Convert PEM keys to JWK and read JWKS

Turn a PEM public or private key (or a certificate) into a JSON Web Key, convert a JWK back to PEM, and inspect every key in a JWKS document with its key ID and RFC 7638 thumbprint. Useful for OAuth, OpenID Connect and JWT setups. Runs in your browser.

What you can do

• PEM, DER or certificate → JWK (public or private)
• JWK → PEM (SPKI or PKCS#8)
• JWKS viewer with key type, size, use and key ID
• RFC 7638 thumbprints
• RSA, EC P-256/P-384/P-521 and Ed25519

Frequently asked questions

What is a JWK thumbprint?

An RFC 7638 thumbprint is a SHA-256 hash of a key's required JWK members in a fixed order. It identifies the key and is often used as its kid.

Can I convert a private key to a JWK?

Yes. The JWK then includes the private members (such as d), so treat it as a secret, just like the PEM key.

Where do I find an identity provider's JWKS?

At the jwks_uri listed in its /.well-known/openid-configuration document. PKIScope never fetches URLs, so open that address yourself and paste the JSON.

Related tools

• JWT decoder — Decode and verify JWTs with a key, JWKS or x5c chain
• Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
• SSH key viewer — Read SSH keys and certificates with fingerprints