Introduction
Cryptographic keys come in many formats: PEM (SPKI for public keys, PKCS#8 for private keys), JWK (RFC 7517 JSON), and raw hex bytes for symmetric keys. Converting between them is a routine task when wiring a JWT library to a TLS stack, or when importing a key generated by OpenSSL into a WebCrypto-based application. This tool converts keys between PEM, JWK, and hex formats, entirely in your browser via the WebCrypto API.
What this tool does
- Converts between PEM (SPKI public), PEM (PKCS#8 private), JWK (JSON Web Key), and raw hex.
- Supports RSA, ECDSA (P-256/P-384/P-521), Ed25519, and symmetric octet keys.
- Auto-detects the key type and reports it as a badge on the output.
- Provides a swap button to reverse the conversion direction in one click.
- Processes all data locally in your browser with no network requests.
How this tool works
Pick an input and output format, paste your key, and the tool converts it. For PEM inputs it calls the jose library's `importSPKI` or `importPKCS8`; for JWK it calls `importJWK`; for hex it treats the bytes as a symmetric secret. For PEM and JWK outputs it calls `exportSPKI`, `exportPKCS8`, or `exportJWK`; for hex it base64url-decodes the `k` member of an octet JWK. The swap button reverses the formats and feeds the previous output back as input. All computation runs client-side via WebCrypto.
How key formats relate
The three formats serve different ecosystems. PEM (RFC 7468) is the base64-with-headers text format used by OpenSSL, TLS, and most config files; SPKI (SubjectPublicKeyInfo, X.509) wraps a public key with its algorithm identifier, and PKCS#8 (RFC 5208) wraps a private key with its algorithm identifier. JWK (RFC 7517) is the JSON format used by JWT, JWS, JWE, and the WebCrypto API's `exportKey`. Raw hex is the natural format for symmetric keys when you want to inspect or embed the bytes directly. The WebCrypto API is the browser's native cryptographic primitive layer; it accepts and returns `CryptoKey` objects that can be exported to SPKI, PKCS#8, or JWK. The jose library used by this tool wraps WebCrypto to handle the format-specific encoding.
How to use this tool
- Pick the input format (PEM SPKI, PEM PKCS#8, JWK, or hex).
- Pick the output format, or click the swap button to reverse the direction.
- Paste your key into the input field.
- The converted key appears instantly in the output area.
- Use Copy to copy the result to your clipboard.
Real-world examples
PEM public key to JWK
Input: a `-----BEGIN PUBLIC KEY-----` PEM. Output: a JWK JSON object with `kty`, `n`, `e` (for RSA) or `crv`, `x`, `y` (for EC), ready to paste into a JWKS endpoint.
JWK to PEM PKCS#8
Input: a private JWK with `d`. Output: a `-----BEGIN PRIVATE KEY-----` PEM suitable for OpenSSL or a TLS stack.
Hex secret to JWK
Input: 32 bytes of hex. Output: a JWK with `kty: oct` and a base64url `k` member, ready to use as an HS256 signing key.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| PEM (SPKI/PKCS#8) | O(n) — base64 + DER | TLS, OpenSSL, config files |
| JWK (RFC 7517) | O(n) — JSON parse | JWT, JWS, JWE, JWKS, WebCrypto |
| Raw hex | O(n) — direct bytes | Symmetric keys, debugging, embedding |
| OpenSSH | O(n) — custom binary | SSH authorized_keys, known_hosts |
Limitations or considerations
Converting a public key to PKCS#8 private is rejected because PKCS#8 wraps a private key. Hex output is only supported for symmetric `oct` keys; asymmetric keys do not have a single canonical byte representation. The tool does not validate that an EC public point lies on its curve or that an RSA private key is mathematically consistent. Never paste a production private key into any online tool; this tool runs entirely in your browser, but you should still treat private keys as sensitive.
Frequently asked questions
Can I convert a public key to a private key?
No. A public key does not contain the private components, so no conversion can produce a private key. The tool rejects attempts to export a public key as PKCS#8 private.
Why is hex output only available for symmetric keys?
Asymmetric keys (RSA, EC, Ed25519) do not have a single canonical byte representation; they are structured objects. Symmetric `oct` keys are a single byte string, so hex is a natural format for them.
What is the difference between SPKI and PKCS#8?
SPKI (SubjectPublicKeyInfo, X.509) wraps a public key with its algorithm identifier. PKCS#8 (RFC 5208) wraps a private key with its algorithm identifier. Both are DER-encoded and usually base64-wrapped as PEM.
Is it safe to paste a private key here?
The tool runs entirely in your browser and sends no data to any server, but you should still treat private keys as sensitive. For production keys, prefer a local tool such as OpenSSL or your runtime's key management service.
Conclusion
The key format converter gives you a fast, browser-based way to move cryptographic keys between PEM, JWK, and hex formats. With support for RSA, ECDSA, Ed25519, and symmetric keys, a one-click swap button, and a fully client-side implementation via WebCrypto, it is a handy tool for anyone wiring JWT libraries to TLS stacks or importing OpenSSL keys into web applications.