PEM, JWK & OpenSSH Converter

One key, many formats

The same key is written differently depending on who reads it:

• PEM is Base64 between -----BEGIN …----- lines. The header names the structure inside: PUBLIC KEY (SPKI), PRIVATE KEY (PKCS#8), RSA PUBLIC KEY / RSA PRIVATE KEY (PKCS#1), and EC PRIVATE KEY (SEC1).
• JWK is JSON, used by JOSE libraries, OIDC providers, and cloud key services. A JWKS document wraps keys in a "keys" array.
• OpenSSH is the ssh-ed25519 AAAAC3… line you put in authorized_keys, and the -----BEGIN OPENSSH PRIVATE KEY----- file ssh-keygen writes.

This tool reads any of them and writes all the others at once, so you can move a key between a Kubernetes secret, a JWKS endpoint, and an SSH server without installing OpenSSL.

How to convert a key

1. Paste the key. The source format is detected automatically; override the selector if the auto-detection disagrees. Paste one key at a time — with several key lines, only the first is converted.
2. Pick the output tab you need — every format is generated at the same time.
3. Copy or download that tab. The download uses the conventional file name for the format (public.pem, private.jwk, public.pub, openssh_private).

Private key outputs are hidden until you tick Reveal private key output, so a screenshare or a copied window never shows a secret by accident.

For OpenSSH output, the optional comment field fills the trailing comment of the authorized_keys line, for example deploy@ci.

Fingerprints

The Fingerprints tab reports four values for the same key:

• SHA256:… — the default ssh-keygen -lf fingerprint: Base64 of the SHA-256 digest of the SSH public key blob, without padding.
• MD5:… — the legacy ssh-keygen -E md5 form, colon-separated lowercase hex.
• JWK thumbprint — RFC 7638: SHA-256 over the canonical JWK members, Base64url. This is what kid values are usually derived from.
• SPKI SHA-256 — SHA-256 of the DER SPKI encoding, Base64. Certificate pinning and expect-ct style configuration use this form.

What this tool does not do

• Encrypted keys. PBES2 (BEGIN ENCRYPTED PRIVATE KEY) and passphrase-protected OpenSSH keys need a password KDF. Decrypt first: openssl pkcs8 -in key.pem -out plain.pem, or ssh-keygen -p -m PKCS8.
• PKCS#12 / .p12 / .pfx, which bundle a key with a certificate chain.
• X.509 certificates. Use the X.509 Certificate Decoder to inspect them.
• DSA, secp256k1, Ed448. RSA, P-256, P-384, P-521, Ed25519 and X25519 are supported.
• Signing or encrypting. This is a format converter, not a crypto workbench.

When a private key does not carry its public half (Ed25519 and X25519 seeds never do, and an EC key written with openssl ec -no_public does not either), the public key is derived with WebCrypto. A browser without Ed25519 or X25519 support cannot do that one step; every other conversion works offline in any current browser.

Privacy

Keys are parsed and converted in your browser with no network requests, so a private key never leaves the page. An OpenSSH private key this tool writes is unencrypted — if you download one, protect the file (chmod 600) and add a passphrase with ssh-keygen -p before using it.

Frequently asked questions

Why does my PEM start with BEGIN RSA PRIVATE KEY?

That is PKCS#1, the legacy RSA-only encoding. Paste it here and download the PKCS#8 tab (BEGIN PRIVATE KEY) when a library wants the modern container.

Is a JWK private key the same secret as the PEM one?

Yes. Both carry the private exponent, so treat the JWK d (plus p, q, dp, dq, qi) exactly like the PEM private key.

Why is my cloud console's fingerprint different from the one here?

Consoles often hash the key rather than the SSH wire blob, or use SHA-1. Compare the fingerprint that hashes the same bytes: this tool's SHA256: line matches ssh-keygen -lf id_ed25519.pub.