[{"data":1,"prerenderedAt":354},["ShallowReactive",2],{"tool-content-en-key-format-converter":3},{"id":4,"title":5,"body":6,"description":344,"extension":345,"locale":346,"meta":347,"navigation":348,"path":349,"seo":350,"stem":351,"toolId":352,"__hash__":353},"tools\u002Ftools\u002Fen\u002Fkey-format-converter.md","PEM, JWK & OpenSSH Converter",{"type":7,"value":8,"toc":328},"minimark",[9,14,18,90,93,97,123,130,140,144,147,189,193,242,249,253,268,272,281,288,292,314,318],[10,11,13],"h2",{"id":12},"one-key-many-formats","One key, many formats",[15,16,17],"p",{},"The same key is written differently depending on who reads it:",[19,20,21,54,68],"ul",{},[22,23,24,28,29,33,34,37,38,41,42,45,46,49,50,53],"li",{},[25,26,27],"strong",{},"PEM"," is Base64 between ",[30,31,32],"code",{},"-----BEGIN …-----"," lines. The header names the structure inside: ",[30,35,36],{},"PUBLIC KEY"," (SPKI), ",[30,39,40],{},"PRIVATE KEY"," (PKCS#8), ",[30,43,44],{},"RSA PUBLIC KEY"," \u002F ",[30,47,48],{},"RSA PRIVATE KEY"," (PKCS#1), and ",[30,51,52],{},"EC PRIVATE KEY"," (SEC1).",[22,55,56,59,60,63,64,67],{},[25,57,58],{},"JWK"," is JSON, used by JOSE libraries, OIDC providers, and cloud key services. A ",[25,61,62],{},"JWKS"," document wraps keys in a ",[30,65,66],{},"\"keys\""," array.",[22,69,70,73,74,77,78,81,82,85,86,89],{},[25,71,72],{},"OpenSSH"," is the ",[30,75,76],{},"ssh-ed25519 AAAAC3…"," line you put in ",[30,79,80],{},"authorized_keys",", and the ",[30,83,84],{},"-----BEGIN OPENSSH PRIVATE KEY-----"," file ",[30,87,88],{},"ssh-keygen"," writes.",[15,91,92],{},"This tool reads any of them and writes all the others at once, so you can move a key between a Kubernetes secret, a JWKS endpoint, and an SSH server without installing OpenSSL.",[10,94,96],{"id":95},"how-to-convert-a-key","How to convert a key",[98,99,100,103,106],"ol",{},[22,101,102],{},"Paste the key. The source format is detected automatically; override the selector if the auto-detection disagrees. Paste one key at a time — with several key lines, only the first is converted.",[22,104,105],{},"Pick the output tab you need — every format is generated at the same time.",[22,107,108,109,112,113,112,116,112,119,122],{},"Copy or download that tab. The download uses the conventional file name for the format (",[30,110,111],{},"public.pem",", ",[30,114,115],{},"private.jwk",[30,117,118],{},"public.pub",[30,120,121],{},"openssh_private",").",[15,124,125,126,129],{},"Private key outputs are hidden until you tick ",[25,127,128],{},"Reveal private key output",", so a screenshare or a copied window never shows a secret by accident.",[15,131,132,133,135,136,139],{},"For OpenSSH output, the optional comment field fills the trailing comment of the ",[30,134,80],{}," line, for example ",[30,137,138],{},"deploy@ci",".",[10,141,143],{"id":142},"fingerprints","Fingerprints",[15,145,146],{},"The Fingerprints tab reports four values for the same key:",[19,148,149,159,169,179],{},[22,150,151,154,155,158],{},[30,152,153],{},"SHA256:…"," — the default ",[30,156,157],{},"ssh-keygen -lf"," fingerprint: Base64 of the SHA-256 digest of the SSH public key blob, without padding.",[22,160,161,164,165,168],{},[30,162,163],{},"MD5:…"," — the legacy ",[30,166,167],{},"ssh-keygen -E md5"," form, colon-separated lowercase hex.",[22,170,171,174,175,178],{},[30,172,173],{},"JWK thumbprint"," — RFC 7638: SHA-256 over the canonical JWK members, Base64url. This is what ",[30,176,177],{},"kid"," values are usually derived from.",[22,180,181,184,185,188],{},[30,182,183],{},"SPKI SHA-256"," — SHA-256 of the DER SPKI encoding, Base64. Certificate pinning and ",[30,186,187],{},"expect-ct"," style configuration use this form.",[10,190,192],{"id":191},"what-this-tool-does-not-do","What this tool does not do",[19,194,195,212,224,230,236],{},[22,196,197,200,201,204,205,208,209,139],{},[25,198,199],{},"Encrypted keys."," PBES2 (",[30,202,203],{},"BEGIN ENCRYPTED PRIVATE KEY",") and passphrase-protected OpenSSH keys need a password KDF. Decrypt first: ",[30,206,207],{},"openssl pkcs8 -in key.pem -out plain.pem",", or ",[30,210,211],{},"ssh-keygen -p -m PKCS8",[22,213,214,223],{},[25,215,216,217,45,220],{},"PKCS#12 \u002F ",[30,218,219],{},".p12",[30,221,222],{},".pfx",", which bundle a key with a certificate chain.",[22,225,226,229],{},[25,227,228],{},"X.509 certificates."," Use the X.509 Certificate Decoder to inspect them.",[22,231,232,235],{},[25,233,234],{},"DSA, secp256k1, Ed448."," RSA, P-256, P-384, P-521, Ed25519 and X25519 are supported.",[22,237,238,241],{},[25,239,240],{},"Signing or encrypting."," This is a format converter, not a crypto workbench.",[15,243,244,245,248],{},"When a private key does not carry its public half (Ed25519 and X25519 seeds never do, and an EC key written with ",[30,246,247],{},"openssl ec -no_public"," does not either), the public key is derived with WebCrypto. A browser without Ed25519 or X25519 support cannot do that one step; every other conversion works offline in any current browser.",[10,250,252],{"id":251},"privacy","Privacy",[15,254,255,256,259,260,263,264,267],{},"Keys are parsed and converted in your browser with no network requests, so a private key never leaves the page. An OpenSSH private key this tool writes is ",[25,257,258],{},"unencrypted"," — if you download one, protect the file (",[30,261,262],{},"chmod 600",") and add a passphrase with ",[30,265,266],{},"ssh-keygen -p"," before using it.",[10,269,271],{"id":270},"frequently-asked-questions","Frequently asked questions",[273,274,276,277,280],"h3",{"id":275},"why-does-my-pem-start-with-begin-rsa-private-key","Why does my PEM start with ",[30,278,279],{},"BEGIN RSA PRIVATE KEY","?",[15,282,283,284,287],{},"That is PKCS#1, the legacy RSA-only encoding. Paste it here and download the PKCS#8 tab (",[30,285,286],{},"BEGIN PRIVATE KEY",") when a library wants the modern container.",[273,289,291],{"id":290},"is-a-jwk-private-key-the-same-secret-as-the-pem-one","Is a JWK private key the same secret as the PEM one?",[15,293,294,295,298,299,112,301,112,304,112,307,112,310,313],{},"Yes. Both carry the private exponent, so treat the JWK ",[30,296,297],{},"d"," (plus ",[30,300,15],{},[30,302,303],{},"q",[30,305,306],{},"dp",[30,308,309],{},"dq",[30,311,312],{},"qi",") exactly like the PEM private key.",[273,315,317],{"id":316},"why-is-my-cloud-consoles-fingerprint-different-from-the-one-here","Why is my cloud console's fingerprint different from the one here?",[15,319,320,321,324,325,139],{},"Consoles often hash the key rather than the SSH wire blob, or use SHA-1. Compare the fingerprint that hashes the same bytes: this tool's ",[30,322,323],{},"SHA256:"," line matches ",[30,326,327],{},"ssh-keygen -lf id_ed25519.pub",{"title":329,"searchDepth":330,"depth":330,"links":331},"",2,[332,333,334,335,336,337],{"id":12,"depth":330,"text":13},{"id":95,"depth":330,"text":96},{"id":142,"depth":330,"text":143},{"id":191,"depth":330,"text":192},{"id":251,"depth":330,"text":252},{"id":270,"depth":330,"text":271,"children":338},[339,342,343],{"id":275,"depth":340,"text":341},3,"Why does my PEM start with BEGIN RSA PRIVATE KEY?",{"id":290,"depth":340,"text":291},{"id":316,"depth":340,"text":317},"Convert RSA, EC and Ed25519 keys between PEM, JWK\u002FJWKS and OpenSSH formats and read SHA-256, MD5 and JWK thumbprint fingerprints. Nothing is uploaded.","md","en",{},true,"\u002Ftools\u002Fen\u002Fkey-format-converter",{"title":5,"description":344},"tools\u002Fen\u002Fkey-format-converter","key-format-converter","C3uj_oDb5PnFLqjJoO4Nd9VjVhYuHjFuZljKeYXwvJA",1792391418982]