JWK Generator & PEM ↔ JWK Converter
Generate JSON Web Keys (RSA, EC P-256/384/521, Ed25519, HMAC) with use, alg and an RFC 7638 thumbprint kid, a JWKS, and convert PEM ↔ JWK in your browser.
A JSON Web Key (JWK, RFC 7517) is a key written as JSON, used by OAuth 2.0, OpenID Connect and JWT libraries; a JWKS is the list of public keys a server publishes so others can verify its tokens. This tool generates RSA, EC, Ed25519 and symmetric keys as JWKs with use, alg and a stable kid (the RFC 7638 thumbprint), wraps the public key in a JWKS, and converts PEM keys to JWK and back.
How to use this tool
- Choose generate, PEM → JWK or JWK → PEM.
- To generate, pick the key type and whether it is for signatures or encryption.
- To convert, paste a PEM key (public, private, PKCS#1, SEC1 or a certificate) or a JWK.
- Publish the public JWK or JWKS; keep the private JWK and PEM secret.
Formula
kid = Base64URL( SHA-256( {"e":…,"kty":"RSA","n":…} ) ) (RFC 7638 thumbprint)
Only the required members are hashed, in lexicographic order and without spaces: e, kty, n for RSA; crv, kty, x, y for EC; crv, kty, x for Ed25519; k, kty for symmetric keys. The thumbprint therefore stays the same however the JWK is formatted. alg defaults to RS256, ES256/384/512, EdDSA or HS256/384/512 (RSA-OAEP-256 or ECDH-ES for encryption keys).
Example
The example RSA key in RFC 7638 §3.1 (n = 0vx7agoebGcQ…, e = AQAB) has the thumbprint NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs; converting it to PEM gives a 2048-bit "BEGIN PUBLIC KEY" block. A generated P-384 signing key comes out with "alg": "ES384" and its own thumbprint as the kid.
Frequently asked questions
What goes in my JWKS endpoint?
Only public keys: the "JWKS (public…)" output. Never publish a JWK that contains "d" (private RSA/EC/Ed25519 part) or "k" (symmetric secret).
Why use the thumbprint as kid?
It is derived from the key itself, so it is unique, stable and needs no bookkeeping. Verifiers pick the right key from a JWKS by matching the token header’s kid.
Which key type should I choose?
ES256 (EC P-256) keys are small and fast and widely supported; RS256 (RSA 2048+) is the most compatible; Ed25519 is modern and fast but not supported everywhere yet. Use symmetric keys only when the same party signs and verifies.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/jwk-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). JWK Generator & PEM ↔ JWK Converter. https://kakao.mobile/tools/jwk-generator/
“JWK Generator & PEM ↔ JWK Converter.” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/jwk-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms