JWK ↔ PEM
Convert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.
JWK to PEM converts an RSA or EC key in either direction, defaulting to pem-to-jwk, through crypto.subtle import and export. The JSON arrives with the source PEM label appended on a trailing comment line that begins with two slashes. A kty of OKP is refused: WebCrypto handling of Ed25519 and X25519 differs between runtimes.
Questions
Which keys can it convert?
RSA keys, and EC keys on P-256, P-384 or P-521. Both directions: pem-to-jwk, which is the default mode, and jwk-to-pem. Public and private keys both work; the direction and the key type are detected from the structure rather than from what the file is called.
Why will it not take my Ed25519 key?
It refuses on purpose, with a message that kty "OKP" is not supported because WebCrypto support for Ed25519 and X25519 is inconsistent across runtimes. Getting that silently wrong would be worse than saying no, so it says no. An unknown EC curve is refused the same way, naming P-256, P-384 and P-521 as the ones handled.
What PEM does jwk-to-pem produce?
A SPKI block labelled PUBLIC KEY for a public key, and a PKCS8 block labelled PRIVATE KEY when the JWK has a private component. The choice follows the key itself, so a JWK carrying a d value comes out as a private key PEM.
Why is there a comment line at the end of my JWK?
Because pem-to-jwk appends the source PEM label after the JSON, on a line starting with two slashes. It records what your PEM was labelled. That makes the output not strictly valid JSON, so delete that line before feeding the result to a parser.
Is my private key safe here?
It never leaves the tab. Conversion goes through crypto.subtle import and export in a Web Worker, with nothing uploaded and nothing stored. The tool imports RSA as RSASSA-PKCS1-v1_5 with SHA-256 and EC as ECDSA purely as a way to reach the raw key components, which are the same regardless of that choice.