There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to convert a key between PEM, DER, and JWK
- Paste the key. Drop in the key in whatever format you have — PEM, DER, or JWK.
- Pick the target. Choose the format you need to produce.
- Convert. The key is re-encoded locally into the target representation.
- Copy or download. Take the converted key into your tool or config.
Keys move between tools constantly, and the friction is almost always the wrapper, not the key — a service that only accepts JWK, a binary that wants raw DER, a config expecting a PEM block. This converter handles the wrapper so you don't hand-edit Base64 by hand.
It covers public keys as SPKI and private keys as PKCS8, across PEM, DER (hex or Base64), and JWK. Because it's just structure translation, the result is byte-for-byte the same key in a new coat.
Generate the key first with the Key pair generator, verify a certificate that carries the public key in the X.509 decoder, or use it to check a token in the JWT decoder.
Frequently asked questions
Why do I need to convert key formats?
Different stacks want different encodings: OpenSSL and most servers use PEM, some binaries want DER, and web/JOSE libraries use JWK. Converting lets one key work across all of them.
Does converting change the key itself?
No. Conversion only re-encodes the same key material into another representation — the underlying key is identical, so anything encrypted or signed with it still matches.
Is my private key sent anywhere?
No. The re-encoding uses in-browser text and binary utilities on your device; the key is transformed locally and never uploaded.