The Big LearnThe Big Learn
The Big Learn
Certificate to JWK

Certificate or key

Any format: .pem, .crt, .cer, .der, .pfx, .p12, .p7b, .key, .csr… You can also drop a file here. PFX/P12 files and encrypted keys ask for their password.

Everything runs locally in your browser. No file, key or password is uploaded.

How it works

  1. Paste a certificate or key, or load a file in any format. PFX/P12 and encrypted keys ask for their password.
  2. A certificate or public key gives the public JWK: kty, n, e, alg, use and kid for RSA (crv, x, y for EC).
  3. A PFX/P12 or a private key also gives the private JWK, with the same members plus d, p, q, dp, dq and qi (just d for EC).

Both JWKs carry the same kid, so a token signed with the private key is matched to the public key in a JWKS. The default kid is the RFC 7638 thumbprint, which depends only on the key; the certificate's SHA-1 thumbprint (x5t) is what Microsoft Entra ID and AD FS publish. RSA, EC (P-256, P-384, P-521, secp256k1) and Ed25519/Ed448 keys are supported.