www.alpagot.net/jwks-to-pem · keys, unwrapped

JWKS to PEM

Paste a JSON Web Key Set, or give the URL of one, and get each RSA key back as a PEM public key, plus a base64 copy for one-line config. Conversion happens at the Fastly edge nearest you. Nothing is logged or stored.

WHAT IT DOES

From key set to public key

Identity providers publish their signing keys as a JWKS (RFC 7517): JSON, with each RSA key’s modulus n and exponent e base64url encoded. Plenty of software wants a PEM instead: an X.509 SubjectPublicKeyInfo, DER encoded and wrapped in base64 between BEGIN PUBLIC KEY lines.

This page does that conversion, one result per key, matched by kid. Only RSA keys are converted; other key types in the set are listed with a note rather than failing the whole request.

UNDER THE HOOD

Rust on Fastly Compute

The converter is a small Rust program compiled to WebAssembly and run on Fastly Compute. It builds the DER by hand: an RSAPublicKey sequence of two INTEGERs, wrapped in a BIT STRING beside the rsaEncryption algorithm identifier. Fetching a URL uses a dynamic backend created for that host on the fly, over HTTPS only, with tight timeouts and a size cap.

It lives on www.alpagot.net next to its siblings, stitched onto one hostname with Fastly Request Routing: blog · geoip · tls · device · h3 · http.