[{"data":1,"prerenderedAt":805},["ShallowReactive",2],{"navigation":3,"-jwk-pem":167,"-jwk-pem-surround":802},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":122,"body":169,"description":206,"extension":797,"meta":798,"navigation":799,"path":123,"seo":800,"stem":124,"__hash__":801},"content\u002F2.JWK\u002F3.pem.md",{"type":170,"value":171,"toc":787},"minimark",[172,200,232,238,257,269,329,464,469,532,539,554,559,575,582,603,648,651,701,717,721,724,758,766,770,783],[173,174,175,176,180,181,184,185,192,193,199],"p",{},"PEM (",[177,178,179],"code",{},"-----BEGIN PRIVATE KEY-----"," \u002F ",[177,182,183],{},"-----BEGIN PUBLIC KEY-----",") is the key format used by OpenSSL, SSH, most CLI tools, and many legacy systems. unjwt converts between JWK and PEM with ",[186,187,189],"a",{"href":188},"#importpem",[177,190,191],{},"importPEM"," and ",[186,194,196],{"href":195},"#exportpem",[177,197,198],{},"exportPEM",".",[201,202,207],"pre",{"className":203,"code":204,"language":205,"meta":206,"style":206},"language-ts shiki shiki-themes github-light github-dark github-dark","import { importPEM, exportPEM } from \"unjwt\u002Fjwk\";\n","ts","",[177,208,209],{"__ignoreMap":206},[210,211,214,218,222,225,229],"span",{"class":212,"line":213},"line",1,[210,215,217],{"class":216},"so5gQ","import",[210,219,221],{"class":220},"slsVL"," { importPEM, exportPEM } ",[210,223,224],{"class":216},"from",[210,226,228],{"class":227},"sfrk1"," \"unjwt\u002Fjwk\"",[210,230,231],{"class":220},";\n",[233,234,236],"h2",{"id":235},"importpem",[177,237,191],{},[201,239,241],{"className":203,"code":240,"language":205,"meta":206,"style":206},"importPEM(pem, alg, options?)\n",[177,242,243],{"__ignoreMap":206},[210,244,245,248,251,254],{"class":212,"line":213},[210,246,191],{"class":247},"shcOC",[210,249,250],{"class":220},"(pem, alg, options",[210,252,253],{"class":216},"?",[210,255,256],{"class":220},")\n",[173,258,259,260,264,265,268],{},"Parses a PEM string and returns it as a JWK. The PEM ",[261,262,263],"strong",{},"type"," is inferred from the ",[177,266,267],{},"-----BEGIN \u003CX>-----"," label:",[270,271,272,288],"table",{},[273,274,275],"thead",{},[276,277,278,282],"tr",{},[279,280,281],"th",{},"PEM label",[279,283,284,285],{},"Inferred ",[177,286,287],{},"pemType",[289,290,291,304,316],"tbody",{},[276,292,293,298],{},[294,295,296],"td",{},[177,297,179],{},[294,299,300,303],{},[177,301,302],{},"\"pkcs8\""," — private key",[276,305,306,310],{},[294,307,308],{},[177,309,183],{},[294,311,312,315],{},[177,313,314],{},"\"spki\""," — public key",[276,317,318,323],{},[294,319,320],{},[177,321,322],{},"-----BEGIN CERTIFICATE-----",[294,324,325,328],{},[177,326,327],{},"\"x509\""," — X.509 certificate",[201,330,333],{"className":203,"code":331,"filename":332,"language":205,"meta":206,"style":206},"import { importPEM } from \"unjwt\u002Fjwk\";\nimport { readFile } from \"node:fs\u002Fpromises\";\n\nconst pem = await readFile(\".\u002Frsa-private.pem\", \"utf-8\");\nconst jwk = await importPEM(pem, \"RS256\", {\n  extractable: true,\n  jwkParams: { kid: \"rsa-main\", use: \"sig\" },\n});\n","import.ts",[177,334,335,348,363,370,404,428,440,458],{"__ignoreMap":206},[210,336,337,339,342,344,346],{"class":212,"line":213},[210,338,217],{"class":216},[210,340,341],{"class":220}," { importPEM } ",[210,343,224],{"class":216},[210,345,228],{"class":227},[210,347,231],{"class":220},[210,349,351,353,356,358,361],{"class":212,"line":350},2,[210,352,217],{"class":216},[210,354,355],{"class":220}," { readFile } ",[210,357,224],{"class":216},[210,359,360],{"class":227}," \"node:fs\u002Fpromises\"",[210,362,231],{"class":220},[210,364,366],{"class":212,"line":365},3,[210,367,369],{"emptyLinePlaceholder":368},true,"\n",[210,371,373,376,380,383,386,389,392,395,398,401],{"class":212,"line":372},4,[210,374,375],{"class":216},"const",[210,377,379],{"class":378},"suiK_"," pem",[210,381,382],{"class":216}," =",[210,384,385],{"class":216}," await",[210,387,388],{"class":247}," readFile",[210,390,391],{"class":220},"(",[210,393,394],{"class":227},"\".\u002Frsa-private.pem\"",[210,396,397],{"class":220},", ",[210,399,400],{"class":227},"\"utf-8\"",[210,402,403],{"class":220},");\n",[210,405,407,409,412,414,416,419,422,425],{"class":212,"line":406},5,[210,408,375],{"class":216},[210,410,411],{"class":378}," jwk",[210,413,382],{"class":216},[210,415,385],{"class":216},[210,417,418],{"class":247}," importPEM",[210,420,421],{"class":220},"(pem, ",[210,423,424],{"class":227},"\"RS256\"",[210,426,427],{"class":220},", {\n",[210,429,431,434,437],{"class":212,"line":430},6,[210,432,433],{"class":220},"  extractable: ",[210,435,436],{"class":378},"true",[210,438,439],{"class":220},",\n",[210,441,443,446,449,452,455],{"class":212,"line":442},7,[210,444,445],{"class":220},"  jwkParams: { kid: ",[210,447,448],{"class":227},"\"rsa-main\"",[210,450,451],{"class":220},", use: ",[210,453,454],{"class":227},"\"sig\"",[210,456,457],{"class":220}," },\n",[210,459,461],{"class":212,"line":460},8,[210,462,463],{"class":220},"});\n",[465,466,468],"h3",{"id":467},"options","Options",[270,470,471,484],{},[273,472,473],{},[276,474,475,478,481],{},[279,476,477],{},"Option",[279,479,480],{},"Default",[279,482,483],{},"Effect",[289,485,486,498,512],{},[276,487,488,492,495],{},[294,489,490],{},[177,491,287],{},[294,493,494],{},"Inferred from label",[294,496,497],{},"Override explicitly if the label is missing",[276,499,500,505,509],{},[294,501,502],{},[177,503,504],{},"extractable",[294,506,507],{},[177,508,436],{},[294,510,511],{},"Web Crypto extractable flag",[276,513,514,519,522],{},[294,515,516],{},[177,517,518],{},"jwkParams",[294,520,521],{},"—",[294,523,524,525,397,528,531],{},"Extra JWK metadata (",[177,526,527],{},"kid",[177,529,530],{},"use",", ...)",[173,533,534,535,538],{},"Throws ",[177,536,537],{},"ERR_JWK_INVALID"," if:",[540,541,542,549],"ul",{},[543,544,545,546,548],"li",{},"The PEM has no recognizable label and ",[177,547,287],{}," is not supplied.",[543,550,551,552,199],{},"The label doesn't match the requested or inferred ",[177,553,287],{},[233,555,557],{"id":556},"exportpem",[177,558,198],{},[201,560,562],{"className":203,"code":561,"language":205,"meta":206,"style":206},"exportPEM(jwk, options?)\n",[177,563,564],{"__ignoreMap":206},[210,565,566,568,571,573],{"class":212,"line":213},[210,567,198],{"class":247},[210,569,570],{"class":220},"(jwk, options",[210,572,253],{"class":216},[210,574,256],{"class":220},[173,576,577,578,581],{},"Converts a JWK back to a PEM-encoded string. The PEM ",[261,579,580],{},"format"," is inferred from the JWK shape:",[540,583,584,594],{},[543,585,586,587,590,591,593],{},"JWK has ",[177,588,589],{},"d"," (or an equivalent private component) → ",[177,592,302],{}," (private).",[543,595,596,597,599,600,602],{},"No ",[177,598,589],{}," → ",[177,601,314],{}," (public).",[201,604,607],{"className":203,"code":605,"filename":606,"language":205,"meta":206,"style":206},"import { exportPEM } from \"unjwt\u002Fjwk\";\n\nconst pem = await exportPEM(jwk);\n\u002F\u002F \"-----BEGIN PRIVATE KEY-----\\n...base64...\\n-----END PRIVATE KEY-----\\n\"\n","export.ts",[177,608,609,622,626,642],{"__ignoreMap":206},[210,610,611,613,616,618,620],{"class":212,"line":213},[210,612,217],{"class":216},[210,614,615],{"class":220}," { exportPEM } ",[210,617,224],{"class":216},[210,619,228],{"class":227},[210,621,231],{"class":220},[210,623,624],{"class":212,"line":350},[210,625,369],{"emptyLinePlaceholder":368},[210,627,628,630,632,634,636,639],{"class":212,"line":365},[210,629,375],{"class":216},[210,631,379],{"class":378},[210,633,382],{"class":216},[210,635,385],{"class":216},[210,637,638],{"class":247}," exportPEM",[210,640,641],{"class":220},"(jwk);\n",[210,643,644],{"class":212,"line":372},[210,645,647],{"class":646},"sCsY4","\u002F\u002F \"-----BEGIN PRIVATE KEY-----\\n...base64...\\n-----END PRIVATE KEY-----\\n\"\n",[465,649,468],{"id":650},"options-1",[270,652,653,663],{},[273,654,655],{},[276,656,657,659,661],{},[279,658,477],{},[279,660,480],{},[279,662,483],{},[289,664,665,683],{},[276,666,667,672,675],{},[294,668,669],{},[177,670,671],{},"pemFormat",[294,673,674],{},"Inferred from JWK",[294,676,677,679,680,682],{},[177,678,302],{}," or ",[177,681,314],{}," — cert export is not supported",[276,684,685,690,695],{},[294,686,687],{},[177,688,689],{},"alg",[294,691,692],{},[177,693,694],{},"jwk.alg",[294,696,697,698,700],{},"Algorithm hint used when ",[177,699,694],{}," is absent",[702,703,704],"note",{},[173,705,706,709,710,713,714,199],{},[261,707,708],{},"X.509 certificate export is intentionally not supported."," A certificate requires metadata (subject, issuer, validity period, extensions) and a CA signature — none of which a JWK carries. If you need a certificate, generate it with a PKI tool (OpenSSL, ",[177,711,712],{},"step-ca",", your CA's API) and import it with ",[177,715,716],{},"importPEM()",[233,718,720],{"id":719},"deprecated-aliases","Deprecated aliases",[173,722,723],{},"Earlier unjwt versions exposed positional equivalents:",[201,725,727],{"className":203,"code":726,"language":205,"meta":206,"style":206},"\u002F\u002F Deprecated — still work, emit IDE deprecation hints\nimportFromPEM(pem, pemType, alg, options?);\nexportToPEM(jwk, pemFormat, alg?);\n",[177,728,729,734,746],{"__ignoreMap":206},[210,730,731],{"class":212,"line":213},[210,732,733],{"class":646},"\u002F\u002F Deprecated — still work, emit IDE deprecation hints\n",[210,735,736,739,742,744],{"class":212,"line":350},[210,737,738],{"class":247},"importFromPEM",[210,740,741],{"class":220},"(pem, pemType, alg, options",[210,743,253],{"class":216},[210,745,403],{"class":220},[210,747,748,751,754,756],{"class":212,"line":365},[210,749,750],{"class":247},"exportToPEM",[210,752,753],{"class":220},"(jwk, pemFormat, alg",[210,755,253],{"class":216},[210,757,403],{"class":220},[173,759,760,761,180,763,765],{},"These remain for backward compatibility but you should migrate to ",[177,762,191],{},[177,764,198],{}," on touch.",[233,767,769],{"id":768},"see-also","See also",[540,771,772,778],{},[543,773,774,777],{},[186,775,776],{"href":119},"Importing & exporting →"," — for JWK\u002FCryptoKey\u002Fbytes.",[543,779,780,199],{},[186,781,782],{"href":115},"Generating keys →",[784,785,786],"style",{},"html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}",{"title":206,"searchDepth":350,"depth":350,"links":788},[789,792,795,796],{"id":235,"depth":350,"text":191,"children":790},[791],{"id":467,"depth":365,"text":468},{"id":556,"depth":350,"text":198,"children":793},[794],{"id":650,"depth":365,"text":468},{"id":719,"depth":350,"text":720},{"id":768,"depth":350,"text":769},"md",{},{},{"title":122,"description":206},"FrK8IZAeAzui8-dPiZExuvWPHIdhe6kItBT-DozLyHY",[803,804],{"title":118,"path":119,"stem":120,"description":206,"children":-1},{"title":126,"path":127,"stem":128,"description":206,"children":-1},1776888559436]