How to convert a PEM public key to a JWK and back in Kotlin

1import io.jsonwebtoken.security.Jwks
2import io.jsonwebtoken.security.PublicJwk
3import java.io.File
4import java.security.KeyFactory
5import java.security.interfaces.ECPublicKey
6import java.security.spec.X509EncodedKeySpec
7import java.util.Base64
8 
9fun main() {
10    // PEM -> JWK: the JDK reads the SPKI, JJWT builds and serializes the JWK
11    val der = Base64.getMimeDecoder().decode(File("pub.pem").readText().replace(Regex("-----[^-]+-----"), ""))
12    val key = KeyFactory.getInstance("EC").generatePublic(X509EncodedKeySpec(der)) as ECPublicKey
13    val json = Jwks.json(Jwks.builder().key(key).build())
14    File("out.jwk.json").writeText(json)
15    println(json)
16 
17    // JWK -> PEM: parse the JWK, getEncoded() of its key is the SPKI DER
18    val jwk = Jwks.parser().build().parse(File("pub.jwk.json").readText()) as PublicJwk<*>
19    val body = Base64.getMimeEncoder(64, "\n".toByteArray()).encodeToString(jwk.toKey().encoded)
20    val pem = "-----BEGIN PUBLIC KEY-----\n$body\n-----END PUBLIC KEY-----\n"
21    File("out.pem").writeText(pem)
22    print(pem)
23}

How it works

1. The PEM armour is removed and the body decoded with the MIME decoder; X509EncodedKeySpec reads the SPKI as an ECPublicKey.
2. Jwks.builder().key(key).build() returns an EcPublicJwk; Jwks.json(jwk) writes it as JSON.
3. Jwks.parser().build().parse(json) validates the JWK (curve, point) and returns a PublicJwk for a public key.
4. toKey().encoded is the SPKI DER; the MIME encoder with 64-character lines rebuilds the PEM.

Gotchas

• Jwks.json accepts only a PublicJwk, so a private JWK cannot be serialized with it by accident; toString() of a private JWK prints <redacted> for secret members. Other JSON serializers handed a private Jwk get no such protection.
• Jwks.builder().key(…) needs the key's static type: with ECPublicKey (as here) the EC overload applies; with a plain PublicKey, Kotlin needs explicit type arguments.
• Parsing a JWK needs jjwt-impl and a JSON module (jjwt-gson or jjwt-jackson) at runtime, like every other JJWT operation.
• The JDK's KeyFactory cannot read BEGIN EC PRIVATE KEY or certificate PEM files; this route is for BEGIN PUBLIC KEY blocks.

Related recipes

• How to compute a JWK thumbprint (RFC 7638) in Kotlin
• How to verify a JWT with a JWKS in Kotlin
• How to convert a PEM public key to a JWK and back in Java
• How to convert a PEM public key to a JWK and back in Swift