Tools Home|100% Client-Side

PEM Key Inspector & Public Key Extractor

Inspect, parse, and validate RSA, ECDSA, and Ed25519 PEM keys (PKCS#1, PKCS#8, SPKI) locally in your browser with zero data transmission.

ASN.1 DER Length: 1008 bytes
Key StructureRSA PRIVATE KEY
Modulus / Curve Size2048-bit Modulus
Cryptographic AlgorithmRSA (PKCS#1 / PKCS#8)
SHA-256 Key Fingerprint-
Paste PEM Key (Private or Public)1426 chars
Extracted Public Key (SPKI PEM)
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0YqL3l+Y7i8Q6K6S7h7G
1B5v4W8d3n+K3e7Y8a9c2d1e0f4g5h6i7j8k9l0m1n2o3p4q5r6s7t8u9v0w1x2y
3z4A5B6C7D8E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3T4U5V6W7X8Y9Z0a1b2c3d4e
5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6A7B8C9D0E1F2G3H4I5J6K
7L8M9N0O1P2Q3R4S5T6U7V8W9X0Y1Z2a3b4c5d6e7f8g9h0i1j2k3l4m5n6o7p8q
9r0s1t2u3v4w5x6y7z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W
1X2Y3Z0a1b2c3d4e5f6g7h8i9j0kAgMBAAE=
-----END PUBLIC KEY-----

Zero Cryptographic Upload

Your production RSA and EC private keys never leave your device. All Base64 DER decoding and fingerprinting occur in your browser sandbox.

Multi-Standard ASN.1 Support

Seamlessly handles PKCS#1 RSA keys, PKCS#8 universal envelopes, SPKI public certificates, and SEC1 elliptic curve structures.

SHA-256 Fingerprinting

Automatically generates standard colon-delimited SHA-256 key fingerprints for quick verification with SSH hosts and TLS certificates.

Technical Reference & Architecture Guide

PEM Key Structure & Cryptography Developer Guide — Reference Guide

Technical guide to decoding ASN.1 DER encodings, distinguishing PKCS#1 vs PKCS#8 formats, computing key fingerprints, and extracting public keys locally.

Key Parameters & Controls

pemBlockstring

Base64-encoded ASCII PEM block containing header and footer boundaries.

keyFormatenum ('PKCS#1' | 'PKCS#8' | 'SPKI' | 'SEC1')

Structural standard defining the cryptographic key envelope.

keyTypeenum ('RSA' | 'EC' | 'Ed25519')

Underlying mathematical asymmetric cryptographic algorithm.

fingerprintAlgoenum ('SHA-256' | 'MD5')

Cryptographic hash algorithm used for public key fingerprinting.

Pro Tips & Best Practices

PKCS#8 keys (-----BEGIN PRIVATE KEY-----) are standard for modern frameworks and can contain RSA, ECDSA, or Ed25519 keys.

Always verify SHA-256 fingerprints when deploying SSH or TLS keys to prevent man-in-the-middle substitutions.

Extracting public keys directly from private keys eliminates the need to maintain separate public key files on disk.

Common Gotchas & Troubleshooting

Ensure line wrapping is consistent and header/footer hyphens are not omitted.

Decrypt the key using your passphrase before inspection, as ciphertext obscures ASN.1 metadata.

Frequently Asked Questions

Are my private keys uploaded to your server?▼

Never. All ASN.1 decoding and Web Crypto key imports happen 100% in your local browser sandbox.

What is the difference between PKCS#1 and PKCS#8?▼

PKCS#1 is RSA-specific (BEGIN RSA PRIVATE KEY), while PKCS#8 is an algorithm-independent wrapper (BEGIN PRIVATE KEY).

Can I extract the corresponding public key from a private key?▼

Yes, our tool extracts and formats the standard SPKI public key PEM block with one click.

Which elliptic curves are supported for EC keys?▼

P-256 (secp256r1), P-384, P-521, and Ed25519 key structures.

Related Tools & Utilities

All Tools →
TOTP / 2FA Token Generator & Authenticator Debuggersecurity

Generate RFC 6238 time-based one-time passwords (TOTP), test 2FA secret keys, inspect otpauth:// URIs, and simulate token countdowns client-side.

Open tool→
JWT Secret Checker & Weak Key Audit (HMAC-SHA256/384/512)security

Audit JWT tokens locally for known weak HMAC secret keys, brute-force dictionary vulnerabilities, and verify signatures against custom candidate secrets.

Open tool→
SSH Key Fingerprint Calculator & Randomart Visualizersecurity

Inspect OpenSSH public keys (RSA, Ed25519, ECDSA), compute SHA-256 and MD5 fingerprints, and generate authentic OpenSSH ASCII Randomart visual art.

Open tool→
Punycode & IDN Domain Converter (RFC 3492 & Spoofing Detector)security

Convert internationalized domain names (IDN) bidirectionally between Unicode and ASCII Punycode (xn--) with built-in homograph attack and script spoofing analysis.

Open tool→
JWT Token Decoder & Security Inspectorsecurity

Decode JSON Web Tokens, inspect header/payload claims, calculate expiration time and verify integrity locally.

Open tool→
Cryptographically Secure Password Generatorsecurity

Generate ultra-secure passwords using Web Crypto API with custom length, symbols, and memorability.

Open tool→