PEM Key Inspector
Paste a PEM-encoded public or private key to see its algorithm, size or curve, and JWK representation — a quick sanity check before wiring a key into config.
How to use it
Paste any SPKI public key (BEGIN PUBLIC KEY) or PKCS8 private key (BEGIN PRIVATE KEY) and click Inspect. The tool tries RSA first, then EC (P-256/P-384/P-521), and reports whichever import succeeds.
PEM is a container, not an algorithm
PEM wraps Base64-encoded binary data between readable begin and end labels. The label tells software what structure to decode; it does not identify every cryptographic parameter by itself. A public key, private key, certificate, certificate request, and encrypted private key can all use PEM-style text while containing different binary formats. This inspector accepts supported key structures, not arbitrary PEM objects.
Recognize common key labels
BEGIN PUBLIC KEY normally contains an SPKI public key and BEGIN PRIVATE KEY normally contains an unencrypted PKCS8 private key. Older BEGIN RSA PRIVATE KEY and BEGIN EC PRIVATE KEY blocks use algorithm-specific formats that the browser import path here does not accept directly. BEGIN CERTIFICATE contains an X.509 certificate, not just a bare key, so use certificate-specific tooling when you need subject, issuer, validity, or chain information.
What inspection proves
A successful import shows that the browser can parse the key as one of the supported RSA or elliptic-curve structures and export its public parameters as JWK. It does not prove ownership, trust, certificate validity, intended usage, revocation status, or that a remote service uses the matching private key. Compare a trusted fingerprint or public parameters through an authenticated channel when identity matters.
Public and private key handling
Public keys are designed to be distributed, but their source and association with an identity still matter. Private keys must remain secret. Although parsing occurs locally and no key is uploaded, pasting a production private key into any browser page increases exposure through the clipboard, extensions, screen capture, crash reporting, or other software on the device. Prefer a non-production key or inspect sensitive material with a controlled offline command-line workflow.
RSA and EC parameters
For RSA, key size and exponent are important compatibility and policy inputs. For EC, the named curve must match what the protocol and verifier support. A parseable key is not automatically acceptable: an application may require a minimum RSA size, a specific curve, a particular signature algorithm, or hardware-backed storage. Enforce those requirements where the key is actually used.
Move between PEM and JWK carefully
JWK represents public parameters as JSON fields, while SPKI PEM packages a public key in a binary structure with text armor. Use JWKS to PEM Converter for the opposite public-key conversion and JWKS Inspector to review a published set. Conversion changes representation, not trust. Preserve the original key source, expected algorithm, and kid mapping separately.
Frequently Asked Questions
What about older key formats?
PKCS1 (BEGIN RSA PRIVATE KEY) and SEC1 (BEGIN EC PRIVATE KEY) formats aren't supported directly — Web Crypto only imports PKCS8. Convert with openssl pkcs8 -topk8 first.
Is my private key uploaded anywhere?
No — all parsing happens locally via the browser's Web Crypto API. Still, treat any tool (including this one) with caution for production private keys; prefer testing with non-production keys where possible.
Can this inspect an X.509 certificate?
No. A certificate contains identity, issuer, validity, and signature data around a public key and needs certificate-specific parsing.