Private Key Checker

When you generate an RSA private key (e.g., using OpenSSL or ssh-keygen), it is usually formatted according to Public-Key Cryptography Standards (PKCS).

• PKCS#1: An older standard specifically for RSA keys. The PEM header explicitly says BEGIN RSA PRIVATE KEY.
• PKCS#8: A modern, universal standard that can hold ANY type of private key (RSA, Elliptic Curve, Ed25519). The PEM header generically says BEGIN PRIVATE KEY. Inside the binary payload, an Object Identifier (OID) tells the parser which algorithm to use.

A mathematical quirk of RSA is that the Private Key file actually contains all the numbers necessary to recreate the Public Key.

An RSA private key payload stores several massive integers: the modulus (n), the public exponent (e), and the private exponent (d). Because the modulus and public exponent are physically present inside the private key file, tools (like this one or OpenSSL) can instantly derive and output the matching public key.

Uploading a highly sensitive Private Key to a remote server just to "check" its format is a catastrophic security failure. If the server logs it, your infrastructure is compromised.

This tool uses modern WebAssembly (WASM) and JavaScript libraries to parse the ASN.1/DER binary structure 100% locally in your browser memory. The key never touches a network request.

Keys generated with passwords (encrypted keys) have different headers like BEGIN ENCRYPTED PRIVATE KEY. The binary payload is scrambled using algorithms like PBKDF2 and AES. You cannot parse the structure of an encrypted key without supplying the password first to decrypt the payload back into standard PKCS#8.