Introduction
PEM (Privacy-Enhanced Mail, RFC 7468) is the base64-with-headers format used to carry cryptographic keys, certificates, CSRs, and CRLs as text. A PEM file is easy to paste into email, chat, or config files, but its contents are an opaque base64 blob until parsed. This tool inspects PEM encoded keys and certificates, reports the type, algorithm, key size, and parameters, and computes a SHA-256 fingerprint, entirely in your browser.
What this tool does
- Detects the PEM label (PUBLIC KEY, PRIVATE KEY, RSA PUBLIC KEY, EC PRIVATE KEY, CERTIFICATE, OPENSSH PRIVATE KEY, etc.).
- For RSA keys, decodes the modulus, public and private exponents, and primes using node-forge.
- For EC, Ed25519, OpenSSH, and certificate PEM, reports the type, label, and DER size.
- Computes a SHA-256 fingerprint of the underlying DER bytes.
- Generates a sample 1024-bit RSA public key so you can try the tool without your own key.
How this tool works
Paste a PEM block into the input field. The tool extracts the label from the `-----BEGIN ...-----` header, base64-decodes the body to DER bytes, and computes a SHA-256 fingerprint via the WebCrypto API. For RSA keys it calls node-forge to parse the PKCS#1 or PKCS#8 structure and extract the modulus, exponents, and primes. For other key types it reports the detected algorithm and DER size. All computation runs client-side; no key material leaves your browser.
How PEM keys are structured
PEM was originally specified in RFC 1421 (1993) for secure email and re-specified for keys and certificates in RFC 7468 (2015). A PEM block is `-----BEGIN
How to use this tool
- Paste a PEM block (including the BEGIN and END headers) into the input field.
- The tool detects the label, decodes the DER, and computes the fingerprint.
- For RSA keys, the modulus, exponents, and primes are shown in the Parameters card.
- Use Copy on any parameter or the fingerprint to copy it to your clipboard.
- Click Generate sample RSA key to create a 1024-bit key for testing.
Real-world examples
Inspecting an RSA public key
Input: a `-----BEGIN PUBLIC KEY-----` PEM. The tool reports type `public`, algorithm `RSA`, key size in bits, the modulus as hex, the public exponent, and the SHA-256 fingerprint.
Inspecting an EC private key
Input: a `-----BEGIN EC PRIVATE KEY-----` PEM. The tool reports type `private`, algorithm `EC (Elliptic Curve)`, the DER size, and the fingerprint. Full parameter extraction for EC keys is not yet supported.
Inspecting an X.509 certificate
Input: a `-----BEGIN CERTIFICATE-----` PEM. The tool reports algorithm `X.509 Certificate`, the DER size, and the fingerprint. Use the ASN.1/DER Decoder tool to drill into the certificate fields.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| PEM (RFC 7468) | O(n) — base64 + DER parse | Keys, certificates, CSRs as text |
| DER (raw) | O(n) — direct binary | Storage, TLS wire format |
| JWK (RFC 7517) | O(n) — JSON parse | JWT, web crypto APIs |
| OpenSSH | O(n) — custom binary | SSH authorized_keys, known_hosts |
Limitations or considerations
Full parameter extraction is supported only for RSA keys. For EC, Ed25519, OpenSSH, and certificate PEM, the tool reports the type, label, DER size, and fingerprint but does not extract the curve point or certificate fields — use the ASN.1/DER Decoder for those. The 1024-bit sample key is for testing only and is not secure for real use. Never paste a production private key into any online tool; this tool runs entirely in your browser, but you should still treat private keys as sensitive.
Frequently asked questions
Is it safe to paste a private key into this tool?
The tool runs entirely in your browser and sends no data to any server, but you should still treat private keys as sensitive. For real keys, prefer a local tool such as OpenSSL. The sample key generator produces a 1024-bit key that is only suitable for testing.
What is a SHA-256 fingerprint?
It is the SHA-256 hash of the DER bytes underlying the PEM block, displayed as `SHA256:base64`. SSH uses this format (RFC 8709) to identify keys in known_hosts and authorized_keys.
Why does my EC key not show its parameters?
Full parameter extraction is currently supported only for RSA keys. For EC, Ed25519, and OpenSSH keys the tool reports the type, label, DER size, and fingerprint. Use the ASN.1/DER Decoder to inspect the raw structure.
What is the difference between PUBLIC KEY and RSA PUBLIC KEY?
`PUBLIC KEY` is a SubjectPublicKeyInfo (X.509) that wraps the algorithm identifier and the key. `RSA PUBLIC KEY` is a PKCS#1 RSAPublicKey that contains only the modulus and exponent. The tool handles both.
Conclusion
The PEM key parser gives you a fast, browser-based way to inspect PEM encoded keys and certificates, with RSA parameter extraction, SHA-256 fingerprints, and a sample key generator. For full ASN.1 structure inspection of non-RSA keys, pair it with the ASN.1/DER Decoder tool on this site.