Key Inspector

Inspect a PEM, JWK or OpenSSH key: type, size, SHA-256 and SSH fingerprints. Convert between formats and check a key pair. Nothing leaves your browser.

Fact

Your key stays in this tab. Nothing is sent or stored, and the page makes no requests after it loads (check it yourself). Prefer a test key: this covers fjordtools, not your extensions, clipboard or screen.

Key

Tip

The private part is protected by a passphrase, and this page does not decrypt keys. The public key is stored unencrypted in the file, so its facts are below. To inspect the private part, decrypt a copy on your own machine and paste that:

cp id_ed25519 /tmp/copy && ssh-keygen -p -N "" -f /tmp/copy

Tip

This private key is protected by a passphrase, and this page does not decrypt keys. Nothing about the key itself can be read until it is decrypted. Decrypt it on your own machine, then paste the result, or paste just the public key:

openssl pkey -in key.pem -out key-plain.pem
openssl pkey -in key.pem -pubout

SPKI PEM

About Key Inspector

How do I find the fingerprint of an SSH or PEM key?

Paste the key and the fingerprints appear at once. SHA256:… is what ssh-keygen -l, GitHub and GitLab show; the MD5 form is the older style. The SPKI SHA-256 is the hash that OpenSSL tools and certificate pinning use. For a private key, the fingerprints are those of its public key, so they match the public file.

The Sample is the Ed25519 test key published in RFC 8410, so never use it for anything real. Its SSH fingerprint is SHA256:ebCT4wkJOqO5AIlHG03cHvn3Cr3ZZEEh8m81duHhR3Q, the same as ssh-keygen -l prints for it. The JWK thumbprint (RFC 7638) is the SHA-256 of the key's required JWK members, and many JWKS use it as the kid. For other digests of any text or file, use the hash generator.

How do I convert a PEM key to JWK, or JWK to PEM?

Paste either one and open Convert. Public is selected by default: SPKI PEM, JWK and the OpenSSH line. Choose Private to export a private key as PKCS#8, PKCS#1, SEC1 or JWK. A JWKS can hold several keys; pick one in the list. The JWT decoder shows which kid a token expects.

The first line of a PEM block names its format: BEGIN PUBLIC KEY is SPKI, BEGIN PRIVATE KEY is PKCS#8, BEGIN RSA PRIVATE KEY is PKCS#1 and BEGIN EC PRIVATE KEY is SEC1. The lines in between are DER bytes in Base64, which the Base64 decoder can show. An encrypted key is recognised but not decrypted here; openssl pkey -in key.pem -out key-plain.pem decrypts it on your own machine.

Does this public key match my private key?

Open Match and paste the other key, in any format. The page computes the public key of a private key and compares the two exactly, so a PEM private key and an ssh-ed25519 line can be compared directly. This is the check behind OpenSSL's key values mismatch.

Your key stays in this tab, and the note above the key links to a page where you can check that yourself. Still, prefer test keys here: production private keys belong on the machine that uses them, and do not paste secrets into online formatters explains why. For a fresh secret or password, use the password generator.