usefulweb.site RSA/ECC Key Inspector

Cryptography & security tools

RSA/ECC Key Inspector

Inspect PEM, DER, JWK or OpenSSH keys: type, size, curve, fingerprints, thumbprint and weaknesses.

Public keys are best. Never paste production private keys into any web tool. With JavaScript on, private keys are converted to their public key in your browser before anything is sent.

Try an example: RSA-2048 public key (PEM) · P-256 public JWK (RFC 7515 example key) · OpenSSH Ed25519 public key · Weak RSA-512 key

How it works

Paste an RSA, EC (P-256/P-384/P-521, secp256k1, brainpool), Ed25519/Ed448 or X25519 key as PEM, base64/hex DER, JWK or OpenSSH line. Shows key type, size or curve, public exponent, SHA-256 SPKI and OpenSSH fingerprints, the RFC 7638 JWK thumbprint, detects encrypted private keys and their KDF, rates the key against current guidance and converts the PUBLIC key between PEM, JWK and OpenSSH formats.

  • The format is detected from the text: PEM labels (PUBLIC KEY, RSA PUBLIC KEY, PRIVATE KEY, RSA/EC PRIVATE KEY, ENCRYPTED PRIVATE KEY, OPENSSH PRIVATE KEY, CERTIFICATE, CERTIFICATE REQUEST), JSON JWK / JWK sets, OpenSSH authorized_keys lines and RFC 4716 SSH2 blocks; anything else is tried as base64 or hex DER (SPKI, PKCS#8, PKCS#1, SEC1).
  • Keys are imported with Node.js crypto (OpenSSL); the size, exponent and curve come from the key object, the algorithm identifiers from a DER parse of the SubjectPublicKeyInfo.
  • Fingerprints: SHA-256 over the DER SubjectPublicKeyInfo (hex and base64, the pin-sha256 format), OpenSSH SHA256:/MD5: over the SSH wire encoding, and the RFC 7638 JWK thumbprint (SHA-256 over the required members in lexicographic order).
  • Encrypted keys are recognised without a passphrase: PKCS#8 EncryptedPrivateKeyInfo (PBES2 with PBKDF2 or scrypt parameters), legacy Proc-Type: 4,ENCRYPTED PEM and openssh-key-v1 cipher/KDF. The OpenSSH public key is read from the unencrypted file header.
  • Ratings follow NIST SP 800-57 Part 1 Rev. 5 (RSA-2048 = 112-bit security, acceptable until 2030; ≥3072 bits = 128-bit), FIPS 186-5 (DSA no longer approved for signing) and common TLS/SSH support.
  • Conversions only ever output the PUBLIC key (SPKI PEM, JWK, OpenSSH). Private key material is never echoed back.

Keys are processed on the server for this request and not stored. Do not paste production private keys into any web tool; with JavaScript enabled this page converts private keys to public keys locally before sending.

Sources

For scripts and AI agents

  • JSON API: POST https://rsaecckeyinspector.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://rsaecckeyinspector.usefulweb.site/mcp · tool name rsa_ecc_key_inspector
Example request
curl -s -X POST https://rsaecckeyinspector.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"key":"-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh3BIrCB410mLVroKIYbJ\nUPfbt6YGNqOyz/2j7yyi5kOjNVVbFPp02sqjt6i+ZEDvaH5kJIU4P+25V330U0h4\nmXfqN+0yDClu7yxsDLdbVBT7HZHWRuasFoR1ZoZCtlQDg7yP/ubHuWTIVPRHMzRm\n45s7+nUnziEXCDIUhwSxLLTu1Nbo8YfmJEFDKVW+hY8AjlrR6HmNKqjMqiVT+R0U\nVNpB0Y3+koWbPs6WWW0xNpzER2ffGS3IPT0sD++SChsbbZYXJ9gVockGuNifXk1J\n+O/wdXu1FFp9oIua/h2pMwfCYOTci7NZsY4P1dcELAF/+Q/bIz//QMgW+QyGVk9c\nEwIDAQAB\n-----END PUBLIC KEY-----"}'

Related tools

  • X.509 / ASN.1 Certificate Inspector – Decode X.509 certificates, chains and CSRs: SANs, usages, CT SCTs, chain order and an ASN.1 tree.
  • Crypto Kitchen – CyberChef-style recipes: chain encodings, compression, hashes, AES, JWT and more, step by step.
Feedback