{
  "title": "Private key format converter",
  "human_url": "https://happytails.ai/en/developer-tools/private-key-format-converter/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/private-key-format-converter/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/private-key-format-converter.md",
  "content": "Private key format converter\nConvert a private key between PKCS#8, encrypted PKCS#8, PKCS#1, SEC1, OpenSSH and JWK in your browser. The key is checked for consistency and never uploaded.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use Private key format converter\nPaste one private key in PEM, OpenSSH or JWK form.\nIf the key is encrypted, enter its passphrase.\nChoose the output format, and a new passphrase if you want an encrypted PKCS#8 file.\nRun the tool and download the converted key and the matching public key.\nUseful next steps\nRSA key generator\nBase64 encoder decoder\nFile hash\nFormats\nInput and output cover PKCS#8 (RFC 5958), encrypted PKCS#8 with PBES2 and PBKDF2 (RFC 8018), PKCS#1 RSA keys (RFC 8017), SEC1 EC keys (RFC 5915), unencrypted OpenSSH keys and private JWKs (RFC 7517 and RFC 8037). RSA, EC P-256, P-384 and P-521, and Ed25519 keys are supported, and PKCS#8, PKCS#1 and SEC1 output matches what OpenSSL writes byte for byte.\nSafety checks\nEvery key is checked before it is written: RSA primes must multiply to the modulus and the exponents must match, and EC and Ed25519 public keys are recomputed from the private value. The report lists fingerprints of the public key only and never contains private material.\nNot supported\nLegacy PEM encryption with Proc-Type and DEK-Info (MD5 key derivation), PBES1, 3DES, scrypt and passphrase protected OpenSSH keys (bcrypt_pbkdf) are refused with a clear message instead of a guess. Re-export such keys with OpenSSL or ssh-keygen on your own machine first.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "RSA key generator",
      "url": "https://happytails.ai/en/developer-tools/rsa-key-generator/"
    },
    {
      "name": "Base64 encoder decoder",
      "url": "https://happytails.ai/en/developer-tools/base64-encoder-decoder/"
    },
    {
      "name": "File hash",
      "url": "https://happytails.ai/en/developer-tools/file-hash/"
    }
  ],
  "tool": {
    "id": "private-key-format-converter",
    "category": "developer-tools",
    "built": true,
    "requirements": "One private key of up to 200000 characters; RSA keys from 1024 to 8192 bits; passphrases up to 1024 characters, at least 8 for new encryption; at most 2000000 PBKDF2 iterations when decrypting. Everything runs locally in a background worker. Download the converted key, public-key.pem and a JSON report.",
    "implementation": {
      "fields": [
        {
          "key": "format",
          "label": "Output format",
          "value": "pkcs8",
          "type": "select",
          "values": [
            "pkcs8",
            "pkcs8-encrypted",
            "pkcs1",
            "sec1",
            "openssh",
            "jwk"
          ]
        },
        {
          "key": "inputPassphrase",
          "label": "Passphrase of the pasted key (if encrypted)",
          "value": "",
          "type": "password"
        },
        {
          "key": "outputPassphrase",
          "label": "New passphrase (for pkcs8-encrypted)",
          "value": "",
          "type": "password"
        },
        {
          "key": "comment",
          "label": "OpenSSH key comment (optional)",
          "value": "",
          "type": "text"
        }
      ],
      "registrationFamily": "crypto-formats-key-material",
      "inputMaxLength": 200000,
      "inputErrorCode": "CRYPTO_FORMATS_KEY_MATERIAL_TOO_LONG_PRIVATE_KEY",
      "note": "Runs in your browser; the key is never uploaded. One private key of up to 200000 characters.",
      "experience": {
        "automatic": false,
        "single": false,
        "inputMaxLength": 200000,
        "inputMode": "text",
        "label": "Private key",
        "placeholder": "-----BEGIN PRIVATE KEY----- or {\"kty\":\"EC\",...}",
        "help": "Paste one private key. It stays in your browser. Up to 200,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# Private key format converter\n\n- Human page: https://happytails.ai/en/developer-tools/private-key-format-converter/\n- Markdown: https://happytails.ai/en/developer-tools/private-key-format-converter.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/private-key-format-converter/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `private-key-format-converter` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nRuns in your browser; the key is never uploaded. One private key of up to 200000 characters.\n\n### Inputs and settings\n\nText input: Private key.\n\nExample or placeholder shown in the interface (not a validated fixture):\n\n```text\n-----BEGIN PRIVATE KEY----- or {\"kty\":\"EC\",...}\n```\n\nPaste one private key. It stays in your browser. Up to 200,000 characters. Review the settings before running.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `format` | Output format | select | \"pkcs8\" | Allowed: pkcs8, pkcs8-encrypted, pkcs1, sec1, openssh, jwk |\n| `inputPassphrase` | Passphrase of the pasted key (if encrypted) | password | \"\" |  |\n| `outputPassphrase` | New passphrase (for pkcs8-encrypted) | password | \"\" |  |\n| `comment` | OpenSSH key comment (optional) | text | \"\" |  |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nOne private key of up to 200000 characters; RSA keys from 1024 to 8192 bits; passphrases up to 1024 characters, at least 8 for new encryption; at most 2000000 PBKDF2 iterations when decrypting. Everything runs locally in a background worker. Download the converted key, public-key.pem and a JSON report.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"private-key-format-converter\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"One private key of up to 200000 characters; RSA keys from 1024 to 8192 bits; passphrases up to 1024 characters, at least 8 for new encryption; at most 2000000 PBKDF2 iterations when decrypting. Everything runs locally in a background worker. Download the converted key, public-key.pem and a JSON report.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"format\",\n        \"label\": \"Output format\",\n        \"value\": \"pkcs8\",\n        \"type\": \"select\",\n        \"values\": [\n          \"pkcs8\",\n          \"pkcs8-encrypted\",\n          \"pkcs1\",\n          \"sec1\",\n          \"openssh\",\n          \"jwk\"\n        ]\n      },\n      {\n        \"key\": \"inputPassphrase\",\n        \"label\": \"Passphrase of the pasted key (if encrypted)\",\n        \"value\": \"\",\n        \"type\": \"password\"\n      },\n      {\n        \"key\": \"outputPassphrase\",\n        \"label\": \"New passphrase (for pkcs8-encrypted)\",\n        \"value\": \"\",\n        \"type\": \"password\"\n      },\n      {\n        \"key\": \"comment\",\n        \"label\": \"OpenSSH key comment (optional)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-key-material\",\n    \"inputMaxLength\": 200000,\n    \"inputErrorCode\": \"CRYPTO_FORMATS_KEY_MATERIAL_TOO_LONG_PRIVATE_KEY\",\n    \"note\": \"Runs in your browser; the key is never uploaded. One private key of up to 200000 characters.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": false,\n      \"inputMaxLength\": 200000,\n      \"inputMode\": \"text\",\n      \"label\": \"Private key\",\n      \"placeholder\": \"-----BEGIN PRIVATE KEY----- or {\\\"kty\\\":\\\"EC\\\",...}\",\n      \"help\": \"Paste one private key. It stays in your browser. Up to 200,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nConvert a private key between PKCS#8, encrypted PKCS#8, PKCS#1, SEC1, OpenSSH and JWK in your browser. The key is checked for consistency and never uploaded.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use Private key format converter\n\n1. Paste one private key in PEM, OpenSSH or JWK form.\n2. If the key is encrypted, enter its passphrase.\n3. Choose the output format, and a new passphrase if you want an encrypted PKCS#8 file.\n4. Run the tool and download the converted key and the matching public key.\n\n## Useful next steps\n\n- [RSA key generator](https://happytails.ai/en/developer-tools/rsa-key-generator/) ([Markdown](https://happytails.ai/en/developer-tools/rsa-key-generator.md))\n\n- [Base64 encoder decoder](https://happytails.ai/en/developer-tools/base64-encoder-decoder/) ([Markdown](https://happytails.ai/en/developer-tools/base64-encoder-decoder.md))\n\n- [File hash](https://happytails.ai/en/developer-tools/file-hash/) ([Markdown](https://happytails.ai/en/developer-tools/file-hash.md))\n\n## Formats\n\nInput and output cover PKCS#8 (RFC 5958), encrypted PKCS#8 with PBES2 and PBKDF2 (RFC 8018), PKCS#1 RSA keys (RFC 8017), SEC1 EC keys (RFC 5915), unencrypted OpenSSH keys and private JWKs (RFC 7517 and RFC 8037). RSA, EC P-256, P-384 and P-521, and Ed25519 keys are supported, and PKCS#8, PKCS#1 and SEC1 output matches what OpenSSL writes byte for byte.\n\n### Safety checks\n\nEvery key is checked before it is written: RSA primes must multiply to the modulus and the exponents must match, and EC and Ed25519 public keys are recomputed from the private value. The report lists fingerprints of the public key only and never contains private material.\n\n### Not supported\n\nLegacy PEM encryption with Proc-Type and DEK-Info (MD5 key derivation), PBES1, 3DES, scrypt and passphrase protected OpenSSH keys (bcrypt\\_pbkdf) are refused with a clear message instead of a guess. Re-export such keys with OpenSSL or ssh-keygen on your own machine first.\n"
}