Private key format converter
Convert a private key between PKCS#8, encrypted PKCS#8, PKCS#1, SEC1, OpenSSH and JWK in your browser. The key is checked for consistency and never uploaded.
One private key of up to 200000 characters; RSA keys from 1024 to 8192 bits; passphrases up to 1024 characters, at least 8 for new encryption; at most 2000000 PBKDF2 iterations when decrypting. Everything runs locally in a background worker. Download the converted key, public-key.pem and a JSON report. Paste one private key. It stays in your browser. Up to 200,000 characters. Review the settings before running.
Your result
How to use Private key format converter
- Paste one private key in PEM, OpenSSH or JWK form.
- If the key is encrypted, enter its passphrase.
- Choose the output format, and a new passphrase if you want an encrypted PKCS#8 file.
- Run the tool and download the converted key and the matching public key.
Useful next steps
Formats
Input and output cover PKCS#8 (RFC 5958), encrypted PKCS#8 with PBES2 and PBKDF2 (RFC 8018), PKCS#1 RSA keys (RFC 8017), SEC1 EC keys (RFC 5915), unencrypted OpenSSH keys and private JWKs (RFC 7517 and RFC 8037). RSA, EC P-256, P-384 and P-521, and Ed25519 keys are supported, and PKCS#8, PKCS#1 and SEC1 output matches what OpenSSL writes byte for byte.
Safety checks
Every key is checked before it is written: RSA primes must multiply to the modulus and the exponents must match, and EC and Ed25519 public keys are recomputed from the private value. The report lists fingerprints of the public key only and never contains private material.
Not supported
Legacy PEM encryption with Proc-Type and DEK-Info (MD5 key derivation), PBES1, 3DES, scrypt and passphrase protected OpenSSH keys (bcrypt_pbkdf) are refused with a clear message instead of a guess. Re-export such keys with OpenSSL or ssh-keygen on your own machine first.