10 tools
RSA, PGP, PEM, CSR, and SSH key tools
Start with the key container and the intended operation: inspection, conversion, key generation, encryption, or signature verification.
Choose by task
Inspect fields and convert containers
CSR Parser exposes certificate-request fields; it does not issue a certificate. SSH Host Key Parser reads SSH fields rather than ASN.1 structures. Read the key and certificate format guide before converting a container.
JWK to PEM Converter changes a supported JSON key representation into PEM. PEM to Hex Converter removes the text wrapper to expose encoded bytes. Hex to Object Identifier Converter decodes an OID value. Do not paste an entire certificate into the OID field. Read the binary encoding guide for DER lengths and OID examples.
- CSR ParserRead a PEM certificate signing request: subject, public key, signature algorithm, and Subject Alternative Names, parsed in your browser.
- SSH Host Key ParserDecode an OpenSSH public key line or blob. See the key type and its RSA, ECDSA, or Ed25519 public values, decoded in your browser.
- JWK to PEM ConverterConvert RSA and P-256 EC JSON Web Keys, or a whole JWKS, to PEM. Public keys become SPKI blocks; keys with d become PKCS#8 blocks.
- PEM to Hex ConverterDecode PEM blocks to hexadecimal bytes. Inspect top-level DER tags, lengths, value previews, and byte offsets below the result.
- Hex to Object Identifier ConverterDecode OID value bytes into decimal arcs. Inspect continuation bits and base-128 groups with an independent byte calculation.
Generate a key pair for the receiving format
Choose RSA Key Pair Generator for RSA key material. Choose PGP Key Pair Generator when your recipient expects OpenPGP keys. A PEM key and an armored OpenPGP key are different containers. Share the public key and retain the private key securely.
Encrypt a message or check its signature
RSA Encryption and PGP Encryption need public keys in their respective formats. Match RSA padding to the receiving application. RSA Verifier checks a signature against the message and public key. A successful signature check still requires a trusted association between that key and its owner.
- RSA EncryptionEncrypt a short message with an RSA public key using RSA-OAEP, SHA-256 by default. Get Base64 or hex ciphertext, made in your browser.
- PGP EncryptionEncrypt a text message to a recipient's OpenPGP public key. Get an armored PGP MESSAGE block, encrypted in your browser.
- RSA VerifierVerify an RSA PKCS#1 v1.5 signature against a message and public key. Supports SHA-256, SHA-384, and SHA-512 with Base64 or hex input.