PEM Format Converter Online | PKCS#1 & PKCS#8 | X.509 Certificate
Certificates How It Works
This tool converts RSA private keys between PKCS#1 and PKCS#8 formats and analyzes X.509 certificates by parsing the underlying ASN.1/DER structure. It auto-detects the input key type, algorithm, and bit length, and for certificates it extracts issuer, subject, validity dates, signature algorithm, and public key algorithm — so you can confirm a key's identity before and after conversion. The raw DER hex export lets you inspect the ASN.1 structure for binary-level debugging. Encrypted (password-protected) keys are not supported; decrypt them with OpenSSL first. No external libraries are used — the ASN.1 encoder/decoder is implemented from scratch in pure TypeScript.
PKCS#1 vs PKCS#8 Structure
| Feature | PKCS#1 | PKCS#8 |
|---|---|---|
| PEM header | BEGIN RSA PRIVATE KEY | BEGIN PRIVATE KEY |
| Algorithm ID | Implicit (RSA only) | Explicit (RSA, EC, Ed25519, etc.) |
| Structure | RSAPrivateKey (modulus, exponents, primes) | PrivateKeyInfo wrapping algorithm + key |
| Portability | Legacy tools, older OpenSSL | Modern libraries, cloud providers |
| Recommendation | Compatibility only | Preferred for new deployments |
Code Examples
# PKCS#8 to PKCS#1 (OpenSSL)
openssl rsa -in key.pkcs8.pem -traditional -out key.pkcs1.pem
# PKCS#1 to PKCS#8 (OpenSSL)
openssl pkcs8 -topk8 -nocrypt -in key.pkcs1.pem -out key.pkcs8.pem
# Inspect a PKCS#8 key structure
openssl asn1parse -in key.pkcs8.pem# Analyze X.509 certificate fields
openssl x509 -in cert.pem -text -noout
# Extract DER hex from PEM (shell)
openssl x509 -in cert.pem -outform DER | xxd -p
# Check certificate expiration
openssl x509 -in cert.pem -noout -enddateSecurity Notes
- Private key handling — Conversion runs entirely in your browser. The ASN.1 parser is implemented in pure TypeScript with no external dependencies. No key material is uploaded or logged.
- Encrypted keys not supported — If your PEM file has "ENCRYPTED PRIVATE KEY" in the header, decrypt it with OpenSSL first. Encrypted key support may be added in a future update.
- Verify after conversion — Always compare the tool's metadata output (algorithm, bit length) against the original key. A mismatch indicates an incompatible input format.
- DER hex export — The raw DER hex is useful for debugging ASN.1 structure issues or comparing against openssl asn1parse output.
Related Tools
Need to generate a new CSR with a fresh key pair? Use the CSR Generator. To decode and inspect a certificate's full X.509 details, try the PEM Certificate Parser. For generating and converting EC (Elliptic Curve) keys, see the ECC Key Generator.
Frequently Asked Questions
What input formats does this tool accept?
The converter accepts any PEM-encoded RSA key or X.509 certificate — including PKCS#1 private keys (BEGIN RSA PRIVATE KEY), PKCS#8 private keys (BEGIN PRIVATE KEY), SPKI public keys (BEGIN PUBLIC KEY), and certificates (BEGIN CERTIFICATE). Headers are auto-detected; just paste the full PEM block.
Can this tool analyze X.509 certificates?
Yes. Paste a PEM-encoded certificate (BEGIN CERTIFICATE) and the tool will extract key fields: version, serial number, signature algorithm, issuer, validity dates (not before / not after), subject, and public key algorithm. The raw DER hex is also available for inspection.
When should I convert between PKCS#1 and PKCS#8?
Convert to PKCS#1 when you need compatibility with legacy tools (older OpenSSL, embedded systems) that expect "BEGIN RSA PRIVATE KEY" headers. Convert to PKCS#8 when modernizing infrastructure — it is the recommended format for new deployments, explicitly identifies the key algorithm, and is required by many modern libraries and cloud providers.
Does this tool support encrypted (password-protected) keys?
No. This tool handles unencrypted PEM keys only. If your key is encrypted (the header says "ENCRYPTED PRIVATE KEY"), you must first decrypt it using OpenSSL (openssl rsa -in encrypted.key -out decrypted.key) before converting the format.
How do I verify the converted key is correct?
After conversion, compare the key metadata shown by the tool (algorithm, bit length, key type) with the original. You can also verify with OpenSSL: "openssl rsa -in converted.key -check -noout" for RSA keys. The DER hex export lets you inspect the raw ASN.1 structure for binary-level debugging.
Privacy: This tool runs entirely in your browser — nothing is uploaded or stored. · Disclaimer: For educational purposes only. Not professional security advice.
More in Certificates
CSR Generator
Generate CSR (Certificate Signing Request) online for SSL/TLS certificates. RSA 2048-4096 & ECDSA, SAN support, signature verification.
PEM Certificate Parser
Parse and decode PEM certificates and keys online. View X.509 details: issuer, subject, validity, signature algorithm, fingerprints.