How to inspect a public key

Someone sends you a block of Base64 starting with BEGIN PUBLIC KEY. This tells you what it actually is.

Public keys arrive as opaque blocks of text, and the text does not say what is inside. Two keys that look identical in shape can be a 256-bit elliptic curve key and a 2048-bit RSA key. Before you register one as an authorised signer, it is worth knowing which.

Step-by-step

1. Paste the key, PEM or raw DER.
2. Read the summary — algorithm, curve or modulus size, encoding, and fingerprint.
3. Compare the fingerprint against one you were given by a route you trust.

The fingerprint is the useful part

Comparing two keys by eye is unreliable — they are long, and the interesting differences are not at the ends. A fingerprint is a hash of the key, short enough to read out over the phone and check character by character.

This matters because the hard problem with public keys is never the mathematics, it is knowing the key belongs to who you think. Verifying a fingerprint through a different channel from the one that delivered the key is the standard way to establish that.

Private keys are refused

If you paste a private key, the tool declines to display it and tells you what you have pasted. This is deliberate. Private keys and public keys look similar enough that pasting the wrong one is easy, and a tool that cheerfully rendered a private key on screen would be encouraging a bad habit — a screenshot, a screen share, or a colleague looking over your shoulder is all it takes.

Reading the details

• Algorithm — RSA, ECDSA, Ed25519.
• Curve or modulus size — P-256, P-384, or 2048/4096 bits for RSA.
• Encoding — SPKI is the usual wrapping for a public key; PKCS#1 appears for older RSA keys.

Parsing here is done defensively and deliberately kept apart from anything that decides trust. Reading what a key says is a completely different job from deciding whether to believe it.

Frequently asked questions

Is the key uploaded?

No. It is parsed in your browser and nothing is transmitted.

Why will it not show my private key?

Displaying private key material invites it being screenshotted or shared by accident. The tool identifies what you pasted and refuses to render it. Public keys are what this tool is for.

What do I compare the fingerprint against?

Whatever the key's owner published through a channel you already trust — read out on a call, printed on a business card, posted somewhere you have independent reason to believe. Comparing it against a fingerprint from the same email that carried the key proves nothing.