What is this public key, exactly?
Paste a PEM or DER public key and see what it actually is: the algorithm, the curve or modulus size, the encoding, and a fingerprint you can read aloud. Parsed in your browser, and never transmitted.
Processed locally in your browserNothing you enter here is uploaded, logged or sent to any server.
Parsing is not trusting
Everything this page reports comes from the bytes you pasted, describing themselves. A key that parses cleanly is a well-formed key and nothing more — it says nothing about whose key it is, whether it should be trusted, or whether the private half is still under anyone's control.
The fingerprint is the useful part for that question. It is a SHA-256 digest of the encoded key, so two people holding what they believe is the same key can compare a short string over a channel an attacker does not control — a phone call, in person — and find out whether they really do. That comparison is the thing that establishes identity; the arithmetic on this page cannot.
How the key size is worked out
From the parsed contents, not from the file length. A DER integer carries a leading zero byte when its top bit is set, to keep it positive, and counting that byte reports a 2048-bit RSA key as 2056. The modulus is walked past its leading zeros before its length is taken.
For elliptic-curve keys the size comes from the named curve in the algorithm parameters rather than from the point encoding, which includes a format byte and both coordinates.
The parser checks every length field against how many bytes actually remain. A length claiming more than exists is the classic way a parser is made to read past its input, and here it stops with a reason instead.
What this tool does not claim
No tool on this site is described as unbreakable, military grade, or completely secure, because none of those phrases means anything a person could check. What is written down instead is which standard is used, which library implements it, and what the tool has been tested against.
Everything here runs in your browser using its built-in Web Crypto implementation. Nothing is uploaded, and there is no server that could receive it. That is a real and checkable property — open your browser's network tab and use the tool.
What the fingerprint is for
Comparing keys without transmitting them. If somebody sends you a public key by email, an attacker who controls that email could have replaced it, and you would have no way to tell — both keys parse perfectly.
Reading the fingerprint aloud over a phone call, or comparing it against one printed on a business card or published in a signed release, closes that gap. The short form here is the first sixteen characters, which is enough to make substitution impractical while remaining possible to read out.
Private keys are refused
Deliberately. There is no reason to paste a private key into an inspector, and encouraging the habit is worse than the small convenience of allowing it. A page that accepts private keys today teaches people to paste them into pages, and the next page that asks may not be this one.
Related
Generate a key pair, verify a signature with the key, or see the rest of the tools.
Questions people actually ask
Does a key that parses mean it is safe to use?
No. It means the bytes are a well-formed key structure. It says nothing about whose key it is, whether the private half is still under anyone's control, or whether you should trust it. Parsing and trusting are different questions and only the first is arithmetic.
What is the fingerprint for?
Comparing keys without transmitting them. If a key arrives by email, someone controlling that email could have replaced it and both keys would parse perfectly. Reading the fingerprint aloud on a call, or checking it against one published in a signed release, closes that gap. It is the step that establishes identity.
Why does it refuse private keys?
Because there is no reason to paste one into an inspector, and allowing it teaches a habit worth not having. A page that accepts private keys today trains people to paste them into pages, and the next one that asks may not be this one.
How is the key size calculated?
From the parsed contents rather than the file length. DER pads an integer with a leading zero byte when its top bit is set, so counting naively reports a 2048-bit RSA key as 2056; the modulus is walked past its leading zeros first. Elliptic-curve sizes come from the named curve, not from the point encoding.
What formats does it accept?
PEM with the BEGIN and END markers, bare Base64 without them, and hex. SubjectPublicKeyInfo is the structure it understands — the same thing openssl calls a public key. Certificates are a different structure and are not handled here.
Is the key sent anywhere?
No. It is parsed in your browser by code on this page, and nothing is transmitted.