PFX / PKCS#12 Inspector
Read the structure of a .pfx / .p12 archive: outer ContentInfo, SafeContents, bag types (cert / shrouded key / friendly name), and which encryption schemes are in use. Unencrypted certificate bags are decoded into their X.509 contents. Password-decryption of encrypted bags is not implemented in this client-side tool — that is a deliberate scope limit; we will not silently leak your private key.
How to use this tool
What it does
Inspects a PKCS#12 / PFX container — the bundle of a certificate, its chain and (optionally) a private key.
When to use it
Use it to see what a .pfx or .p12 actually contains before importing it.
Worked example
Open a PFX to list its certificate chain and confirm whether a key bag is present.
PFX / PKCS#12 input
Structure
PFX / PKCS#12 in one line
PKCS#12 (a.k.a. PFX) is a password-protected container of certs and keys. RFC 7292 defines the structure: an outer SEQUENCE with version, an AuthenticatedSafe (one or more SafeContents), and an optional MAC. SafeContents are typically encrypted with PBE (PBES1 with SHA-1+3DES historically; PBES2 with PBKDF2 + AES today). This tool reads the public structure and shows what is in there; we do not implement password-based decryption client-side.
Spec
RFC 7292 (PKCS#12), RFC 8018 (PKCS#5 v2.1, PBES2).
Roadmap
Modern PBES2+AES decryption is on the roadmap. PBE-SHA1-3DES (legacy) requires a 3DES implementation Web Crypto does not expose.
Frequently asked questions
What is a PKCS#12 file?
An archive format, with the .pfx or .p12 extension, bundling a private key with its certificate chain in one password-protected container.
What is a bag type?
PKCS#12 stores content in typed bags: keyBag and pkcs8ShroudedKeyBag for private keys, certBag for certificates, and safeContents for nesting. The shrouded variant is the encrypted one.
Can this tool decrypt my archive?
No — password-based decryption is not implemented. It reports structure only: bag types, algorithm identifiers and which certificates are present.
Why do older archives fail to open in modern tools?
Because they use legacy RC2 or 40-bit RC4 encryption that current libraries disable by default. Re-wrapping with AES is the usual fix.
Does anything I paste leave my browser?
Nothing. The tool is entirely client-side: the page ships a static script, does no network calls, and never transmits what you paste. You can confirm it by opening the network tab, or by loading the page and then going offline.