RSA Key Formats
A side-by-side reference for PKCS#1, PKCS#8, SubjectPublicKeyInfo, PEM vs DER, and JWK — plus an in-browser demo generator that exports a real RSA key pair using the Web Crypto API. Private keys never leave your browser.
How to use this tool
What it does
Explains RSA key encodings — PKCS#1 vs PKCS#8, PEM vs DER — and how modulus and exponent are laid out.
When to use it
Use it when a library rejects a key and you need to identify which RSA format you actually have.
Worked example
Recognise a -----BEGIN RSA PRIVATE KEY----- header as PKCS#1, not PKCS#8.
Generate & identify
Result
What this tool does
RSA keys travel in several different containers, and confusing them is one of the most common causes of "wrong key format" errors in TLS, signing, and JWT work. This page is two things at once: a concise reference that lays out the four ASN.1 containers and the JWK JSON form side by side, and a small demo generator. The generator calls crypto.subtle.generateKey with the RSASSA-PKCS1-v1_5 algorithm and SHA-256, then exports the resulting key pair in the formats the browser produces natively — SubjectPublicKeyInfo (SPKI) and JWK for the public key, and PKCS#8 and JWK for the private key. The DER bytes are Base64-armoured into PEM in JavaScript, so the whole exchange stays on your machine.
The second mode does not generate anything. Paste any PEM block and the tool reports which format it is by reading the dashed header label and decoding the first few DER bytes — the outer SEQUENCE tag (0x30) and its length field — so you can quickly tell a PKCS#1 key from a PKCS#8 key or an SPKI public key.
When to use it
Reach for this when a library rejects a key with an opaque error, when you need a throwaway key pair to test a parser or a signing pipeline, or when you simply want to remember which PEM header maps to which structure. It is also handy for teaching: generate a 2048-bit pair, look at the SPKI and JWK side by side, and the relationship between the ASN.1 integers and the JWK n/e fields becomes obvious. For real-world certificate and CSR inspection, pair it with the dedicated parsers linked below.
The formats at a glance
PKCS#1
RSA-specific. RSAPrivateKey and RSAPublicKey SEQUENCEs holding only the RSA integers. PEM headers RSA PRIVATE KEY and RSA PUBLIC KEY.
PKCS#8
Algorithm-neutral PrivateKeyInfo: an AlgorithmIdentifier (rsaEncryption) wrapping the PKCS#1 key in an OCTET STRING. PEM header PRIVATE KEY.
SubjectPublicKeyInfo
The X.509 public-key container: AlgorithmIdentifier + a BIT STRING wrapping the PKCS#1 RSAPublicKey. PEM header PUBLIC KEY.
PEM vs DER
DER is the raw binary ASN.1. PEM is that same DER, Base64-encoded between dashed BEGIN/END lines. Converting is encoding only — the structure is identical.
JWK
JSON Web Key. Fields: kty (RSA), n and e for public; private adds d, p, q, dp, dq, qi. Integers are base64url with no leading zero byte.
What Web Crypto exports
The browser exports public keys as spki or jwk, and private keys as pkcs8 or jwk. It does not expose PKCS#1 directly.
Input and output
Generate mode takes only a key size and produces four exports: the public key as SPKI PEM and JWK, and the private key as PKCS#8 PEM and JWK. Each block is labelled, and the JWK is pretty-printed JSON. Identify mode takes a pasted PEM block as input and outputs the detected format name, the matched header label, and the first decoded DER bytes (tag, length, and what they imply). If the input is not a valid PEM block, an inline error explains what is wrong.
Common mistakes
- Assuming
PRIVATE KEYmeans PKCS#1. TheRSAprefix is the tell:RSA PRIVATE KEYis PKCS#1; barePRIVATE KEYis PKCS#8. - Feeding an SPKI public key to a PKCS#1 parser. They differ by the AlgorithmIdentifier and BIT STRING wrapper, so a bare-RSAPublicKey parser will choke on SPKI.
- Expecting PEM↔DER to change the format. It only changes the encoding; a PKCS#8 PEM is a PKCS#8 DER once Base64-decoded.
- Reusing a 1024-bit key. 1024-bit RSA is considered broken for new use; some browsers' Web Crypto will refuse it outright, which this tool reports rather than faking a result.
- Treating a JWK integer as a normal Base64 string. JWK uses base64url without padding and strips leading zero bytes, so
nis not byte-identical to the ASN.1 modulus.
Related tools
Frequently asked questions
What is the difference between PKCS#1 and PKCS#8?
PKCS#1 is the RSA-specific structure: an RSAPrivateKey or RSAPublicKey SEQUENCE that contains only the RSA integers. Its PEM armour reads BEGIN RSA PRIVATE KEY. PKCS#8 is an algorithm-neutral wrapper, PrivateKeyInfo, that tags the key with an AlgorithmIdentifier (rsaEncryption) and embeds the PKCS#1 RSAPrivateKey inside an OCTET STRING. Its PEM armour reads BEGIN PRIVATE KEY. Modern libraries prefer PKCS#8 because the same container also holds EC, Ed25519, and other key types.
What is SubjectPublicKeyInfo and how does it relate to PKCS#1?
SubjectPublicKeyInfo (SPKI) is the X.509 public-key container: an AlgorithmIdentifier plus a BIT STRING that wraps the bare PKCS#1 RSAPublicKey. Its PEM armour reads BEGIN PUBLIC KEY, whereas a bare PKCS#1 public key uses BEGIN RSA PUBLIC KEY. OpenSSL, Java, and Web Crypto all default to SPKI for public keys, so it is the format you will see most often.
What is the difference between PEM and DER?
DER is the binary ASN.1 encoding of the key. PEM is that same DER wrapped in Base64 and bracketed by dashed BEGIN and END header lines. Converting between them is purely an encoding step and does not change the underlying structure, so a PEM PKCS#8 key decodes to a DER PKCS#8 key. Use the PEM and DER converter for that transcoding.
Does this tool send my generated private key anywhere?
No. The demo key pair is generated by your browser's Web Crypto API (crypto.subtle.generateKey) and exported entirely in local JavaScript. Nothing is uploaded, logged, or sent to a server. The keys are demonstration material only and should not be reused for production.
Can this tool convert a PKCS#1 key to PKCS#8?
No. This tool only exports the formats that Web Crypto produces natively: SubjectPublicKeyInfo and JWK for public keys, and PKCS#8 and JWK for private keys. It does not perform PKCS#1 to PKCS#8 transcoding or vice versa, because that requires re-wrapping the ASN.1 structures, which Web Crypto does not expose. For real conversions, use OpenSSL or a dedicated library.