PEM Private Key Format Validator

A PEM private key is a Base64-encoded DER structure wrapped in -----BEGIN ... PRIVATE KEY----- armour. When TLS or SSH setup fails, the cause is often a malformed key — wrong label, corrupted Base64 or a truncated block. This validator decodes the PEM in your browser, identifies whether it is RSA, EC or Ed25519, and reports structural validity. The key is never transmitted.

How it works

1. The PEM armour is matched to find the label (e.g. PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY).
2. The Base64 body between the lines is decoded to raw DER bytes.
3. For PKCS#8 keys the parser walks the ASN.1 to read the AlgorithmIdentifier OID, mapping it to a key type:
   • 1.2.840.113549.1.1.1 → RSA
   • 1.2.840.10045.2.1 → EC (elliptic curve)
   • 1.3.101.112 → Ed25519
4. PKCS#1 (RSA PRIVATE KEY) and SEC1 (EC PRIVATE KEY) labels imply the type directly.

Where available, the browser’s Web Crypto importKey is used as an extra structural check for PKCS#8 RSA and EC keys.

Notes

Encrypted keys (BEGIN ENCRYPTED PRIVATE KEY) are recognised but not decrypted — supply the unencrypted form to inspect the algorithm. As with any key tool, prefer test keys; a real private key is a credential you should never paste into untrusted pages. Here, processing is fully local.