RSA Key Pair Verifier
Check whether an RSA public key and private key belong to the same key pair by comparing the modulus n and public exponent e. Shows the modulus size and exponent. Supports SPKI/PKCS#1 public keys and PKCS#8/PKCS#1 private keys, locally in the browser.
FreeOnline Tool
Loading…
Rate this tool
Your rating helps others decide whether this tool is worth using
How to Use
- Paste the public key into the left box (SPKI BEGIN PUBLIC KEY or PKCS#1 BEGIN RSA PUBLIC KEY).
- Paste the private key into the right box (PKCS#8 BEGIN PRIVATE KEY or PKCS#1 BEGIN RSA PRIVATE KEY).
- Click Check key pair. The tool imports both keys and compares the modulus n and public exponent e.
- The result shows Public and private keys match or do not match, along with the public modulus size (for example 2048 bits) and the public exponent e (usually 65537).
- Use Load matching sample or Load mismatched sample to try both outcomes, or Clear to start over.
Note: encrypted private keys (BEGIN ENCRYPTED PRIVATE KEY) must be decrypted first; non-RSA keys are rejected; the private key is handled only in page memory.
Features
- Matching is based on the public parameters: both keys are imported and exported as JWK, then the modulus n and public exponent e are compared.
- Public keys may be SPKI or PKCS#1 PEM; private keys may be PKCS#8 or PKCS#1 PEM, and the algorithm OID must be RSA.
- The result reports the public modulus size (for example 2048 bits) and the decimal public exponent e, so you can confirm the key specification.
- Built-in matching and mismatched sample keys let you compare both outcomes in one click.
- No network requests are made, and the private key is never uploaded or stored.
- When a signature verification keeps failing, use this tool first to rule out a public/private key pair mismatch.
Use Cases
Confirm a certificate key pair after deployment
When rolling out a new certificate or key, paste the certificate/public key and the server private key to confirm they are a pair before signing goes live.
Diagnose signature verification failures
When an API signature never verifies, first confirm that the public and private keys match, then investigate the algorithm or message encoding.
Compare keys exported by different tools
Keys exported from OpenSSL, Java KeyStore, or cloud platforms use different formats; this tool compares their public parameters in one place.
Demonstrate RSA public parameters
Use the matching and mismatched samples to show the RSA modulus and exponent and how key-pair matching is determined.
FAQ
How does the tool decide whether the keys match?
It imports both keys, exports them as JWK, and compares the public parameters: modulus n and public exponent e. Both must be identical for a match, regardless of the PEM container format.
Which key formats are supported?
Public keys: SPKI (BEGIN PUBLIC KEY) and PKCS#1 (BEGIN RSA PUBLIC KEY). Private keys: PKCS#8 (BEGIN PRIVATE KEY) and PKCS#1 (BEGIN RSA PRIVATE KEY). Encrypted private keys and non-RSA keys such as EC are not supported.
What do the modulus size and exponent e mean?
The modulus size is the RSA key length, commonly 2048 or 4096 bits. The public exponent e is shown in decimal; the most common value is 65537. Both come from the public key itself.
Why is an encrypted private key rejected?
BEGIN ENCRYPTED PRIVATE KEY is a password-protected PKCS#8 key that the browser cannot read directly. Decrypt it first with OpenSSL or a similar tool and export an unencrypted PKCS#8 private key.
Is the private key uploaded?
No. Both keys are imported and compared locally in the browser. The tool makes no network requests and does not save the private key.
Can keys in different formats be compared?
Yes. The tool normalizes different container formats to their public parameters before comparing n and e, so SPKI, PKCS#1, and PKCS#8 keys can be mixed.