RSA Key Converter
Convert RSA private keys between PKCS#1 and PKCS#8 in your browser.
Runs 100% in your browser — nothing you paste or generate ever leaves your device.
Paste an RSA private key. The format is detected automatically and converted to the other one.
Quick answer
RSA Key Converter switches an RSA private key between PKCS#1 (BEGIN RSA PRIVATE KEY) and PKCS#8 (BEGIN PRIVATE KEY) in your browser, with the key never uploaded. Use it when a server rejects your key's format even though the key itself is valid.
RSA Key Converter changes an RSA private key between the PKCS#1 and PKCS#8 formats, entirely in your browser. A private key is the single most sensitive file you own, so converting it on a remote server, where a copy could be logged, is a needless risk. This tool does the transformation locally with the Web Crypto and ASN.1 handling built into the page; the key you paste never leaves your machine.
The two formats look confusingly similar but are not interchangeable to every program. PKCS#1 is the older, RSA-specific encoding whose PEM block reads -----BEGIN RSA PRIVATE KEY-----. PKCS#8 is the generic container that can hold a key of any algorithm and reads -----BEGIN PRIVATE KEY-----, or -----BEGIN ENCRYPTED PRIVATE KEY----- when it is password-protected. Different servers and libraries expect different ones, and a mismatch produces a frustrating error even though the underlying key is identical, which is exactly what this converter resolves.
Converts locally, the key never leaves your browser
The conversion is pure structural re-encoding of the same key bytes, and it runs client-side. Your private key is not uploaded, logged, or transmitted. Because the whole value of a private key is that no one else has seen it, this local-only guarantee is the reason to convert here rather than paste your key into a server-side tool. You can safely reformat a production key without ever exposing it.
PKCS#1 vs PKCS#8
PKCS#1 is the original RSA key format; it encodes only RSA parameters and its PEM header names RSA explicitly. PKCS#8 wraps a key of any type in a standard envelope that also records which algorithm it is, and its header is the generic PRIVATE KEY. PKCS#8 additionally supports built-in password encryption, giving the ENCRYPTED PRIVATE KEY header. The raw RSA math is the same in both; PKCS#8 just adds a standardized outer layer, which is why newer software prefers it.
Which format your software wants
OpenSSL happily reads both. Older Apache and NGINX builds and many legacy tools expect PKCS#1 (BEGIN RSA PRIVATE KEY). Java, .NET, Go, Node.js, and most modern libraries expect PKCS#8 (BEGIN PRIVATE KEY). If a program rejects your key with an unsupported or invalid format error even though the key is fine, you almost certainly have the wrong one of these two, and converting fixes it without regenerating anything.
Encrypted keys and passphrases
A key can be stored encrypted so it cannot be used without a passphrase. PKCS#8 does this with the ENCRYPTED PRIVATE KEY header. When you convert, you may need to supply the passphrase to unlock the key first, and you can choose whether the output is encrypted. Keep production keys encrypted at rest, but note that many servers need the decrypted key at load time or a way to supply the passphrase on startup.
Frequently asked questions
- Is my private key uploaded during conversion?
- No. The conversion runs entirely in your browser as a local re-encoding of the same key. Nothing is transmitted or logged. Since a private key only has value while it stays secret, this local-only behavior is precisely why you should convert here instead of pasting the key into a server-side converter.
- How do I tell PKCS#1 from PKCS#8 at a glance?
- Read the PEM header. -----BEGIN RSA PRIVATE KEY----- is PKCS#1, the RSA-specific format. -----BEGIN PRIVATE KEY----- is PKCS#8, the generic format that records the algorithm. -----BEGIN ENCRYPTED PRIVATE KEY----- is a passphrase-protected PKCS#8 key. The header line alone tells you which format you have.
- Does converting change my key or require reissuing the certificate?
- No. Both formats encode the exact same key material; only the outer structure changes. The public key, and therefore the certificate that matches it, is unaffected. You can convert freely between PKCS#1 and PKCS#8 without generating a new key, submitting a new CSR, or reissuing the certificate.
- My server says the key format is invalid, is this the fix?
- Very likely, if the key itself is otherwise correct. Many format errors come from software that only accepts PKCS#8 being handed a PKCS#1 key, or vice versa. Convert to the format your server documents and the error usually disappears. If it persists, check that the key actually matches the certificate using the Certificate Key Matcher.
- Can this convert ECDSA or other keys too?
- This tool targets the PKCS#1 to PKCS#8 conversion, which is an RSA-specific question because PKCS#1 is defined only for RSA. Elliptic-curve keys use SEC1 or PKCS#8 rather than PKCS#1, so the PKCS#1 side does not apply to them. For general certificate and key repackaging across formats, use the SSL Converter.
- Should I keep my private key encrypted?
- Encrypting the key at rest with a passphrase (ENCRYPTED PRIVATE KEY, PKCS#8) is good hygiene, especially in backups or version control you must avoid. The trade-off is that servers need the decrypted key or the passphrase at startup. A common pattern is an encrypted key on disk with the passphrase supplied securely at boot, rather than an unprotected key sitting in the clear.