Match the required header
Turn BEGIN PRIVATE KEY into RSA PRIVATE KEY or EC PRIVATE KEY, and the other way around.
PKCS#1 & PKCS#8 · Public and private keys
Private and Public Key Format Conversion: PKCS#1 and PKCS#8
Convert a private or public key between PKCS#1 and PKCS#8. Rewrite the PEM into the structure another server, load balancer, or cloud API expects. Detection and conversion stay in your browser.
Browser-only conversion · Your key is not uploaded
Paste or upload a public or private key.
A recognized PEM header fills the key type and current format. Choose the target format. If the current format cannot be detected, it is treated as the other format. Conversion runs in this tab, and the key is discarded when you clear or close the page.
Accepts unencrypted .key, .pem, or .pub files.
A recognized PEM header fills the key type. Choose the target format.
The converted key will appear here
Paste one PEM key and choose a target format. A key that is already in that format is returned unchanged.
KEY ENCODING
Same key, different wrapper.
A cloud API, web server, or older toolkit may accept only one PEM header. Converting the encoding lets you install the key you already have instead of generating a new pair and reissuing the certificate.
Public keys too
Convert an RSA public key between BEGIN PUBLIC KEY and BEGIN RSA PUBLIC KEY.
Keep key material local
Parsing and rewriting happen inside the current browser tab. The key is not uploaded.
PKCS#1 AND PKCS#8
How to convert a key format.
Use the complete PEM, including the BEGIN and END lines. A recognized header fills the key type and current format. Choose the target format yourself.
- 01
Add one key
Paste the PEM or upload an unencrypted .key, .pem, or .pub file.
- 02
Choose the target format
Pick PKCS#1 or PKCS#8. If the key is already in that format, the result is the same PEM.
- 03
Copy or download the result
The output stays in this tab. Store it with the same access controls as the original key.
PEM HEADERS
Which header maps to which format.
PKCS#8
BEGIN PRIVATE KEY
BEGIN PUBLIC KEY
Private keys use PrivateKeyInfo. Public keys use SubjectPublicKeyInfo, which this converter treats as the PKCS#8 public form.
PKCS#1
BEGIN RSA PRIVATE KEY
BEGIN EC PRIVATE KEY
BEGIN RSA PUBLIC KEY
EC PRIVATE KEY is the SEC1 encoding. RSA PUBLIC KEY is the only PKCS#1 public key this page writes.
FORMAT DETECTION
How the converter chooses a direction.
It reads the PEM label first. One recognized header fills the key type and the current format. You choose whether the result should be PKCS#1 or PKCS#8.
Missing labels, a truncated header, or two keys in the same box leave the current format unset. Choose the target format and the converter treats the key as the other format. A detected key that already uses the target format is returned unchanged.
What conversion changes
- The PEM header and ASN.1 wrapper
- Line wrapping of the Base64 body
- Where an EC curve identifier is stored
Conversion does not generate a new key pair, decrypt a passphrase, or prove that a certificate matches the key.
How to convert PKCS#1 and PKCS#8 with OpenSSL.
Use these commands on a trusted machine when the key is encrypted or your policy does not allow browser tools.
PRIVATE KEY PKCS#1 TO PKCS#8
openssl pkcs8 -topk8 -nocrypt \
-in private-key.pem -out private-key-pkcs8.pemRSA PRIVATE KEY PKCS#8 TO PKCS#1
openssl rsa -in private-key.pem \
-out private-key-pkcs1.pemEC PRIVATE KEY PKCS#8 TO SEC1
openssl ec -in private-key.pem \
-out private-key-sec1.pemRSA PUBLIC KEY SPKI TO PKCS#1
openssl rsa -pubin -in public-key.pem \
-RSAPublicKey_out -out public-key-pkcs1.pemSupported formats and limits.
Paste or upload one unencrypted PEM. Private keys may be PKCS#8, RSA PKCS#1, or EC SEC1. RSA public keys may be SubjectPublicKeyInfo or RSAPublicKey. Supported EC curves follow the named curves already used for certificates, including P-256, P-384, and P-521.
Encrypted private keys, certificates, CSRs, and PKCS#12 bundles are outside this page. Use OpenSSL for those containers, then convert the extracted key here if you still need a different PEM header.
When detection should fail.
Detection stays unset when the text has no PEM boundary, the boundary is cut off, or both a public key and a private key are present. Choose the target format and the converter assumes the key uses the other format. Set the key type when the header does not identify it.
A wrong manual choice fails instead of writing a key. Check the original header, or remove the passphrase with OpenSSL before trying again.
RELATED KEY TOOLS
Check the key after you convert it.
CSR & Private Key Matcher
Confirm a CSR and private key belong to the same pair before you submit the request.
Check CSR & keyCertificate Key Matcher
Compare an issued certificate with its private key before installing it.
Check certificate & keyCSR Generator
Create a new CSR and private key locally when you need a new pair instead of a new encoding.
Generate CSRPKCS CONVERSION FAQ
Common PKCS#1 and PKCS#8 questions.
What is the difference between PKCS#1 and PKCS#8?
PKCS#8 is the generic private-key wrapper, written as BEGIN PRIVATE KEY. PKCS#1 here means the algorithm-specific form: BEGIN RSA PRIVATE KEY, or BEGIN EC PRIVATE KEY for an elliptic-curve key in SEC1. For public keys, the generic form is SubjectPublicKeyInfo (BEGIN PUBLIC KEY). This page treats that as the PKCS#8 public key. The PKCS#1 public key is BEGIN RSA PUBLIC KEY.
Is it safe to paste a private key into this converter?
The conversion runs locally in your browser. The key is not sent to our server, stored, or added to the URL. Clear the form or close the tab when you finish. Follow your organization's key-handling policy for production keys.
Does the converter support RSA and EC keys?
Private keys can be RSA or ECDSA, including the P-256, P-384, and P-521 curves used with certificates. Public-key conversion is for RSA. An elliptic-curve public key already uses SubjectPublicKeyInfo and has no PKCS#1 PEM form.
Can I convert an encrypted private key?
No. This page does not request or decrypt a passphrase. BEGIN ENCRYPTED PRIVATE KEY and a PEM with Proc-Type: 4,ENCRYPTED are rejected. Use the OpenSSL commands on this page, or create a temporary unencrypted copy on a trusted machine and remove it immediately afterward.
What happens when the format cannot be detected?
A standard PEM header fills the key type and current format. You choose the target format. If the header is missing, truncated, or more than one key is pasted, set the key type yourself. The current format is then assumed to be the other PKCS format. A detected key that already uses the target format is returned unchanged.
Will conversion change the key pair?
No. PKCS#1 and PKCS#8 are encodings of the same key material. The modulus, exponents, and curve parameters stay the same. Only the PEM wrapper changes.