Public Key Extractor — Derive Public Key from Private Key (RSA & EC)

A few common scenarios: (1) You generated a private key on a server and now need to publish the public key at a JWKS endpoint so clients can verify tokens. (2) You have a private-key backup but lost the corresponding public key file. (3) You're distributing the public key to a peer for signature verification or hybrid encryption. Every private key contains all the information needed to derive its public key — it's a one-way but mechanical operation.

Both PEM PKCS#8 (-----BEGIN PRIVATE KEY-----) and JWK JSON. For PEM, the tool auto-detects whether the key is RSA or EC by trying each algorithm. Legacy openssl 'RSA PRIVATE KEY' (PKCS#1) is not supported directly — convert it with: openssl pkcs8 -topk8 -nocrypt -in old.pem -out new.pem.

No. The extraction runs entirely in your browser via the Web Crypto API. You can verify with your browser's DevTools Network panel — clicking Extract produces zero network traffic. The private key exists only in this tab's memory and is destroyed when you close it.

Four formats, toggleable: PEM (SPKI, the -----BEGIN PUBLIC KEY----- form used by openssl / Node / Go / Python), JWK (JSON form used by JWTs and browsers), DER · hex, and DER · base64 (raw bytes for low-level inspection). Copy whichever your target system expects.

Yes, and you should whenever it matters. Use our RSA Encrypt & Decrypt or ECDSA Sign & Verify tools: encrypt something with the extracted public key and decrypt with the original private key (or sign with the private key and verify with the extracted public key). If both succeed, the pair matches.