RSA Key Format Converter API — Free & Private

PKCS#1 ⇄ PKCS#8, SPKI ⇄ PKCS#1 public, PEM ⇄ DER — exactly what openssl pkcs8 -topk8 does, as an API. By formatho.com.

Open the full browser tool →

Free, no signup, runs entirely in your browser — your data never leaves your device.

FreeNo signupCORS enabledZero trackingGET + POST

PKCS#1 → PKCS#8

curl -G "https://key-format-converter-formatho.filesformatho.workers.dev/api" \
  --data-urlencode "key=-----BEGIN RSA PRIVATE KEY-----
... your key ...-----END RSA PRIVATE KEY-----" \
  --data-urlencode "to=pkcs8"

Response (excerpt):

{
  "input":     { "format": "pkcs1", "bits": 2048 },
  "converted": { "format": "pkcs8", "bits": 2048 },
  "pem": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
  "round_trip_ok": true
}

Conversions

to=	input	output label
pkcs8	PKCS#1 private (BEGIN RSA PRIVATE KEY)	BEGIN PRIVATE KEY
pkcs1	PKCS#8 private (BEGIN PRIVATE KEY)	BEGIN RSA PRIVATE KEY
spki	PKCS#1 public (BEGIN RSA PUBLIC KEY)	BEGIN PUBLIC KEY
pkcs1-public	SPKI public (BEGIN PUBLIC KEY)	BEGIN RSA PUBLIC KEY
der	any of the above	base64 DER bytes

Why you need this

AWS KMS / Java / modern tooling want PKCS#8; OpenSSL genrsa produces PKCS#1
SSH-style libs and older tooling want PKCS#1 back
Every conversion is verified by an automatic round trip (round_trip_ok: true) before it is returned

Clean errors

EC / Ed25519 keys → explicit "RSA only" message (no silent garbage)
Encrypted PEM (Proc-Type header) or PBES2 envelope → told to decrypt first
Truncated / tampered DER → exact TLV length mismatch message

Privacy: keys are converted in edge memory and discarded — never logged, never stored. Prefer POST so key material stays out of access logs.