Skip to content

PKI Workbench & Key Matcher

Compare certificates, CSRs, and private keys; verify public-key matches, inspect supplied signature links, and order certificate chains locally.

Local input limit: 20 MB · Processing timeout: 120 s
How can I verify this?

Open your browser DevTools and the Network panel, optionally clear existing requests, then run the tool. Page assets or consent-based analytics may still load, but tool payloads, files, keys, and results are not sent for processing.

Compare PKI artifacts

Add up to 32 certificate, CSR, or private-key files. Processing runs in disposable browser workers; private key bytes and parameters are never returned to the relationship result.

PKI relationship result

Artifact metadata, matching public keys, supplied certificate signature links, chain order, and review findings will appear here.

Match public-key material without exporting private keys

DecodeLens derives bounded public metadata from each artifact, verifies private key consistency with a local sign/verify proof, compares exact SPKI SHA-256 fingerprints, and retains certificate signature verification as a separate relationship.

Verification and trust boundaries

  • Supports PEM/DER X.509 certificates and PKCS#10 CSRs plus unencrypted PKCS#8, RSA PKCS#1, and EC SEC1 private keys.
  • Private key bytes, private JWK parameters, and proof signatures are never returned to the workspace result.
  • Key Usage, Extended Key Usage, Basic Constraints, and pathLength findings use only the supplied verified chain; they are not a complete trust-path validation.
  • Only supplied certificates are used; AIA, OCSP, CRL, Certificate Transparency, and remote URLs are not fetched.
  • Public-key equality and certificate signature verification do not establish operating-system or browser trust.

Related tools for this workflow

Continue with tools that decode, convert, inspect, or verify the same data.