Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Web & auth
  3. Certificate key matcher
Your files stay on your device

Certificate key matcher

Compares a pasted certificate, CSR or public key against a pasted private key entirely in the browser and reports match or no match, with passphrase handling for encrypted keys.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Certificate, CSR or public key

PEM text · the first block in the paste is the one checked

Private key

PEM text · stays in this tab, never uploaded

Paste key material on both sides to run the comparison.

The comparison reduces both pastes to their public key and compares that, not the metadata around it, which is why a certificate and a bare key file still line up. What it does not do: it derives no public key for Ed25519 or X25519 private keys (their PEMs carry only the seed), skips EC keys saved without an embedded public point, and decrypts only PBES2 encrypted keys (PBKDF2 with AES-CBC), the scheme modern OpenSSL writes. Nothing is uploaded: the parsing, the decryption, and the comparison all happen in this tab.

Options

More settings▾
Only for encrypted PKCS#8 keys

The passphrase never leaves this tab. It decrypts the key in memory for the comparison and is not stored anywhere.

Each paste is capped at 200,000 characters. Accepted labels: CERTIFICATE, CERTIFICATE REQUEST, and PUBLIC KEY on one side; PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, and EC PRIVATE KEY on the other. The result updates as you paste.

More web & auth tools

  • Certificate & CSR
  • SSH key inspector
All web & auth tools

Was this tool useful?