Certificate tools that never see your keys
PFX conversion, certificate and CSR decoding, key matching, chain ordering — everything runs in your browser. No uploads, no accounts, no server.
- No uploads
- No accounts
- No ads, no tracking
- Free
- Works offline once loaded
Tools
All seven tools share the same property: your file stays on your machine.
PFX → PEM
Extract the private key and certificate chain from a .pfx / .p12 file.
PEM → PFX
Build a password-protected .pfx / .p12 from a key and certificates.
Certificate decoder
Subject, issuer, SANs, validity, serial, signature algorithm — PEM or DER.
CSR decoder
Read a signing request: subject, SANs, key info, signature check.
Key ↔ certificate match
Check whether this private key really belongs to this certificate.
Chain order
Sort certificates leaf → intermediate → root and find missing issuers.
DER & JWK inspector
Inspect DER certificates and JWK / JWK-set JSON without verifying claims.
How “local” works
- One vendored library. Parsing and crypto use a pinned copy ofnode-forge 1.4.0 served from this domain — not a CDN, and not a service.
- Zero network calls in the tool flows. Open DevTools → Network, run any tool, and you will see no request containing your data. You can also load a page and then disconnect: the tools keep working.
- No storage. Nothing is written to localStorage, cookies or a server; results exist only in this tab until you close it.
- Verify, don’t trust. Every tool page links back to this section so you can check the claims with your own DevTools.
Trust & transparency
- No ads. No analytics. No tracking pixels. No affiliate links (a partner slot exists in the config and is unused).
- No accounts, no email required, no rate limits, no paid tier.
- Open-source repository — link coming soon: the parsing library and tests are already published with the project.
- RSA-first v1, with EC/Ed25519 on the roadmap — limitations are stated up front, not discovered later.
Frequently asked questions
Are my keys or files uploaded anywhere?
No. Every tool on this site runs entirely inside your browser tab: files are read with the browser File API, and the cryptography runs in JavaScript served from this domain. Your private keys never leave your device, and nothing is stored.
How can I verify that myself?
Open DevTools → Network, load any tool and run your file. You will see only the page assets (HTML, CSS, JS, favicon) — no request ever carries your file or password. You can also disconnect from the internet after the page loads: the tools keep working.
Why is EC support missing?
v1 is deliberately RSA-first: the whole toolkit was proven end-to-end on RSA before adding more. EC and Ed25519 support is the first item on the roadmap. When a tool meets an EC object it says so clearly instead of guessing.
Is a PFX created here compatible everywhere?
Files created by the PEM → PFX tool open in OpenSSL and Windows, and were tested against OpenSSL. Two honest details differ from an OpenSSL-built file: the MAC is HMAC-SHA-1 and the certificate bags are stored unencrypted inside the container. The tool page documents this before you use it.
Does it cost anything?
No. CertKit is free, has no accounts, no ads and no tracking. There is a reserved slot for a future certificate-provider partner link, and it is currently unused — no affiliate links are shown.
Should I use this with production keys?
Only on a machine you trust — that rule applies to every key tool, including this one. Because CertKit makes no network calls, it is safe to use fully offline, which is exactly how sensitive work should be done.