DER & JWK inspector
Two inspectors in one page: a DER certificate reader, and a JWK / JWK-set parser that shows kid, alg, use and key parameters — with no verification claims.
Runs locally in your browser — nothing is uploaded
DER certificate inspector
Read a raw DER certificate (.der / .cer) — the same decoder as the certificate tool, in compact form.
JWK / JWK-set inspector
Paste a single JWK or a { "keys": [ … ] } set. Parsed and described — not verified.
| # | kty | kid | alg | use | Size / curve | Private? |
|---|
Parsed for inspection only — no signature verification or key validation is performed. To check a key against a certificate, use the match checker (RSA).
Questions
Does parsing a JWK verify it?
No. This inspector parses and describes the JSON only: key type, key id, algorithm label, intended use, curve or size, and whether private material is present. It makes no claim that the key is valid, trusted or matches anything.
What does the JWK warning about “d” mean?
A JWK field "d" is private key material. CertKit cannot undo that exposure — if you pasted a real private JWK anywhere, treat that key as compromised and rotate it.
Can I inspect EC JWKs even though the X.509 tools are RSA-only?
Yes. JWK parsing is pure JSON, so EC, RSA and symmetric JWKs are all described. X.509/PKCS#12 handling is RSA-first in v1 — EC support is on the roadmap.
Is my file uploaded?
No. Both inspectors run in this tab. Open DevTools → Network and run them to confirm: no request carries your data.
How this runs locally
CertKit is a static site. Parsing and cryptography run inside this browser tab using a vendored copy of node-forge 1.4.0 served from this domain. Open DevTools → Network, run the tool, and you will see no request that contains your file — nothing is uploaded, and nothing is stored.