Algorithm, container, and encoding are different
An Ed25519, RSA, or ECDSA key is the cryptographic identity. OpenSSH private key, PuTTY PPK, and PKCS#8 PEM are containers around supported identities; PKCS#1 PEM is specific to RSA and SEC1 EC PEM is specific to ECDSA. Changing the container should not change the corresponding public-key fingerprint.
| Format | Typical header | Common use |
|---|---|---|
| OpenSSH | OPENSSH PRIVATE KEY | Modern OpenSSH clients and servers |
| PPK v2/v3 | PuTTY-User-Key-File | PuTTY-family applications |
| PKCS#1 PEM | RSA PRIVATE KEY | Legacy RSA-specific integrations |
| SEC1 EC PEM | EC PRIVATE KEY | EC-specific OpenSSL and integration workflows |
| PKCS#8 PEM | PRIVATE KEY or ENCRYPTED PRIVATE KEY | Algorithm-neutral tooling and libraries |
Start with a safe copy
- Use a trusted machine and browser profile, with unrelated extensions closed.
- Keep the original key unchanged until the converted key is tested.
- Do not paste production private keys into websites that upload or log the content.
- Prefer approved local command-line tooling when organizational policy forbids browser handling.
Local Dev Kit is delivered as static files. Supported key generation, diagnosis, authentication, and conversion run in the browser; the key workflow has no upload endpoint.
Convert, then verify identity
- Diagnose the source first. Detection confirms structure; it does not prove that every private-key value is valid.
- Select the destination required by the actual client or platform.
- Enter the source passphrase only when the container is encrypted.
- Choose an encrypted destination when supported. If an unencrypted output is required, confirm the risk deliberately.
- Convert locally and compare the displayed source and output public fingerprints.
- Download to a protected location, restrict file permissions, and test against a non-production endpoint.
- Replace or retire the old copy only after the new workflow is verified.
Encryption is not interoperability
A passphrase protects a private-key file at rest, but destination applications support different ciphers, KDFs, and container versions. “Encrypted” does not mean “accepted everywhere.” Use the compatibility profile that matches the receiving product and review any downgrade or unencrypted-output warning.
Supported scope and limitations
The Local Dev Kit converter generates Ed25519, RSA 2048/3072/4096, or ECDSA P-256/P-384/P-521 and converts the compatible containers and protection profiles listed for each algorithm. Format Doctor recognizes a broader set of algorithms for diagnosis, but recognition does not imply conversion support. Browser memory cannot be deterministically zeroized, and downloads remain subject to device, browser, extension, backup, and filesystem controls.