How I check whether an RSA public key and private key belong together

RSA uses a pair of keys. The private key signs or decrypts. The public key verifies or encrypts. The two keys are related, but the public key should not reveal the private key.

The RSA Key Pair tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.

The simple mental model

RSA uses a pair of keys. The private key signs or decrypts. The public key verifies or encrypts. The two keys are related, but the public key should not reveal the private key.

I try to reduce the tool to one question: what input do I have, what output do I expect, and what would make the result unsafe or misleading?

Step 1: Identify which file is private and which file is public

Identify which file is private and which file is public.

Start with a small example first. A small example is easier to inspect than a real production-sized case.

Step 2: Check the PEM labels before pasting anything

Check the PEM labels before pasting anything.

Step 3: Use a test key when learning

Use a test key when learning.

Step 4: Paste both keys into the matcher

Paste both keys into the matcher.

Step 5: Confirm whether the keys match

Confirm whether the keys match.

Step 6: If they do not match, check environment mix-ups first

If they do not match, check environment mix-ups first.

Step 7: Never send a private key when someone only needs the public key

Never send a private key when someone only needs the public key.

My checklist

Before I trust the result, I check:

Identify which file is private and which file is public.
Check the PEM labels before pasting anything.
Use a test key when learning.
Paste both keys into the matcher.
Confirm whether the keys match.
If they do not match, check environment mix-ups first.
Never send a private key when someone only needs the public key.

The tool saves time, but the important part is still understanding the input and reviewing the output before using it somewhere important.