Local sensitive input

Choose a P12 or PFX file

Choose .p12 or .pfx

No local container selected.

Container password

An empty password is valid. The password remains in this tab and is cleared on request.

Limit: 32 MiB, 2,000 bags, and 5,000,000 password-derivation iterations. Modern PBES2 + PBKDF2 + AES-CBC is decrypted through Web Crypto. Legacy PKCS#12 RC2/3DES encryption is identified but not decrypted here.

Choose a container or load the teaching sample.

Inspection result

Container inventory

Authenticated safes: —
Certificates: —
Private keys: —
Key relationships: —
MAC status: —
Legacy crypto: —
Errors: —
Warnings: —

Private-key export creates unencrypted PEM. I understand the downloaded file is sensitive and will store or delete it safely.

Safe and encryption inventory

#	Content type	Encryption	Status	Decoded bytes

Certificate inventory

Parent hints compare encoded issuer and subject names only. They are not signature, path, policy, revocation, or trust validation.

#	Name / subject	Issuer	Validity	SANs	Serial	SHA-256	Parent hint

Private-key inventory

#	Friendly name	Algorithm	Protection	Status	localKeyId

Key-to-certificate relationships

Key bag	Name	Certificate(s)	Evidence

Encryption algorithms

Scope	Algorithm	OID	Compatibility note

Findings

Search findings

Severity

Severity	Code	Context	Explanation

Local by design: file bytes, passwords, certificates, private keys, names, fingerprints, and exports stay in this browser tab. ToolQuill does not upload or send them.

What this inspector checks

The tool decodes the PFX, its AuthenticatedSafe and SafeBag structure, inventories certificate and private-key bags, verifies supported MacData, and records the actual encryption identifiers. For readable RSA or EC material it compares public-key evidence; otherwise it can report the weaker localKeyId attribute relationship separately.

Why an old PFX may fail in modern software

RFC 7292 defines the PFX, AuthSafe, SafeBag, and MacData structures. Modern PBES2 files can combine PBKDF2 and AES-CBC, which this page processes through the browser's Web Cryptography API. Older PKCS#12 password-based algorithms often use RC2 or 3DES; OpenSSL's PKCS#12 documentation describes legacy handling for those algorithms. This inspector names that compatibility evidence without attempting a weaker custom cryptographic implementation.

Exports and trust boundaries

Certificate PEM export contains only readable public certificates. Private-key PEM export is separate, disabled until an explicit confirmation, and produces unencrypted PKCS#8 material. Safe JSON deliberately omits DER certificate bytes, decrypted key bytes, and derived public-key evidence. Clear memory when finished and protect any key export like the original credential.

Validation boundary

A successful parse or public-key match does not establish identity, trust, or deployability. The tool does not validate signatures, build a standards-complete certification path, consult trust stores or revocation services, test application import, assess password strength, repair a PFX, or certify its security. Chain hints are name relationships only. Verify critical credentials with controlled platform tooling before use.

Frequently asked questions

Why can the file open but show a failed MAC?

Unencrypted structure may still be readable even when the password-derived integrity check fails. Treat the contents as unverified and confirm the password and original file.

Why is a legacy key still locked?

The browser API does not expose the old PKCS#12 RC2/3DES password schemes used by some exports. The algorithm evidence remains useful for diagnosing an import failure, but conversion belongs in trusted platform software.

Does a matching localKeyId prove the key belongs to a certificate?

No. It is an attribute association. A decoded public-key match is stronger evidence and the tool labels the two cases separately.

Browse PKI and DevOps tools · Inspect an Apple provisioning profile