Key Passphrase Remover
or drop your .key / .pem file anywhere on this card
or drop your .key / .pem file anywhere on this card
Paste your private key, or drop the .key/.pem file onto the card.
Enter the current passphrase if the key is encrypted.
Choose "Remove passphrase" (for servers) or "Set / change passphrase" (for backups), then click the button.
Download the converted key and point your server or backup at it.
A passphrase-protected private key is great for backups and terrible for servers: Nginx or Apache will sit at boot waiting for someone to type it. Removing the passphrase — the openssl pkey ritual — is a one-click job here, and it runs entirely in your browser, which is the only acceptable place to handle a private key online.
The tool reads PKCS#8 (encrypted or not), traditional RSA and SEC1 EC formats, and outputs a clean PKCS#8 PEM. It also works in reverse: paste a plain key, choose "Set / change passphrase", and get an AES-256 encrypted copy for safe keeping.
100% private“The key and every passphrase you type are processed in this tab’s memory only — nothing is uploaded, logged or stored. Do it offline if you like: load the page, disconnect, convert.”
It is the industry norm — almost every production web server key is passphrase-less, protected by file permissions (chmod 600, owned by root) instead. The passphrase mainly protects keys at rest in backups and transfers; keep an encrypted copy for those.
PKCS#8 with AES-256-CBC — the same thing openssl pkey produces by default on modern versions, and readable by every mainstream server and tool.
Watch for keyboard-layout differences and copy-pasted trailing whitespace. Also note the legacy "Proc-Type: 4,ENCRYPTED" RSA format and modern encrypted PKCS#8 derive keys differently — this tool handles both, but a wrong character fails identically in each.