Paste a private key and a certificate (or CSR) to check whether they belong together. The comparison derives the public key from each input and compares them, which works for RSA and EC keys alike — unlike the older modulus comparison, which only works for RSA. Everything is computed in your browser and nothing is uploaded.
It never leaves the tab — parsing is local and the page blocks network requests at the browser level. That said, a key that has been pasted anywhere is one more place it has existed. The command-line check does the same job without that.
How does the comparison work?
It derives the public key from the private key, extracts the public key from the certificate, and compares them. This works for RSA, EC and Ed25519 alike — unlike the older modulus comparison, which is RSA-only and reports a false match for EC keys.
Why can it not read my encrypted key?
Because deriving the public key requires decrypting it, and this tool deliberately never asks for a passphrase. Decrypt locally with openssl pkey -in encrypted.key -out plain.key first.
They do not match — can it be fixed?
No. A certificate certifies one specific public key and only its counterpart can complete a handshake. Find the right key, or generate a new one and have the certificate reissued. See key values mismatch.