--- product: Chilkat product_version: 11.7.0 language: js language_label: JavaScript class: PrivateKey license: free deprecated: false reference_html: https://www.chilkatsoft.com/refdoc/jsPrivateKeyRef.html --- # Chilkat PrivateKey — JavaScript — v11.7.0 > Chilkat 11.7.0 · language=js · class=PrivateKey > Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0//classes/PrivateKey.md`. > Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/js/guide.md`. ## Purpose PrivateKey **Load, inspect, export, save, and convert one private key.** `PrivateKey` is a key-container class. It holds one current RSA, DSA, EC, or Ed25519 private key and provides format conversion, persistence, JWK/XML access, raw EC and Ed25519 access, and public-key extraction. Cryptographic operations such as signing, decryption, TLS authentication, and SSH authentication are performed by other Chilkat classes that receive the loaded `PrivateKey`. **Content-based loading** Named load methods inspect the content and recognize supported unencrypted formats. Password-taking loaders also recognize encrypted PKCS #8 and unencrypted input. **Standard export choices** Use PKCS #8 for modern algorithm-independent interchange, encrypted PKCS #8 for password-protected storage, JWK for JOSE, and traditional PEM only when required by a legacy consumer. **One-key state** A successful load replaces the current key. A failed load leaves the object empty. Check `KeyType` and `BitLength` after loading when the expected algorithm matters. **Independent public key** `ToPublicKey` creates an independent `PublicKey` that is unaffected when this object is reloaded with another key. **Key generation** Generate new keys with `Rsa`, `Ecc`, or `EdDSA`, which can place the generated key into a `PrivateKey`. **Certificates are separate** A private key does not contain a certificate or chain. Use `Cert` or `Pfx` when certificate association is required. **Recommended format selection:** Prefer unencrypted PKCS #8 for transient interchange, encrypted PKCS #8 with `aes256` and a strong password for stored key files, JWK for JWT/JWS/JWE workflows, and traditional RSA or EC PEM only when the receiving software requires it. **Protect private material:** Base64, hexadecimal, PEM, JWK, and XML are encodings or containers, not encryption. Avoid exporting a private key unless necessary, and protect every unencrypted representation as sensitive data. For an extended overview, see [PrivateKey Class Overview](https://www.chilkatsoft.com/privatekey_class_overview.asp). ## Object creation, unlocking and error handling **Object Creation** Note: This is intended for running within a [Chilkat.Js embedded JavaScript engine](https://www.chilkatsoft.com/chilkat_javascript_engine.asp). ``` var obj = new CkPrivateKey(); ``` Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in JavaScript. How failure is reported depends on the method's return type and is stated in the note under each method below. In every case the diagnostic text is in the `LastErrorText` property of the object whose method was called. ## Members common to every Chilkat class Documented once per language in `common-members.md`; listed here so this page is self-contained. | Property | Signature | Access | Meaning | |---|---|---|---| | `DebugLogFilePath` | `DebugLogFilePath` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. | | `LastErrorHtml` | `LastErrorHtml` | read-only | Provides HTML-formatted information about the last called method or property. | | `LastErrorText` | `LastErrorText` | read-only | Provides plain text information about the last called method or property. | | `LastErrorXml` | `LastErrorXml` | read-only | Provides XML-formatted information about the last called method or property. | | `LastMethodSuccess` | `LastMethodSuccess` | read/write | Indicates the success or failure of the most recent method call: `true` means success, `false` means failure. | | `VerboseLogging` | `VerboseLogging` | read/write | If set to `true`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. | | `Version` | `Version` | read-only | Version of the component/library, such as "10.1.0" | ## Member index | Member | Kind | Signature | |---|---|---| | `BitLength` | property, read-only | `BitLength` | | `KeyType` | property, read-only | `KeyType` | | `Pkcs8EncryptAlg` | property, read/write | `Pkcs8EncryptAlg` | | `UncommonOptions` | property, read/write | `UncommonOptions` | | `GetJwk` | method | `var strVal = GetJwk();` | | `GetJwkThumbprint` | method | `var strVal = GetJwkThumbprint(hashAlg);` | | `GetPkcs1ENC` | method | `var strVal = GetPkcs1ENC(encoding);` | | `GetPkcs1Pem` | method | `var strVal = GetPkcs1Pem();` | | `GetPkcs8ENC` | method | `var strVal = GetPkcs8ENC(encoding);` | | `GetPkcs8EncryptedENC` | method | `var strVal = GetPkcs8EncryptedENC(encoding, password);` | | `GetPkcs8EncryptedPem` | method | `var strVal = GetPkcs8EncryptedPem(password);` | | `GetPkcs8Pem` | method | `var strVal = GetPkcs8Pem();` | | `GetPkcsBd` | method | `var success = GetPkcsBd(pkcs1, password, bd);` | | `GetRawHex` | method | `var strVal = GetRawHex(pubKey);` | | `GetXml` | method | `var strVal = GetXml();` | | `LoadAnyFormat` | method | `var success = LoadAnyFormat(privKeyData, password);` | | `LoadAnyFormatFile` | method | `var success = LoadAnyFormatFile(path, password);` | | `LoadEd25519` | method | `var success = LoadEd25519(privKey, pubKey);` | | `LoadEncryptedPem` | method | `var success = LoadEncryptedPem(pemStr, password);` | | `LoadEncryptedPemFile` | method | `var success = LoadEncryptedPemFile(path, password);` | | `LoadJwk` | method | `var success = LoadJwk(jsonStr);` | | `LoadPem` | method | `var success = LoadPem(str);` | | `LoadPemFile` | method | `var success = LoadPemFile(path);` | | `LoadPkcs1File` | method | `var success = LoadPkcs1File(path);` | | `LoadPkcs8EncryptedFile` | method | `var success = LoadPkcs8EncryptedFile(path, password);` | | `LoadPkcs8File` | method | `var success = LoadPkcs8File(path);` | | `LoadPvkFile` | method | `var success = LoadPvkFile(path, password);` | | `LoadXml` | method | `var success = LoadXml(xml);` | | `LoadXmlFile` | method | `var success = LoadXmlFile(path);` | | `SavePemFile` | method | `var success = SavePemFile(path);` | | `SavePkcs1File` | method | `var success = SavePkcs1File(path);` | | `SavePkcs8EncryptedFile` | method | `var success = SavePkcs8EncryptedFile(password, path);` | | `SavePkcs8EncryptedPemFile` | method | `var success = SavePkcs8EncryptedPemFile(password, path);` | | `SavePkcs8File` | method | `var success = SavePkcs8File(path);` | | `SavePkcs8PemFile` | method | `var success = SavePkcs8PemFile(path);` | | `SaveXmlFile` | method | `var success = SaveXmlFile(path);` | | `ToPublicKey` | method | `var success = ToPublicKey(pubKey);` | | `UploadToCloud` | method | `var success = UploadToCloud(jsonIn, jsonOut);` | ## Properties ### PrivateKey.BitLength `Chilkat 11.7.0 · js · PrivateKey · BitLength · property · read-only · since 9.5.0.49` ```javascript BitLength ``` · `int`, `read-only` Returns the nominal size of the loaded private key, in bits. The value is `0` when the object is empty. For RSA it is the modulus size; for DSA it is the size of `p`; for EC it is the named-curve field size; and for Ed25519 it is `256`. **Comparing strength:** Bit lengths are meaningful only within the context of the algorithm. A 256-bit EC key and a 256-bit RSA key do not provide comparable security. ### PrivateKey.KeyType `Chilkat 11.7.0 · js · PrivateKey · KeyType · property · read-only · since 9.5.0.52` ```javascript KeyType ``` · `string`, `read-only` Identifies the algorithm of the currently loaded key. The value is one of `empty`, `rsa`, `dsa`, `ecc`, or `ed25519`. `empty` means that no usable private key is loaded. **One-key state model:** A `PrivateKey` object holds one current key. Loading another key replaces it; a failed load leaves the object empty. ### PrivateKey.Pkcs8EncryptAlg `Chilkat 11.7.0 · js · PrivateKey · Pkcs8EncryptAlg · property · read/write · since 9.5.0.49` ```javascript Pkcs8EncryptAlg ``` · `string` Controls the block cipher used by encrypted PKCS #8 export methods. Supported values are `3des`, `aes128`, `aes192`, and `aes256`. Values are case-insensitive and are normalized to lowercase. The default is `3des`. Assigning an empty or unrecognized value resets the property to `3des`. All choices use CBC mode. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Recommended setting:** Prefer `aes256` for new output unless an older consumer requires 3DES. This property selects encryption parameters only; password quality remains essential. ### PrivateKey.UncommonOptions `Chilkat 11.7.0 · js · PrivateKey · UncommonOptions · property · read/write · since 9.5.0.96` ```javascript UncommonOptions ``` · `string` Provides a catch-all string for specialized compatibility options that are not exposed as ordinary properties. The default is the empty string, which is appropriate for normal use. **Leave empty unless instructed:** Set this property only when a Chilkat example, release note, or support response documents a specific option needed for an unusual interoperability case. ## Methods ### PrivateKey.GetJwk `Chilkat 11.7.0 · js · PrivateKey · GetJwk · method · since 9.5.0.66` ```javascript var strVal = GetJwk(); ``` · return: `string` Exports the key as a compact JWK (JSON Web Key). Binary integers and byte strings use Base64url without padding. | Key type | Members emitted | | :--- | :--- | | RSA | `kty`, `n`, `e`, `d`, `p`, `q`, `dp`, `dq`, `qi` | | EC | `kty`, `crv`, `x`, `y`, `d` | | Ed25519 | `kty`=`OKP`, `crv`=`Ed25519`, `x`, `d`, and `use`=`sig` | **Key material only:** Optional JOSE metadata loaded from a JWK, such as `kid`, `alg`, `key_ops`, or a caller-supplied `use`, is not retained for re-export. The Ed25519 `use`=`sig` member is emitted by Chilkat. **Private output:** The returned JSON contains private key material and must be protected accordingly. Returns `null` on failure ### PrivateKey.GetJwkThumbprint `Chilkat 11.7.0 · js · PrivateKey · GetJwkThumbprint · method · since 9.5.0.66` ```javascript var strVal = GetJwkThumbprint(hashAlg); ``` · return: `string` · hashAlg: `string` Computes the RFC 7638 thumbprint of the public portion of the loaded key using the hash algorithm named by `hashAlg`. Supported values include `md5`, `sha1`, `sha256`, `sha384`, and `sha512`. An unsupported name causes the method to fail. The returned digest is Base64url-encoded without padding. **Public-key identity:** The canonical thumbprint input contains only the required public JWK members. Private members and optional metadata such as `kid`, `use`, and `alg` are excluded, so the result matches the thumbprint of the corresponding `PublicKey`. **Recommended hash:** Use `sha256` for normal RFC 7638 interoperability. MD5 and SHA-1 are available for compatibility but should not be chosen for new security-sensitive identifiers. Returns `null` on failure ### PrivateKey.GetPkcs1ENC `Chilkat 11.7.0 · js · PrivateKey · GetPkcs1ENC · method · since 9.5.0.52` ```javascript var strVal = GetPkcs1ENC(encoding); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · return: `string` · encoding: `string` Exports the key as the traditional or preferred unencrypted DER representation and encodes the DER as text using the binary encoding named by `encoding`. The binary bytes are the same as returned by `GetPkcs1`. **Historical method name:** PKCS #1 is specifically an RSA standard. For non-RSA key types, this method returns the applicable traditional structure or a PKCS #8 fallback. | Key type | Returned representation | | :--- | :--- | | RSA | `RSAPrivateKey` DER from PKCS #1. | | DSA | The traditional six-integer DSA private-key structure. | | EC | `ECPrivateKey` DER from RFC 5915. | | Ed25519 | PKCS #8 `PrivateKeyInfo` DER using the Ed25519 OID `1.3.101.112`, because Ed25519 has no traditional PKCS #1 form. | For RSA, the DER contains: ``` RSAPrivateKey ::= SEQUENCE { version Version, modulus INTEGER, -- n publicExponent INTEGER, -- e privateExponent INTEGER, -- d prime1 INTEGER, -- p prime2 INTEGER, -- q exponent1 INTEGER, -- d mod (p-1) exponent2 INTEGER, -- d mod (q-1) coefficient INTEGER, -- (inverse of q) mod p otherPrimeInfos OtherPrimeInfos OPTIONAL } ``` For EC, the traditional structure is: ``` ECPrivateKey ::= SEQUENCE { version INTEGER { ecPrivkeyVer1(1) }, privateKey OCTET STRING, parameters [0] ECParameters OPTIONAL, publicKey [1] BIT STRING OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. Returns `null` on failure ### PrivateKey.GetPkcs1Pem `Chilkat 11.7.0 · js · PrivateKey · GetPkcs1Pem · method · since 9.5.0.58` ```javascript var strVal = GetPkcs1Pem(); ``` · return: `string` Exports the key as unencrypted PEM, preferring the traditional algorithm-specific representation when one exists. | Key type | PEM label | Body | | :--- | :--- | :--- | | RSA | `RSA PRIVATE KEY` | PKCS #1 DER | | DSA | `DSA PRIVATE KEY` | Traditional DSA DER | | EC | `EC PRIVATE KEY` | RFC 5915 DER | | Ed25519 | `PRIVATE KEY` | PKCS #8 DER | **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** The returned private key is not encrypted. Returns `null` on failure ### PrivateKey.GetPkcs8ENC `Chilkat 11.7.0 · js · PrivateKey · GetPkcs8ENC · method · since 9.5.0.52` ```javascript var strVal = GetPkcs8ENC(encoding); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · return: `string` · encoding: `string` Exports the key as unencrypted PKCS #8 DER and encodes the DER as text using the binary encoding named by `encoding`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail; it does not silently select another encoding. **Encoding is not encryption:** Base64, hexadecimal, and similar encodings only represent the DER bytes as text. They do not protect the private key. Returns `null` on failure ### PrivateKey.GetPkcs8EncryptedENC `Chilkat 11.7.0 · js · PrivateKey · GetPkcs8EncryptedENC · method · since 9.5.0.52` ```javascript var strVal = GetPkcs8EncryptedENC(encoding, password); ``` **Full documentation for this method (same in every language):** [Supported Binary Encodings](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md) · return: `string` · encoding: `string` · password: `string` Exports the key as password-protected PKCS #8 DER, then encodes the encrypted DER as text. `encoding` names the binary encoding and `password` supplies the password. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Encoding validation:** An unsupported `encoding` encoding name causes the method to fail. **Empty passwords:** A nonempty, strong password should be used. An empty `password` is accepted but provides no meaningful password protection. Returns `null` on failure ### PrivateKey.GetPkcs8EncryptedPem `Chilkat 11.7.0 · js · PrivateKey · GetPkcs8EncryptedPem · method` ```javascript var strVal = GetPkcs8EncryptedPem(password); ``` · return: `string` · password: `string` Exports the key as password-protected PKCS #8 PEM using `password` as the password. The cipher is selected by `Pkcs8EncryptAlg`. The output uses: ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Empty passwords:** An empty `password` is accepted and still produces encrypted PKCS #8, but it provides no meaningful password protection. Returns `null` on failure ### PrivateKey.GetPkcs8Pem `Chilkat 11.7.0 · js · PrivateKey · GetPkcs8Pem · method` ```javascript var strVal = GetPkcs8Pem(); ``` · return: `string` Exports the key as unencrypted PKCS #8 PEM. For RSA, EC, and Ed25519, the PEM armor is: ``` -----BEGIN PRIVATE KEY----- ... -----END PRIVATE KEY----- ``` PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **Security note:** This output is not password-protected. Returns `null` on failure ### PrivateKey.GetPkcsBd `Chilkat 11.7.0 · js · PrivateKey · GetPkcsBd · method · since 11.0.0` ```javascript var success = GetPkcsBd(pkcs1, password, bd); ``` · return: `boolean`; `true` for success, `false` for failure · pkcs1: `boolean` · password: `string` · bd: `CkBinData` Exports the key as DER and replaces the contents of the `BinData` in `bd`. | `pkcs1` | `password` | Output | | :--- | :--- | :--- | | `true` | Ignored for encryption. | RSA PKCS #1, traditional DSA, RFC 5915 EC, or PKCS #8 for Ed25519. | | `false` | Empty string. | Unencrypted PKCS #8 DER. | | `false` | Nonempty password. | Encrypted PKCS #8 DER using `Pkcs8EncryptAlg`. | **Output state:** A successful call replaces any existing `bd` content. If the call fails, `bd` is cleared. **Password behavior:** When `pkcs1` is `true`, `password` does not encrypt the output. To obtain encrypted output, set `pkcs1` to `false` and provide a nonempty `password`. Returns true for success, false for failure. ### PrivateKey.GetRawHex `Chilkat 11.7.0 · js · PrivateKey · GetRawHex · method · since 9.5.0.83` ```javascript var strVal = GetRawHex(pubKey); ``` · return: `string` · pubKey: `CkStringBuilder` Exports the raw private value as lowercase hexadecimal and replaces the contents of the `StringBuilder` in `pubKey` with the corresponding raw public key. | Key type | Returned private value | Public value in `pubKey` | | :--- | :--- | :--- | | Ed25519 | The 32-byte seed accepted by `LoadEd25519`, as 64 hex characters. | The 32-byte public key, as 64 hex characters. | | EC | The private scalar, padded to the curve size as needed. | The uncompressed point `04 \|\| HEX(x) \|\| HEX(y)`. | **Applicable key types:** This method supports Ed25519 and ordinary EC keys. RSA and DSA keys do not have a single simple raw representation and cause the method to fail. **Output on failure:** If the method fails, `pubKey` is cleared. Returns `null` on failure ### PrivateKey.GetXml `Chilkat 11.7.0 · js · PrivateKey · GetXml · method` ```javascript var strVal = GetXml(); ``` · return: `string` Exports the key in Chilkat-compatible XML. The XML is not encrypted. RSA and DSA components use ordinary Base64. RSA keys use: ``` ... ... ...

...

... ... ... ... ``` DSA keys use: ```

...

... ... ... ... ``` EC keys place the named curve in the `curve` attribute and Base64-encode the RFC 5915 `ECPrivateKey` DER in the element content: ``` ... ``` Ed25519 keys Base64-encode 64 bytes consisting of the 32-byte private seed followed by the 32-byte public key: ``` ... ``` **Round-trip support:** XML produced by this method can be loaded by `LoadXml`, `LoadXmlFile`, or the general format-detection methods. **Interoperability note:** These XML forms are Chilkat-compatible representations. Prefer PKCS #8, PEM, or JWK when interoperating with systems that expect standard key containers. Returns `null` on failure ### PrivateKey.LoadAnyFormat `Chilkat 11.7.0 · js · PrivateKey · LoadAnyFormat · method · since 9.5.0.75` ```javascript var success = LoadAnyFormat(privKeyData, password); ``` · return: `boolean`; `true` for success, `false` for failure · privKeyData: `CkBinData` · password: `string` Loads a private key from the data in `privKeyData` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when the detected representation is encrypted; otherwise it may be empty. **Text and binary input:** `privKeyData` contains the exact bytes to inspect. Textual PEM, JWK, and XML are detected from those bytes; a filename extension is not involved. **Trailing DER data:** If the input begins with one complete supported DER key followed by extra bytes or another DER object, the first key is loaded and trailing data is ignored. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadAnyFormatFile `Chilkat 11.7.0 · js · PrivateKey · LoadAnyFormatFile · method · since 9.5.0.83` ```javascript var success = LoadAnyFormatFile(path, password); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` · password: `string` Loads a private key from the file at `path` by inspecting its contents. Recognized representations include RSA PKCS #1 DER, traditional DSA and EC DER, PKCS #8 DER, encrypted PKCS #8, PEM, JWK, Chilkat-compatible XML, Microsoft PVK, and supported Ed25519 representations. `password` supplies the password when needed. **Filename extensions are advisory:** The file content determines the format; a nonstandard or misleading extension does not prevent recognition. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadEd25519 `Chilkat 11.7.0 · js · PrivateKey · LoadEd25519 · method · since 9.5.0.83` ```javascript var success = LoadEd25519(privKey, pubKey); ``` · return: `boolean`; `true` for success, `false` for failure · privKey: `string` · pubKey: `string` Loads an Ed25519 key pair from raw hexadecimal values. `privKey` is the 32-byte Ed25519 private seed. `pubKey` is the 32-byte public key. Each nonempty value must contain exactly 64 hexadecimal digits. Uppercase hexadecimal and an optional `0x` prefix are accepted; embedded whitespace is not accepted. `pubKey` may be empty, in which case Chilkat derives the public key from the seed. **Supplied public key is not verified:** When `pubKey` is nonempty, Chilkat stores the supplied public value without checking that it corresponds to `privKey`. Pass an empty `pubKey` when the public key should be derived and guaranteed to match the private seed. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadEncryptedPem `Chilkat 11.7.0 · js · PrivateKey · LoadEncryptedPem · method` ```javascript var success = LoadEncryptedPem(pemStr, password); ``` · return: `boolean`; `true` for success, `false` for failure · pemStr: `string` · password: `string` Loads a private key from the PEM text in `pemStr`. `password` supplies the password when the PEM is encrypted. The method accepts encrypted PKCS #8 PEM and also loads supported unencrypted PEM. ``` -----BEGIN ENCRYPTED PRIVATE KEY----- ... -----END ENCRYPTED PRIVATE KEY----- ``` **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. **Password failure:** An incorrect password causes loading to fail and leaves this object empty. Returns true for success, false for failure. ### PrivateKey.LoadEncryptedPemFile `Chilkat 11.7.0 · js · PrivateKey · LoadEncryptedPemFile · method` ```javascript var success = LoadEncryptedPemFile(path, password); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` · password: `string` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The file may contain encrypted PKCS #8 PEM or another supported encrypted or unencrypted representation. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadJwk `Chilkat 11.7.0 · js · PrivateKey · LoadJwk · method · since 9.5.0.66` ```javascript var success = LoadJwk(jsonStr); ``` · return: `boolean`; `true` for success, `false` for failure · jsonStr: `string` Loads a private key from the JWK JSON in `jsonStr`. Supported private JWK key types are RSA (`kty`=`RSA`), EC (`kty`=`EC`), and Ed25519 (`kty`=`OKP`, `crv`=`Ed25519`). An unsupported `kty` causes the method to fail. **Private key material required:** A JWK containing only public members belongs in a `PublicKey`. This method is for JWKs that contain private key material. **Metadata handling:** Optional JOSE metadata such as `kid`, `use`, `alg`, and `key_ops` may be present but is not retained by `PrivateKey`. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPem `Chilkat 11.7.0 · js · PrivateKey · LoadPem · method` ```javascript var success = LoadPem(str); ``` · return: `boolean`; `true` for success, `false` for failure · str: `string` Loads a private key from the PEM text in `str`. This method has no password argument and therefore cannot load password-protected PEM. Use `LoadEncryptedPem` for encrypted input. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** If the text contains multiple PEM blocks, Chilkat selects the first supported private-key block. It skips preceding public-key or unrelated PEM blocks. **Accepted surrounding content:** Leading and trailing whitespace, a UTF-8 BOM, and trailing non-PEM text are accepted. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPemFile `Chilkat 11.7.0 · js · PrivateKey · LoadPemFile · method` ```javascript var success = LoadPemFile(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Loads a private key from the file at `path`. This method has no password argument and therefore cannot load a password-protected key. Use `LoadEncryptedPemFile` or `LoadAnyFormatFile` when a password may be required. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **PEM block selection:** For a file containing multiple PEM blocks, Chilkat selects the first supported private-key block and skips preceding public-key or unrelated blocks. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPkcs1File `Chilkat 11.7.0 · js · PrivateKey · LoadPkcs1File · method · since 9.5.0.58` ```javascript var success = LoadPkcs1File(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Loads a private key from the file at `path`. Despite the historical PKCS #1 name, the method examines the content and accepts supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPkcs8EncryptedFile `Chilkat 11.7.0 · js · PrivateKey · LoadPkcs8EncryptedFile · method` ```javascript var success = LoadPkcs8EncryptedFile(path, password); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` · password: `string` Loads a private key from the file at `path`, using `password` when the detected key is encrypted. The method can load encrypted PKCS #8 DER or PEM and also supported unencrypted representations. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPkcs8File `Chilkat 11.7.0 · js · PrivateKey · LoadPkcs8File · method` ```javascript var success = LoadPkcs8File(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Loads a private key from the file at `path`. Although named for unencrypted PKCS #8, the method examines the file content and accepts other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Trailing DER data:** When the file begins with a complete supported DER private-key object, trailing bytes or a second concatenated DER object are ignored; the first key is loaded. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadPvkFile `Chilkat 11.7.0 · js · PrivateKey · LoadPvkFile · method` ```javascript var success = LoadPvkFile(path, password); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` · password: `string` Loads a private key from the file at `path`, using `password` if the detected representation is encrypted. This Windows-only method supports Microsoft PVK and also participates in Chilkat private-key content auto-detection. **Content auto-detection:** Chilkat examines the content rather than relying on the method name or filename extension. This password-taking method can load both encrypted and unencrypted supported private-key representations. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadXml `Chilkat 11.7.0 · js · PrivateKey · LoadXml · method` ```javascript var success = LoadXml(xml); ``` · return: `boolean`; `true` for success, `false` for failure · xml: `string` Loads a private key from the XML text in `xml`. Supported Chilkat-compatible XML roots include `RSAKeyValue`, `DSAKeyValue`, `ECCKeyValue`, and `Ed25519KeyValue`. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Ed25519 XML:** The `Ed25519KeyValue` content is ordinary Base64 for the 32-byte private seed followed by the 32-byte public key. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.LoadXmlFile `Chilkat 11.7.0 · js · PrivateKey · LoadXmlFile · method` ```javascript var success = LoadXmlFile(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Loads a private key from the file at `path`. Chilkat recognizes RSA, DSA, EC, and Ed25519 XML produced by `GetXml`, and also auto-detects other supported unencrypted private-key representations. **Content auto-detection:** The method name identifies the expected or traditional use, but Chilkat examines the content and can load other supported unencrypted private-key representations. Encrypted input requires a load method that accepts a password. **Object state:** A successful load replaces any key already held by this object. If loading fails, this object is left empty. Returns true for success, false for failure. ### PrivateKey.SavePemFile `Chilkat 11.7.0 · js · PrivateKey · SavePemFile · method · since 9.5.0.58` ```javascript var success = SavePemFile(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Saves the key at `path` as unencrypted PEM, preferring a traditional algorithm-specific representation when one exists. RSA uses `RSA PRIVATE KEY`, DSA uses `DSA PRIVATE KEY`, EC uses `EC PRIVATE KEY`, and Ed25519 uses the PKCS #8 `PRIVATE KEY` form. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **PKCS #8 alternative:** Use `SavePkcs8PemFile` to always request the algorithm-independent PKCS #8 `PRIVATE KEY` form. **Security note:** The file is not password-protected. Returns true for success, false for failure. ### PrivateKey.SavePkcs1File `Chilkat 11.7.0 · js · PrivateKey · SavePkcs1File · method · since 9.5.0.58` ```javascript var success = SavePkcs1File(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Saves the key at `path` using the traditional or preferred unencrypted DER representation. **Historical method name:** RSA is saved as PKCS #1, EC as RFC 5915, DSA in its traditional structure, and Ed25519 as PKCS #8 because no traditional PKCS #1 form exists. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Security note:** The file contains cleartext private-key material. Returns true for success, false for failure. ### PrivateKey.SavePkcs8EncryptedFile `Chilkat 11.7.0 · js · PrivateKey · SavePkcs8EncryptedFile · method` ```javascript var success = SavePkcs8EncryptedFile(password, path); ``` · return: `boolean`; `true` for success, `false` for failure · password: `string` · path: `string` Saves the key as password-protected PKCS #8 DER. `password` supplies the password and `path` is the destination path. The cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns true for success, false for failure. ### PrivateKey.SavePkcs8EncryptedPemFile `Chilkat 11.7.0 · js · PrivateKey · SavePkcs8EncryptedPemFile · method` ```javascript var success = SavePkcs8EncryptedPemFile(password, path); ``` · return: `boolean`; `true` for success, `false` for failure · password: `string` · path: `string` Saves the key as password-protected PKCS #8 PEM. `password` supplies the password and `path` is the destination path. The file uses the `ENCRYPTED PRIVATE KEY` PEM label, and the cipher is selected by `Pkcs8EncryptAlg`. Encrypted PKCS #8 output uses PBES2 with PBKDF2. The generated parameters use an 8-byte salt, 2048 PBKDF2 iterations, and the default PBKDF2 PRF (HMAC-SHA-1). The selected cipher uses CBC mode with a newly generated IV. **Generated PEM formatting:** PEM output uses CRLF line endings, Base64 lines of at most 64 characters, and a final CRLF. **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **Empty passwords:** An empty `password` is accepted but provides no meaningful password protection. Returns true for success, false for failure. ### PrivateKey.SavePkcs8File `Chilkat 11.7.0 · js · PrivateKey · SavePkcs8File · method` ```javascript var success = SavePkcs8File(path); ``` · return: `boolean`; `true` for success, `false` for failure · path: `string` Saves the key as unencrypted PKCS #8 DER at `path`. PKCS #8 is an algorithm-independent private-key container. Chilkat emits the classic version-0 `PrivateKeyInfo` structure, with the algorithm-specific private-key DER in an `OCTET STRING`. ``` PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm AlgorithmIdentifier, privateKey OCTET STRING, attributes [0] IMPLICIT Attributes OPTIONAL } ``` **File behavior:** An existing destination file is replaced. Parent directories are not created; the parent directory must already exist. **macOS Keychain:** Starting in Chilkat v10.0.0, `path` may be formatted as `keychain: