Public key from cert / private key
Extract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.
Public key from cert / private key reads the DER shape, not the PEM label, then prints a PEM block labelled PUBLIC KEY beside a describing line. RSA always works, because the modulus and exponent sit inside the private key itself. An EC key lacking its optional public point is refused: no scalar multiplication happens here.
Questions
What can I extract a public key from?
An X.509 certificate, where the public key is simply present, or an RSA or EC private key. The tool decides which it has from the DER structure rather than from the PEM label, so a mislabelled file still works. The output is a PEM block labelled PUBLIC KEY plus a description line.
Why did it refuse my EC private key?
Because that key does not carry its public point. SEC1 makes the public key field optional in an EC private key, and when it is missing the tool stops with a message saying the field is absent and that deriving it needs elliptic curve scalar multiplication, which this tool does not implement. Most EC keys do include the point, so this is uncommon.
Why does RSA always work?
Because an RSA private key already contains the modulus and public exponent. The tool reads both, rebuilds a SubjectPublicKeyInfo around them and prints it as PEM, and the description line reports the modulus size in bits and the exponent. No scalar multiplication is needed, which is what makes the EC case harder.
Can it open a password protected private key?
No. There is no passphrase field on the page, so an encrypted private key cannot be read and will not match the structures this tool expects. Decrypt it with your own tooling first, then drop the plain key here. Certificates never have this problem, since a public key is not secret.
Does my private key get uploaded?
No. The whole operation is DER parsing and re-encoding inside a Web Worker in this tab, with no network involved at any point and nothing kept after the run. That is the reason to extract a public key here rather than pasting a private key into a site that processes it on a server.