Generate random RSA private and public key pairs in standard PEM format locally.
Loading tool
About RSA key pair generator
Generates an RSA key pair with your browser's WebCrypto API in 1024, 2048, 3072 or 4096-bit sizes, with public exponent 65537. The private key is exported as PKCS#8 PEM, the public key as SPKI PEM and also as a JWK. The algorithm choice (RSASSA-PKCS1-v1_5, RSA-PSS or RSA-OAEP) only changes the JWK 'alg' value; the PEM files are standard and work with OpenSSL, Node.js and Java. Keys are generated locally and never leave the page.
Common uses
- Create a key pair for signing JWTs (RS256, PS256) in development
- Get test keys for encryption or signature code
- Generate a public key in JWK form for a JWKS endpoint
- Produce PEM files to try OpenSSL or library commands
FAQ
- What RSA key size should I use?
- 2048 bits is the common minimum today and 3072 bits is recommended for use well beyond 2030. 1024-bit keys are considered insecure.
- What is the difference between PKCS#8 and PKCS#1 PEM?
- PKCS#8 ('BEGIN PRIVATE KEY') is a generic container that records the key algorithm, while PKCS#1 ('BEGIN RSA PRIVATE KEY') is RSA-specific. OpenSSL can convert between them.
- Can I use these keys for SSH?
- Not directly; SSH uses its own public key format. You can convert the PEM public key with 'ssh-keygen -i -m PKCS8 -f public.pem', or use an SSH key generator instead.
- Should I generate production keys in a browser?
- For production secrets it is safer to generate keys on the machine or in the key management system that will use them. This tool is best for development and testing.