RSA Key Pair Generator
CryptoGenerate RSA key pairs in PEM format via the Web Crypto API with 1024-4096 bit keys. Web Crypto native, exportable PEM keys for any stack or service you use.
Related Tools
About RSA Key Pair Generator
RSA is the classic asymmetric algorithm: in a key pair the public key encrypts or verifies while the private key decrypts or signs, used widely in HTTPS certificates, SSH, and JWT RS256. This tool generates an RSA key pair locally with the browser's Web Crypto API, with selectable 2048/3072/4096-bit length, and outputs standard PEM (SPKI public key, PKCS#8 private key) ready to paste into config or code. For example, choosing 2048 bits generates a PEM private/public key pair for signing, verification or SSH key testing.
How to Use
- Open the RSA Key Pair Generator tool
- Enter the content and set the parameters
- Adjust the output options as needed
- Click the Generate button; results appear in real time
- Copy or export the result
Use Cases
- Generate test key pairs — Quickly produce an RSA PEM pair for a local sign/verify flow under development.
- Configure JWT RS256 — Create the pair to sign JWTs with the private key and verify with the public key while debugging auth.
- Learn asymmetric crypto — Follow public-key encryption and private-key decryption to understand how RSA works.
- Prepare a JWKS — Convert the public key to JWK to build an OIDC public-key endpoint.
- Validate key format — Check whether an existing PEM is a valid SPKI/PKCS#8 structure.
- SSH key bootstrap — Generate an RSA pair and paste the public key into a server's authorized_keys for SSH access.
- Self-signed TLS cert — Create an RSA key pair to use as the foundation for a self-signed TLS certificate for local development.
FAQ
Should I pick 2048 or 4096 bits?
2048-bit is still considered secure and faster, the default for most cases; choose 3072/4096 for long-term confidentiality, but longer keys make signing and verifying slower, so weigh the trade-off.
What are SPKI and PKCS#8?
They are key encodings. This tool emits the public key as SPKI (PEM BEGIN PUBLIC KEY) and the private key as PKCS#8 (BEGIN PRIVATE KEY), the standard formats modern libraries use.
Can RSA encrypt large files directly?
No. RSA can encrypt only data smaller than the key size in one shot. In practice you RSA-encrypt a random AES key and use AES for the bulk data, known as hybrid encryption.
Can public and private keys swap roles?
Not freely. The public key encrypts and verifies; the private key decrypts and signs. The public key can be shared, while the private key must stay secret, since a leak destroys all security.
Is generating production keys in a browser safe?
crypto.subtle's randomness itself is reliable, but the browser may carry extension or script risks. Generate critical production keys on an isolated server; this tool suits development and testing better.