RSA Key Pair Generator
CryptoGenerate RSA key pairs in PEM format via the Web Crypto API with 1024-4096 bit keys. Web Crypto native, exportable PEM keys for any stack or service.
About RSA Key Pair Generator
RSA is the classic asymmetric algorithm: in a key pair the public key encrypts or verifies while the private key decrypts or signs, used widely in HTTPS certificates, SSH, and JWT RS256. This tool generates an RSA key pair locally with the browser's Web Crypto API, with selectable 2048/3072/4096-bit length, and outputs standard PEM (SPKI public key, PKCS#8 private key) ready to paste into config or code. The private key is generated on your device and never uploaded, but once leaked it lets others impersonate you, so production keys are still best generated and stored on a controlled server. Tip: Bookmark this tool for quick access whenever you need to generate keys or hashes. All processing happens locally in your browser — no data upload, so it is safe to use with sensitive material.
How to Use
- Open the RSA Key Pair Generator tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Generate test key pairs — Quickly produce an RSA PEM pair for a local sign/verify flow under development.
- Configure JWT RS256 — Create the pair to sign JWTs with the private key and verify with the public key while debugging auth.
- Learn asymmetric crypto — Follow public-key encryption and private-key decryption to understand how RSA works.
- Prepare a JWKS — Convert the public key to JWK to build an OIDC public-key endpoint.
- Validate key format — Check whether an existing PEM is a valid SPKI/PKCS#8 structure.
- SSH key bootstrap — Generate an RSA pair and paste the public key into a server's authorized_keys for SSH access.
- Self-signed TLS cert — Create an RSA key pair to use as the foundation for a self-signed TLS certificate for local development.
FAQ
Should I pick 2048 or 4096 bits?
2048-bit is still considered secure and faster, the default for most cases; choose 3072/4096 for long-term confidentiality, but longer keys make signing and verifying slower, so weigh the trade-off.
What are SPKI and PKCS#8?
They are key encodings. This tool emits the public key as SPKI (PEM BEGIN PUBLIC KEY) and the private key as PKCS#8 (BEGIN PRIVATE KEY), the standard formats modern libraries use.
Can RSA encrypt large files directly?
No. RSA can encrypt only data smaller than the key size in one shot. In practice you RSA-encrypt a random AES key and use AES for the bulk data, known as hybrid encryption.
Can public and private keys swap roles?
Not freely. The public key encrypts and verifies; the private key decrypts and signs. The public key can be shared, while the private key must stay secret, since a leak destroys all security.
Is generating production keys in a browser safe?
crypto.subtle's randomness itself is reliable, but the browser may carry extension or script risks. Generate critical production keys on an isolated server; this tool suits development and testing better.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
Comments are stored locally in your browser. Configure Giscus for cloud-based comments.