RSA Key Pair Generator
Generate an RSA public/private key pair (2048/3072/4096-bit) locally with Web Crypto and export both as PEM. Nothing leaves your browser.
About the RSA Key Pair Generator
This RSA key pair generator creates a fresh public/private key pair in your browser using the Web Crypto API and exports both keys in standard PEM format. Choose a key size — 2048, 3072 or 4096 bits — and get a SPKI public key and a PKCS#8 private key ready to use.
RSA key pairs underpin SSL/TLS, SSH, JWT signing (RS256), code signing and encrypted messaging. Generating them locally with the browser's vetted cryptography means the private key is produced on your machine and never transmitted.
Because the keys are generated with crypto.subtle and never leave the page, this is a genuinely private way to make a key pair for testing and development. For production keys on shared machines, generating on a trusted, isolated system is still best practice.
How to Use the RSA Key Pair Generator
- 1Choose the key size (2048, 3072 or 4096 bits).
- 2Click Generate to create the key pair locally.
- 3Copy or download the PEM public and private keys.
- 4Keep the private key secret; share only the public key.
Frequently Asked Questions
What key size should I choose?
2048-bit RSA is the current baseline and fine for most uses; 3072-bit offers a stronger long-term margin; 4096-bit is the most conservative but slower to generate and use. For new systems, 2048 or 3072 is the usual choice — 4096 mainly where very long-lived keys are required.
In what format are the keys exported?
The public key is exported as SPKI PEM (-----BEGIN PUBLIC KEY-----) and the private key as PKCS#8 PEM (-----BEGIN PRIVATE KEY-----). These are the standard formats accepted by OpenSSL, most languages' crypto libraries and JWT tooling.
Is it safe to generate keys in the browser?
The keys are generated by the browser's Web Crypto API — the same vetted implementation used for TLS — and are never transmitted anywhere. For development and testing this is safe and convenient. For high-value production keys, many teams still prefer generating on a dedicated, offline system as an extra precaution.
What can I use the key pair for?
Signing and verifying JWTs (RS256), TLS and SSH testing, encrypting small pieces of data, code signing, and any workflow that needs an RSA key pair. Keep the private key secret and distribute only the public key to those who need to verify or encrypt to you.
Can I convert these keys to other formats?
Yes. Use the PEM to JWK Converter to get a JSON Web Key for OAuth/OIDC systems, or standard OpenSSL commands to convert between PEM, DER and PKCS#1. The exported PKCS#8 and SPKI PEM are the most broadly compatible starting points.