RSA Key Generator

Runs in browser Security

Generate RSA-PSS or RSASSA-PKCS1 key pairs with WebCrypto and export them as PEM (PKCS#8 private key, SPKI public key) for JWT RS256 signing, SSH-style testing or encryption experiments. Keys are generated locally and never uploaded.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How should API keys and secrets be generated and handled?

A secret is only as strong as its randomness: keys and tokens should come from a cryptographically secure generator with at least 128 bits of entropy (256 for HMAC keys), never from a password or a timestamp. RSA keys should be 2048 bits or more, kept in PEM files with restricted permissions. Secrets belong in a vault or environment configuration, rotated on a schedule, and never in source code, logs or URLs.

Security note: Anything generated here is only as private as where you paste it next. Generate keys locally, store them in a secrets manager, and rotate any key that was ever committed to a repository or shared in chat.

How to use RSA Key Generator

  1. Choose the key size, algorithm and hash.
  2. Click Generate (4096-bit keys may take a few seconds).
  3. Download private.pem and public.pem or copy the JWK.
  4. Keep the private key secret; publish only the public key.

RSA Key Generator features

  • 2048, 3072 or 4096-bit keys generated with crypto.subtle.generateKey
  • RSASSA-PKCS1-v1_5 (RS256/384/512), RSA-PSS (PS256/384/512) or RSA-OAEP
  • PEM export: PKCS#8 private key and SPKI public key
  • Optional JWK export with alg and use set
  • Suggested JWT algorithm and kid; conversion hints for OpenSSL and SSH
  • Everything happens locally — private keys are never uploaded

RSA Key Generator example

RS256 key pair

Input:

Key size: 2048 · Algorithm: RSASSA-PKCS1-v1_5 · Hash: SHA-256

Output:

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC…
-----END PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…
-----END PUBLIC KEY-----

Frequently asked questions about RSA Key Generator

Which key size should I pick?

2048 bits is the common minimum and generates quickly. 3072 bits reaches the 128-bit security level recommended for keys used beyond 2030. 4096 bits is the most conservative but noticeably slower to generate and to use.

What is the difference between PKCS#8 and PKCS#1 PEM?

PKCS#8 ("BEGIN PRIVATE KEY") is the modern, algorithm-agnostic container exported by WebCrypto. Older tools expect PKCS#1 ("BEGIN RSA PRIVATE KEY"); convert with: openssl rsa -in private.pem -traditional -out private-pkcs1.pem.

Can I use these keys for JWT RS256?

Yes. Choose RSASSA-PKCS1-v1_5 with SHA-256, sign with the private key on your server and publish the public key (or its JWK) for verification. Choose RSA-PSS for PS256.

Can I use them for SSH?

Not directly: SSH uses its own public-key format. Convert the PEM with "ssh-keygen -i -m PKCS8 -f public.pem" or generate SSH keys with ssh-keygen.

Are the keys really generated locally?

Yes — crypto.subtle.generateKey runs inside your browser. Nothing is sent anywhere, and the page keeps no copy once you leave it.

Technical notes

WebCrypto generates the key pair with public exponent 65537 and exports DER structures (PKCS#8 for the private key, SubjectPublicKeyInfo for the public key). The tool Base64-encodes the DER with 64-character lines and adds the PEM armour, producing files that OpenSSL, Node.js, Java and every JOSE library accept.

References