RSA Key Generator

Runs in browser Security

Generate RSA-PSS or RSASSA-PKCS1 key pairs with WebCrypto and export them as PEM (PKCS#8 private key, SPKI public key) for JWT RS256 signing, SSH-style testing or encryption experiments. Keys are generated locally and never uploaded.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use RSA Key Generator

  1. Choose the key size, algorithm and hash.
  2. Click Generate (4096-bit keys may take a few seconds).
  3. Download private.pem and public.pem or copy the JWK.
  4. Keep the private key secret; publish only the public key.

RSA Key Generator features

  • 2048, 3072 or 4096-bit keys generated with crypto.subtle.generateKey
  • RSASSA-PKCS1-v1_5 (RS256/384/512), RSA-PSS (PS256/384/512) or RSA-OAEP
  • PEM export: PKCS#8 private key and SPKI public key
  • Optional JWK export with alg and use set
  • Suggested JWT algorithm and kid; conversion hints for OpenSSL and SSH
  • Everything happens locally — private keys are never uploaded

RSA Key Generator example

RS256 key pair

Input:

Key size: 2048 · Algorithm: RSASSA-PKCS1-v1_5 · Hash: SHA-256

Output:

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC…
-----END PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA…
-----END PUBLIC KEY-----

Frequently asked questions about RSA Key Generator

Which key size should I pick?

2048 bits is the common minimum and generates quickly. 3072 bits reaches the 128-bit security level recommended for keys used beyond 2030. 4096 bits is the most conservative but noticeably slower to generate and to use.

What is the difference between PKCS#8 and PKCS#1 PEM?

PKCS#8 ("BEGIN PRIVATE KEY") is the modern, algorithm-agnostic container exported by WebCrypto. Older tools expect PKCS#1 ("BEGIN RSA PRIVATE KEY"); convert with: openssl rsa -in private.pem -traditional -out private-pkcs1.pem.

Can I use these keys for JWT RS256?

Yes. Choose RSASSA-PKCS1-v1_5 with SHA-256, sign with the private key on your server and publish the public key (or its JWK) for verification. Choose RSA-PSS for PS256.

Can I use them for SSH?

Not directly: SSH uses its own public-key format. Convert the PEM with "ssh-keygen -i -m PKCS8 -f public.pem" or generate SSH keys with ssh-keygen.

Are the keys really generated locally?

Yes — crypto.subtle.generateKey runs inside your browser. Nothing is sent anywhere, and the page keeps no copy once you leave it.

Technical notes

WebCrypto generates the key pair with public exponent 65537 and exports DER structures (PKCS#8 for the private key, SubjectPublicKeyInfo for the public key). The tool Base64-encodes the DER with 64-character lines and adds the PEM armour, producing files that OpenSSL, Node.js, Java and every JOSE library accept.