{}

RSA Key Pair Generator

Browser-local 2048/4096-bit RSA key pairs as standard PEM, downloadable.

A third-party callback needs an RSA public key, Git/SSH wants a fresh pair, moving JWT to RS256 requires test keys — the orthodox route is the command line (openssl genrsa), but the flag soup is a barrier if you do not do it often. This tool generates the pair with the browser's native WebCrypto: 2048 or 4096 bits, encryption (RSA-OAEP) or signing (RSA-PSS) usage.

Output is two standard PEMs: the public key in SPKI form (-----BEGIN PUBLIC KEY-----) and the private key in PKCS#8 form (-----BEGIN PRIVATE KEY-----) — directly compatible with openssl, JWT libraries and SSH tooling, downloadable as .pem files. Generation happens entirely in browser memory with zero uploads.

Choosing the key size

2048 bits is today's industry floor (NIST guidance through 2030) and takes about a second; 4096 buys a longer security margin at the cost of a 10-second-plus generation and slower verification. Internal testing is fine at 2048; long-lived public services should consider 4096 — or a modern curve like Ed25519.

OAEP vs PSS: same math, different jobs

Raw RSA only computes modular exponentiation; real use requires a padding scheme: OAEP (Optimal Asymmetric Encryption Padding) for encryption, PSS (Probabilistic Signature Scheme) for signatures. One pair could technically do both, but best practice is one pair per job — which is why the tool asks you to declare the usage up front.

Frequently asked questions

Are generated keys safe? Can the site see them?
The keys come from WebCrypto inside the browser — the page cannot influence or read the randomness, and nothing is uploaded. Security is equivalent to running openssl locally.
Can I use this key for SSH?
The PKCS#8 private key converts via ssh-keygen (ssh-keygen -i -f private.pem -m PKCS8), but SSH convention is OpenSSH format with comments — for SSH, ssh-keygen remains the better generator.
I lost the private key — can you recover it?
Refresh and it is gone; generate a new pair. The page keeps no copy — which also means: download the private key before leaving the page.

Related tools