Cómo usar: RSA Key Generator
- Choose RSA, ECDSA or Ed25519 and the key size or curve.
- Click Generate key pair.
- Copy or download the private key (PKCS#8) and the public key in PEM, OpenSSH or JWK format.
Which key type?
| Type | Sizes | Good for |
|---|---|---|
| RSA | 2048 (minimum today), 3072, 4096 | Maximum compatibility: TLS, JWT RS256, older systems |
| ECDSA | P-256, P-384, P-521 | Small, fast keys: JWT ES256, TLS, Apple and cloud APIs |
| Ed25519 | 256-bit (fixed) | SSH and modern signing; fast and hard to misuse |
A 256-bit EC key gives security comparable to a 3072-bit RSA key. NIST recommends RSA 2048 as the minimum until 2030 and 3072 beyond.
Output formats
- PKCS#8 PEM (
BEGIN PRIVATE KEY) — the standard private key format for OpenSSL, Node.js, Java, Go and the JWT encoder. - SPKI PEM (
BEGIN PUBLIC KEY) — the public key to share with whoever verifies your signatures. - OpenSSH (
ssh-rsa AAAA…) — forauthorized_keys. For SSH key pairs with an OpenSSH private key, use the SSH key generator. - JWK — JSON Web Key for JWKS endpoints in OAuth and OpenID Connect.
Is browser key generation secure?
Keys come from the Web Crypto API, which uses the operating system’s cryptographically secure random generator — the same source OpenSSL uses. The keys exist only in this page’s memory until you save them. For long-lived production keys, many teams still prefer generating them on the machine that will use them (openssl genpkey) or inside a hardware security module.
Convert with OpenSSL
# PKCS#8 → traditional RSA format
openssl pkey -in private.pem -traditional -out rsa.pem
# extract the public key
openssl pkey -in private.pem -pubout -out public.pemTambién se busca como: generate rsa key, rsa key pair, public private key generator, rsa 2048, pem key generator, ecdsa key generator, jwk generator.
Herramientas que combinan con: RSA Key Generator
- SSL Certificate Decoder — Paste a PEM certificate or a full chain to see who it was issued to, which domains it covers, when it expires and how it is signed — like openssl x509 -text, but readable.
- CSR Decoder — Verify a CSR before you submit it to a certificate authority: domain names, organization details, key strength and requested extensions.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- Decodificador JWT — Pega un token web JSON para examinar su encabezado y su carga útil, comprobar cuándo caduca y verificar su firma.
Preguntas frecuentes
Are the keys sent to a server?
No. They are generated in your browser by the Web Crypto API and only exist on this page until you copy or download them.
Which RSA key size should I use?
2048 bits is the minimum accepted by browsers and certificate authorities; 3072 or 4096 give more margin at the cost of slower signing.
Why does 4096-bit RSA take longer?
Generating RSA keys requires finding large random primes, which takes longer as the size grows — a few seconds for 4096 bits is normal.
Can I add a passphrase?
Not here. Encrypt the downloaded key with
openssl pkcs8 -topk8 -in private.pem -out encrypted.pem, or use ssh-keygen -p for SSH keys.¿Puedo instalar RSA Key Generator como aplicación web y utilizarla sin conexión?
Sí. RSA Key Generator es una aplicación web instalable (PWA): se instala desde el navegador, no se descarga desde una tienda de aplicaciones. Haz clic en «Instalar aplicación» en la parte superior de esta página en Chrome o Edge (Windows, macOS, Linux, ChromeOS) o, en Android, utiliza «Compartir» → «Añadir a la pantalla de inicio» en iPhone y iPad, o «Archivo» → «Añadir al Dock» en Safari 17+ en un Mac. A continuación, se abrirá en su propia ventana con su propio icono y, como se ejecuta íntegramente en tu navegador, seguirá funcionando sin conexión. Firefox en el ordenador de sobremesa no permite instalar aplicaciones web. Cómo funciona la instalación.