How to use the RSA Key Generator
- Choose RSA, ECDSA or Ed25519 and the key size or curve.
- Click Generate key pair.
- Copy or download the private key (PKCS#8) and the public key in PEM, OpenSSH or JWK format.
Which key type?
| Type | Sizes | Good for |
|---|---|---|
| RSA | 2048 (minimum today), 3072, 4096 | Maximum compatibility: TLS, JWT RS256, older systems |
| ECDSA | P-256, P-384, P-521 | Small, fast keys: JWT ES256, TLS, Apple and cloud APIs |
| Ed25519 | 256-bit (fixed) | SSH and modern signing; fast and hard to misuse |
A 256-bit EC key gives security comparable to a 3072-bit RSA key. NIST recommends RSA 2048 as the minimum until 2030 and 3072 beyond.
Output formats
- PKCS#8 PEM (
BEGIN PRIVATE KEY) — the standard private key format for OpenSSL, Node.js, Java, Go and the JWT encoder. - SPKI PEM (
BEGIN PUBLIC KEY) — the public key to share with whoever verifies your signatures. - OpenSSH (
ssh-rsa AAAA…) — forauthorized_keys. For SSH key pairs with an OpenSSH private key, use the SSH key generator. - JWK — JSON Web Key for JWKS endpoints in OAuth and OpenID Connect.
Is browser key generation secure?
Keys come from the Web Crypto API, which uses the operating system’s cryptographically secure random generator — the same source OpenSSL uses. The keys exist only in this page’s memory until you save them. For long-lived production keys, many teams still prefer generating them on the machine that will use them (openssl genpkey) or inside a hardware security module.
Convert with OpenSSL
# PKCS#8 → traditional RSA format
openssl pkey -in private.pem -traditional -out rsa.pem
# extract the public key
openssl pkey -in private.pem -pubout -out public.pemTools that pair well with the RSA Key Generator
- SSL Certificate Decoder — Paste a PEM certificate or a full chain to see who it was issued to, which domains it covers, when it expires and how it is signed — like openssl x509 -text, but readable.
- CSR Decoder — Verify a CSR before you submit it to a certificate authority: domain names, organisation details, key strength and requested extensions.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
Frequently asked questions
Are the keys sent to a server?
No. They are generated in your browser by the Web Crypto API and only exist on this page until you copy or download them.
Which RSA key size should I use?
2048 bits is the minimum accepted by browsers and certificate authorities; 3072 or 4096 give more margin at the cost of slower signing.
Why does 4096-bit RSA take longer?
Generating RSA keys requires finding large random primes, which takes longer as the size grows — a few seconds for 4096 bits is normal.
Can I add a passphrase?
Not here. Encrypt the downloaded key with
openssl pkcs8 -topk8 -in private.pem -out encrypted.pem, or use ssh-keygen -p for SSH keys.