RSA Key Pair Generator
Generate an RSA key pair (2048, 3072 or 4096 bits) in your browser with Web Crypto. Download PEM keys in PKCS#8/SPKI or PKCS#1 format. Nothing is uploaded.
Keys are generated in your browser with the Web Crypto API (crypto.subtle.generateKey). The public key can be shared freely; it is used to encrypt or verify.
Related Tools
View AllWhat is RSA Key Generator?
Creates a new RSA public/private key pair in the browser using the Web Crypto API and shows both keys as PEM text you can copy or download. Choose 2048, 3072 or 4096 bits and either the modern PKCS#8 + SPKI format or the older PKCS#1 "RSA PRIVATE KEY" format.
How to use RSA Key Generator
- Choose the Key size (2048 bits is the common minimum, 3072 for long-term use).
- Choose the Key format: PKCS#8 + SPKI (recommended) or PKCS#1.
- Click Generate key pair and wait a moment (4096-bit keys take longer).
- Copy or Download
public.pemandprivate.pem, and store the private key securely.
Example
Key size 2048 bits, format PKCS#8 + SPKI
-----BEGIN PUBLIC KEY----- … (about 450 characters) and -----BEGIN PRIVATE KEY----- … (about 1700 characters)
Keys are random, so every run gives a different pair.
When to use RSA Key Generator
Use it for test and development keys, demos, JWT RS256 experiments or encrypting data with the RSA tools on this site. For production servers, certificates and SSH it is better to generate keys on the machine that will use them (openssl genpkey, ssh-keygen) so the private key never passes through a browser. The keys are not protected with a password.
How RSA Key Generator works
crypto.subtle.generateKey picks two random primes p and q of half the modulus size using the browser's cryptographically secure generator, sets n = p·q, the public exponent e = 65537 and the private exponent d = e⁻¹ mod λ(n). The keys are exported as DER (SPKI for the public key, PKCS#8 for the private key) and Base64-wrapped at 64 characters into PEM. For PKCS#1 the same key is re-encoded as RSAPublicKey / RSAPrivateKey. The keys work with OpenSSL, OpenSSH (after conversion), Java, .NET, Node.js and Web Crypto.
Common Use Cases
- Create a key pair for testing RSA-OAEP encryption and decryption
- Generate RS256 keys for local JWT signing experiments
- Produce PEM fixtures for unit tests
- Learn the difference between PKCS#8, SPKI and PKCS#1 PEM headers
Security Note
The private key is shown in plain text and is not password-protected. Save it in a secure place (password manager, encrypted disk) and never commit it to a repository.
FAQs
Which key size should I pick?
2048 bits is the minimum accepted today and is roughly equivalent to 112-bit security; 3072 bits (128-bit security) is recommended for keys used beyond 2030. 4096 bits is slower with little practical gain.
PKCS#8 or PKCS#1?
PKCS#8 (BEGIN PRIVATE KEY) and SPKI (BEGIN PUBLIC KEY) are the modern, algorithm-neutral formats used by Web Crypto, Java and OpenSSL 3. PKCS#1 (BEGIN RSA PRIVATE KEY) is the older RSA-only format that some legacy tools still expect.
Are the keys sent to a server?
No. Generation happens with the browser's Web Crypto API and the keys only exist on this page until you close it.
Can I use the key for SSH?
Convert the public key with ssh-keygen -i -m PKCS8 -f public.pem. For real SSH access it is safer to run ssh-keygen locally.