RSA Key Pair Generator
Mint RSA-OAEP 2048/4096 key pairs with PEM export — in your browser
Key pairs in thirty seconds
Asymmetric crypto splits trust in two: a public key that encrypts and verifies, and a private key that decrypts and signs. Generating the pair used to mean installing OpenSSL and memorizing flags; the browser's WebCrypto engine does the same math with one click — and because generation happens locally, the private key is never transmitted at the moment of its birth, its most vulnerable second.
What this tool does
- 🗝️ Generates RSA-OAEP 2048 or 4096-bit pairs via WebCrypto
- 📄 Exports standard SPKI public and PKCS#8 private PEM
- 📋 Per-key copy buttons plus .pem file downloads
- 🔒 Keys are born and stay on your device
When to use it
- Minting a JWT signing key for a side project
- Creating test certificates and fixtures
- Learning what PEM blocks actually contain
Privacy: generation and export run entirely in your browser — private keys are never sent, stored or logged anywhere.
Last updated · 2026-09-01
How generation works
crypto.subtle.generateKey mints RSA-OAEP (public exponent 65537, SHA-256) with explicit exportable flags; exportKey serializes SPKI and PKCS#8 DER, wrapped to PEM with 64-character lines entirely client-side.
Why generate keys here?
Real WebCrypto keys
Keys come from the OS cryptographic source through the audited WebCrypto API — not Math.random, not a toy PRNG, the same quality OpenSSL would give you.
PEM you can actually use
Standard SPKI/PKCS#8 blocks with 64-column wrapping, plus one-click .pem downloads that drop straight into servers and CLIs.
Private means private
The private key is generated, displayed and downloaded without ever touching a network — check the network tab if you don't believe it.
Frequently asked questions
2048 or 4096 bits?⌄
2048 is the current standard and fast to generate; 4096 buys a larger safety margin at the cost of slower generation and bigger keys. For most uses (JWT signing keys, test certs) 2048 is right.
Are browser-generated keys safe?⌄
Yes — they come from your operating system's cryptographic random source via WebCrypto, the same source Node.js and OpenSSL draw from. The critical part is that private keys never leave your device, which this page guarantees by construction.
What formats are the downloads?⌄
Standard PEM: public key as SubjectPublicKeyInfo, private key as PKCS#8 — the formats OpenSSL, ssh-keygen converters and most libraries accept directly.
Frequently asked questions
2048 or 4096 bits?
2048 is the current standard and fast to generate; 4096 buys a larger safety margin at the cost of slower generation and bigger keys. For most uses (JWT signing keys, test certs) 2048 is right.
Are browser-generated keys safe?
Yes — they come from your operating system's cryptographic random source via WebCrypto, the same source Node.js and OpenSSL draw from. The critical part is that private keys never leave your device, which this page guarantees by construction.
What formats are the downloads?
Standard PEM: public key as SubjectPublicKeyInfo, private key as PKCS#8 — the formats OpenSSL, ssh-keygen converters and most libraries accept directly.