DeveloperKit

RSA Key Pair Generator

Generate RSA public and private keys as PEM, JWK, or OpenSSH. Free, private, and 100% in your browser.

Click Generate Key Pair.

Generated on your device. The private key is never sent anywhere.

Private KeyKeep secret

Click Generate Key Pair.

Public KeySafe to share

Click Generate Key Pair.

What Is an RSA Key Pair?

RSA is a public-key algorithm: a key pair consists of a private key that you keep secret and a public key that you can share. Data signed with the private key can be verified with the public key, and data encrypted with the public key can only be decrypted with the private key. RSA keys are used for JWT signing (RS256), TLS certificates, SSH logins, and code signing.

Common file formats
-----BEGIN PRIVATE KEY-----       PKCS#8 private key
-----BEGIN RSA PRIVATE KEY-----   PKCS#1 private key
-----BEGIN PUBLIC KEY-----        SPKI public key
ssh-rsa AAAAB3NzaC1yc2E… user@host  OpenSSH public key

Features

  • 2048, 3072, or 4096 bits

    Keys use the standard public exponent 65537 and are generated by your browser's native Web Crypto API.

  • Every common format

    Private keys as PKCS#8 or PKCS#1 PEM and JWK; public keys as SPKI or PKCS#1 PEM, JWK, and OpenSSH.

  • Ready for JWT

    Add kid and alg (RS256, PS256, RSA-OAEP-256…) to the JWKs and paste them straight into a JWKS endpoint or the JWT tools.

  • SSH public keys

    Get an ssh-rsa line for authorized_keys and the same SHA256 fingerprint ssh-keygen shows.

  • Copy or download

    Copy each key or download it with a conventional file name such as private_key.pem or id_rsa.pub.

  • Private by design

    Keys are created on your device and exist only in this page's memory. Nothing is uploaded.

How to Generate an RSA Key Pair

  1. Choose the key size. 3072 bits is a good default.
  2. Click Generate Key Pair. A new pair is created in your browser.
  3. Pick the formats you need for the private and public key.
  4. Copy or download both keys and store the private key securely.

Frequently Asked Questions

Is it safe to generate RSA keys in the browser?

The keys are created by your browser's built-in Web Crypto implementation, which uses the operating system's secure random generator, and they never leave the page. For production servers and long-lived keys, the best practice is still to generate keys on the machine that will use them, for example with openssl or ssh-keygen.

Which key size should I choose?

2048-bit RSA is the minimum accepted today and is considered secure until about 2030. 3072-bit keys provide security comparable to 128-bit symmetric encryption and are recommended for keys that must last longer. 4096-bit keys are slower and mainly used for long-lived root or SSH keys.

What is the difference between PKCS#8 and PKCS#1?

Both contain the same RSA key. PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) is RSA-specific; PKCS#8 (-----BEGIN PRIVATE KEY-----) is a generic container that also records the algorithm. Most modern libraries, including Node.js, Java, and Go, prefer PKCS#8.

Can I use the key for SSH?

Yes. Download the PKCS#1 or PKCS#8 private key as ~/.ssh/id_rsa (with chmod 600) and add the OpenSSH public key line to the server's ~/.ssh/authorized_keys. OpenSSH reads PEM private keys directly. Many teams now prefer Ed25519 keys for SSH.

Can I use these keys to sign JWTs?

Yes. Use the private key with RS256 or PS256 to sign tokens and publish the public JWK in your JWKS. You can test the pair right away in our JWT Encoder and JWT Decoder.

Related Tools

  • JWT Decoder

    Decode and debug JSON Web Tokens, see when they expire, and verify HS, RS, PS, ES, and EdDSA signatures.

  • JWT Encoder

    Create and sign JSON Web Tokens with HS256, RS256, ES256, PS256, or EdDSA, and generate test key pairs.

  • Hash Generator

    Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes and HMACs of text or files, live as you type.

  • Bcrypt Generator

    Hash passwords with bcrypt at any cost factor and verify a password against an existing bcrypt hash.