RSA Key Pair Generator

What this tool does

RSA Key Pair Generator creates an RSA key pair entirely in your browser using the Web Crypto API, for RSASSA-PKCS1-v1_5 or RSA-PSS signatures or RSA-OAEP encryption at 2048, 3072 or 4096 bits. It exports the pair as PKCS#8 and SPKI PEM, JWK and an OpenSSH public key with a SHA-256 fingerprint, and runs a self-test that signs or encrypts a message and checks the other half of the pair can verify or decrypt it.

RSA key pairs still underpin a large share of practical cryptography: SSH access to servers, JWT tokens signed with RS256 or PS256, S/MIME email signatures and many certificate authorities all rely on a public key that anyone can use to verify or encrypt, paired with a private key that must never leave its owner. Generating a pair usually means reaching for OpenSSH or OpenSSL on the command line, which is awkward when you just need a quick test key or want to see the different export formats side by side.

This generator calls crypto.subtle.generateKey directly in the browser, so the private key material is created locally and is discarded the moment you close or reload the tab rather than being sent anywhere. Choose a modulus size, an algorithm (signing with PKCS#1 v1.5 or PSS padding, or encryption with OAEP) and a hash function, then generate a pair exported five ways: a PKCS#8 private key PEM, an SPKI public key PEM, private and public JWK, and an OpenSSH-format public key with its SHA-256 fingerprint. A built-in self-test immediately signs or encrypts a short message with one half of the pair and confirms the other half can verify or decrypt it.

How to use RSA Key Pair Generator

1. Choose a key size: 2048 bits for general use, 3072 for roughly 128-bit security, or 4096 if your policy requires the extra margin.
2. Pick the algorithm: RSASSA-PKCS1-v1_5 or RSA-PSS for signing and verifying, or RSA-OAEP for encrypting and decrypting.
3. Select the hash function used inside the signature or padding scheme, typically SHA-256.
4. Optionally set an SSH key comment, which is appended to the exported OpenSSH public key line.
5. Click Generate key pair and wait a few seconds; larger keys take noticeably longer to generate.
6. Check the self-test result, then copy or download whichever export format your target system expects: PEM, JWK or the OpenSSH public key.

Tips for better results

• The private key PEM from this tool loads directly into OpenSSH with chmod 600 and the -i flag, or can be converted to the traditional “BEGIN RSA PRIVATE KEY” format with openssl pkey -traditional.
• RSASSA-PKCS1-v1_5 is the algorithm behind the RS256 JWT header, and RSA-PSS behind PS256; pick the one your library or API documentation names explicitly.
• A 2048-bit key is still considered acceptable for most purposes today, but many compliance frameworks now require 3072 bits or more for long-lived keys.
• The SHA-256 fingerprint shown next to the OpenSSH key matches the format ssh-keygen -lf prints, so you can cross-check a key was transferred correctly.

Common use cases

• Creating a disposable RSA key pair to test an SSH connection, a JWT RS256 integration or an S/MIME setup without installing command-line tools.
• Producing a JWK pair for a service that expects JSON Web Key format rather than PEM.
• Comparing PEM, JWK and OpenSSH representations of the same key while learning how each format encodes the same mathematical key.
• Generating keys for coursework or documentation examples where the key itself does not need to persist beyond the browser tab.

Common mistakes to avoid

• Reusing a key generated here for a long-lived production secret after closing the tab; treat browser-generated keys as disposable unless you deliberately save and protect the private key file yourself.
• Picking RSA-OAEP when a login or signing flow actually needs RSASSA-PKCS1-v1_5 or RSA-PSS; encryption and signing keys are not interchangeable even though both are “RSA”.
• Sharing the PKCS#8 private key PEM by mistake instead of the SPKI public key PEM; only the file explicitly labelled public is safe to hand out.