RSA Key Pair Generator

Generate RSA public/private key pairs (2048/4096-bit) using the Web Crypto API.

Web Crypto API — No Server

Keys are generated using crypto.subtle.generateKey() — your private key never leaves your browser. Download it immediately and clear the page when done.

Key size:

What are the advantages of making RSA asymmetric keys from the browser?

Protecting SSL streams, SSH keys or emails requires that your giant-sized public and private pair (2048/4096-bit) be generated in-situ for greater corporate confidentiality.

Web Crypto, the impenetrable new trench

The private key never even leaves your memory card for creation. All generated and assembled using approved cryptographic APIs that prevent external injection and cloning.

What this tool does

This page helps you generate RSA key pairs in the browser so local testing, integration checks and cryptography experiments are easier to run without relying on external tooling.

Generates RSA public and private key pairs at 2048 or 4096 bits using the browser's Web Crypto API.
Outputs keys in PEM format ready for use in JWT RS256 signing, TLS certificate workflows, SSH configurations and API authentication.
Provides a convenient local alternative to running OpenSSL commands for temporary or testing key material.

How to use it

1
Choose the key size: 2048 bits for most testing scenarios, 4096 bits when you need stronger key material.
2
Click Generate to create the key pair.
3
Copy the public key for use in your verification configuration, and the private key for signing.
4
Store key material securely and never commit private keys to version control or share them over insecure channels.

Example

A developer needs a key pair to test RS256 JWT signing locally before configuring the production identity provider with the real public key.

Key size: 2048-bit RSA

PEM-formatted public key and private key ready for local JWT RS256 testing.

Use cases

Creating temporary key pairs for local auth or encryption tests.
Generating sample public and private keys for integration work.
Testing signing or verification flows before moving to production secrets.

Common mistakes

Using browser-generated keys in production

Keys generated here are suitable for testing and development. Production key material should be generated and stored using a hardware security module or a managed secrets service.

Committing the private key to a repository

A private key in a repository is compromised the moment it is pushed. Store it in a secrets manager or local keystore only.

Choosing 1024-bit key size

1024-bit RSA keys are considered insecure by modern standards. Use at least 2048 bits for any practical purpose.

FAQ

Can I use these keys with JWT RS256 signing?

Yes. RSA 2048 or 4096 keys in PEM format are compatible with RS256, RS384 and RS512 JWT algorithms.

Is key generation secure in the browser?

The Web Crypto API uses the operating system's cryptographic entropy source. It is appropriate for testing and development workflows.

Does this tool send my keys anywhere?

No. Key generation and export happen locally in the browser.

What is the difference between 2048 and 4096-bit keys?

4096-bit keys provide more computational security margin but are slower to generate and use. 2048-bit is sufficient for most development and short-lived testing scenarios.

Can I use the public key to verify a JWT?

Yes. Share the public key with the JWT verification step and keep the private key only on the signing side.

Privacy and security

Key generation happens locally in the browser.
Private key material is not sent to an external service.
That is important when you are experimenting with sensitive crypto workflows.

Related tools

Related tools for the next step in the same workflow:

JWT Generator Password Entropy Analyzer Htpasswd Generator

Next step

Generate the key pair locally, then continue with nearby security tools if the auth or crypto workflow needs another step.