RSA Key Generator

Step-by-step guide

1. 1
   Choose a key size
   Select 2048, 3072, or 4096 bits. 2048-bit is standard for most uses; 4096-bit provides extra security at the cost of slower generation.
2. 2
   Select an algorithm
   Choose RSA-OAEP for encryption/decryption use cases, or RSASSA-PKCS1-v1_5 for signing and verification.
3. 3
   Click Generate Key Pair
   The browser's Web Crypto API generates the key pair entirely on your device. No data is sent to any server.
4. 4
   Copy or download the public key
   Use the Copy button or download a .pem file. The public key can be shared freely with anyone who needs to encrypt data to you.
5. 5
   Secure the private key
   Download the private key and store it securely. Never share it. It is required to decrypt data encrypted with your public key, or to sign messages.

Frequently Asked Questions

Are the generated keys cryptographically secure?

Yes. Keys are generated using the browser's built-in Web Crypto API (SubtleCrypto), which uses the operating system's CSPRNG and is considered cryptographically secure for production use.

Does any key data leave my device?

No. Key generation and export happen entirely in-browser. No network requests are made. The keys are never transmitted to any server.

What is the difference between RSA-OAEP and RSASSA-PKCS1-v1_5?

RSA-OAEP (Optimal Asymmetric Encryption Padding) is used for encrypting data with a public key and decrypting with the private key. RSASSA-PKCS1-v1_5 is used for creating digital signatures with the private key and verifying them with the public key.

Which key size should I choose?

2048-bit RSA is currently the minimum recommended by NIST for most applications and is widely supported. 3072-bit offers a security margin through 2030+. 4096-bit provides the highest security but is slower to generate and use.

What PEM format is used?

Public keys are exported as SPKI (SubjectPublicKeyInfo) and private keys as PKCS#8, both base64-encoded with standard PEM headers. These formats are compatible with OpenSSL, Node.js, Java, and most cryptographic libraries.

Can I use these keys with OpenSSL?

Yes. The generated PEM files are in standard formats that OpenSSL can read. For example: openssl rsa -in key.private.pem -check to verify the private key.

Why might 4096-bit generation be slow?

Generating a 4096-bit RSA key requires finding large prime numbers, which is computationally intensive. Browsers may take several seconds. 2048-bit generation is nearly instant.

How do I use the key pair for SSH?

The PKCS#8/SPKI format from this tool is not directly usable for SSH, which requires OpenSSH format. You can convert using: ssh-keygen -p -m PEM -f key.private.pem: or use a dedicated SSH key generator.

What should I do with the private key?

Store the private key in a secure location such as a password manager, hardware security module, or encrypted filesystem. Never commit it to version control or share it publicly.

Can I regenerate a key pair to get a new one?

Yes. Click Generate Key Pair again to create a fresh key pair. Each generation produces a unique, unrelated key pair.