RSA Key Pair Generator

This generator creates a matching RSA public and private key in your browser and gives you both as PEM text. Choose 2048-bit for most uses today, or 4096-bit for a larger safety margin. The private key is never sent anywhere.

RSA is a form of public-key cryptography. You share the public key freely, and anyone can use it to encrypt data for you or to check your signatures. Only the private key can decrypt that data or create those signatures. NIST rates a 2048-bit key at about 112 bits of security, which it accepts through 2030, and advises 3072 bits or more after that. A 4096-bit key is slower to create and to use, and it can take a few seconds to generate.

The public key comes out in SPKI format (BEGIN PUBLIC KEY) and the private key in PKCS#8 format (BEGIN PRIVATE KEY), with the usual public exponent of 65537. OpenSSL, Node.js, Python and most JWT libraries read these directly. The browser creates the key for RSA-OAEP encryption, but the exported key is standard RSA, so libraries can also use it to sign, for example RS256 tokens.

Two cautions. First, the private key has no passphrase. Save it with strict file permissions, or encrypt it with a command such as openssl pkcs8 -topk8 -v2 aes-256-cbc. Second, SSH needs a different format. Convert the public key with ssh-keygen -i -m PKCS8 -f public.pem, or create SSH keys with ssh-keygen itself. To protect a message with a shared password instead of keys, use Text Encryption and Decryption, and to inspect tokens you sign, try the JWT Decoder.