RSA Key Pair Generator
Generate an RSA public/private key pair in your browser — PEM or JWK, 2048 to 4096-bit.
Share this freely — it only verifies signatures or encrypts to you.
Keep this secret — anyone holding it can sign as you or decrypt your messages.
- Modulus size
- —
- Public exponent
- —
- Algorithm
- —
- SHA-256 fingerprint
- —
Everything runs locally. The key pair is produced by your browser's
Web Crypto API (crypto.subtle.generateKey) using the operating system's
secure random source. Nothing is uploaded, logged or stored — reload the page and the
key is gone for good.
How it works
This generator calls crypto.subtle.generateKey() with a public exponent of
65537 (0x010001), the value every mainstream RSA implementation uses, and
then exports the pair with crypto.subtle.exportKey(). The public key comes
out as SubjectPublicKeyInfo (SPKI) and the private key as PKCS#8, which are the
-----BEGIN PUBLIC KEY----- and -----BEGIN PRIVATE KEY----- PEM
blocks that OpenSSH, OpenSSL 3, Java, Go and Node all read. Choosing PKCS#1 unwraps the
DER by hand — dropping the SPKI algorithm header and unwrapping the PKCS#8 octet string —
to give you the older OpenSSL -----BEGIN RSA PRIVATE KEY----- form. PEM is
just that DER blob in base64, wrapped at 64 characters between the header lines.
2048 bits is the current minimum for new keys (NIST puts it at roughly 112-bit security); 3072 bits reaches about 128-bit security and 4096 bits buys margin at the cost of slower generation and signing. The hash you pick is recorded on the WebCrypto key object and matters for RSA-PSS and OAEP padding, not for the RSA maths itself, so a PEM exported here works with any hash your library later chooses. The fingerprint shown is a SHA-256 digest of the DER public key — the same bytes anyone else can compute from your public key to confirm they have the right one.
No key ever leaves this tab: there is no request to any server, no account, and no analytics on the key material. That said, treat a browser-generated key like any other key on a shared machine — for a long-lived production or CA key, generating on a hardened host (or in an HSM) is still the safer habit.
Frequently asked questions
Is it safe to generate an RSA private key in a browser?
The key is created by your browser's Web Crypto API (crypto.subtle.generateKey), which draws from the operating system's secure random source — the same CSPRNG OpenSSL uses. Nothing is sent anywhere: there is no server call, no logging and no storage, and the key disappears when you reload the page. For a long-lived production or certificate-authority key you should still generate on a hardened machine or in an HSM, simply because a shared browser profile is a bigger attack surface than a locked-down host.
What is the difference between PKCS#8, SPKI and PKCS#1?
PKCS#8 (-----BEGIN PRIVATE KEY-----) and SPKI (-----BEGIN PUBLIC KEY-----) wrap the key in a small DER header that names the algorithm, so one parser can read RSA, EC and Ed25519 keys alike; that is what OpenSSL 3, Java, Go and Node expect. PKCS#1 (-----BEGIN RSA PRIVATE KEY-----) is the older RSA-only form some tools and Apache configs still want. This page shows both from the same key — switching format never regenerates it.
Which key size should I choose: 2048, 3072 or 4096 bits?
2048 bits is the accepted minimum for new keys today, giving roughly 112-bit security. 3072 bits reaches about 128-bit security and is the sensible default for anything meant to stay valid past 2030. 4096 bits adds margin but makes generation and every signature noticeably slower, and it buys less than moving to an elliptic-curve key would. The public exponent is always 65537 (0x010001), the value every mainstream RSA implementation uses.