🔑 RSA Key Generator
Generate RSA public/private key pairs in PEM and JWK format for JWT signing, SSH, and TLS
⚠️ This private key never leaves your browser. Treat it like a password — anyone with this key can impersonate the corresponding public key.
JWK (JSON Web Key)
—
—
—
—
All key generation happens in your browser — no data is ever sent anywhere.
About this tool
RSA Key Generator creates a public/private RSA key pair using your browser's Web Crypto engine. The keys are output in PEM format (ready for servers and config files) and JWK format (ready for JWT libraries and web apps).
Example: select 2048-bit with SHA-256 and click Generate. You'll get a -----BEGIN PUBLIC KEY----- block to share openly, and a -----BEGIN PRIVATE KEY----- block to store securely. The JWK section gives you the same keys in the JSON format used by Auth0, jose, and OpenID Connect libraries.
Common uses: creating keys for JWT RS256 signing, generating an SSH key pair for cloud instances, bootstrapping TLS certificates, or setting up a development OAuth server.
FAQ
Where are the keys generated — on a server? ›
No. Keys are generated entirely in your browser using the Web Crypto API (crypto.subtle). The private key never leaves your machine.
Why PKCS#8 format for the private key? ›
PKCS#8 is the modern standard and works with OpenSSL, Node.js, and most libraries. If you need PKCS#1, you can convert it with <code>openssl pkcs8 -in private.pem -out private-pkcs1.pem -traditional</code>.
What key sizes are reasonable? ›
2048-bit is fast and sufficient for most applications. 3072-bit adds safety margin. 4096-bit is for very long-term secrets — generation is noticeably slower and the keys are larger.
Can I use these keys for SSH? ›
No. SSH uses a different key format (OpenSSH). These RSA keys use PKCS#8/SPKI which are standard for TLS, JWT, and general-purpose asymmetric crypto but not directly usable by ssh.