UsefulTab
RSA Key Generator
Generate an RSA key pair as PEM, locally.
Generate an RSA key pair
Choose a key size and algorithm, then click Generate. The public (SPKI) and private (PKCS#8) keys appear as PEM — copy or download each. Everything is created in your browser.
Runs entirely in your browserGenerate an RSA key pair locally
Pick a key size and algorithm and this tool generates a fresh RSA key pair entirely in your browser with the Web Crypto API. The public key is exported in SPKI format and the private key in PKCS#8, both as PEM — the familiar Base64 blocks wrapped at 64 columns between BEGIN/END headers. You can copy either key or download it as a .pem file. 2048-bit is the modern minimum and 4096-bit is stronger but slower; a 1024-bit option exists only for interoperating with legacy systems and is not secure for new use. The private key is generated on your device and never leaves it — nothing is uploaded — so treat the downloaded .pem as sensitive and store it safely.
Common questions
What formats are the keys exported in?
The public key is exported as SPKI (SubjectPublicKeyInfo) and the private key as PKCS#8, each encoded as PEM: Base64 of the DER bytes wrapped at 64 columns, framed by -----BEGIN PUBLIC KEY----- / -----BEGIN PRIVATE KEY----- headers. These are the standard forms OpenSSL and most libraries accept.
Which key size should I choose?
2048-bit is the current minimum for new RSA keys and is a good default. 4096-bit is stronger but noticeably slower to generate and use. 1024-bit is offered only for legacy interoperability and is considered insecure — do not use it for anything that needs real protection.
What is the difference between the two algorithms?
RSASSA-PKCS1-v1_5 produces a key pair intended for signing and verifying; RSA-OAEP produces one intended for encrypting and decrypting. The exported PEM public/private key structure is the same shape — pick the one that matches how you will use the key. Both use a 65537 public exponent.
Is my private key uploaded or stored anywhere?
No. The key pair is generated in your browser tab with the Web Crypto API and is never sent to a server. Downloading a .pem writes the file locally from data already in your browser. Keep the private key file safe — anyone who has it can act as you.
Can I use these keys with OpenSSL or SSH?
The PEM keys work directly with OpenSSL and libraries that read SPKI/PKCS#8 PEM. OpenSSH's authorized_keys format is different (ssh-rsa ...), so you would convert the public key with ssh-keygen -i -m PKCS8 if you need the SSH form.