RSA Key Generator Online, PEM Key Pairs
Generate a 2048, 3072 or 4096-bit RSA key pair in your browser and copy or download the private and public keys as PEM. Keys are made locally and never leave your device.
About the RSA key generator
This page generates an RSA key pair in your browser and gives you both halves as PEM files ready for OpenSSL, JSON Web Token libraries and most programming languages. Choose 2048, 3072 or 4096 bits, press Generate key pair, and copy or download the private key and the public key. The keys are generated locally with your browser's cryptographically secure random number generator and never leave your device. Nothing is uploaded and nothing is stored after you close the tab.
How to generate a key pair
Steps
- Choose the key size. 2048 bits is selected by default.
- Press Generate key pair. Larger keys take longer: 4096 bits can take several seconds while the browser searches for two large primes.
- Press Download private-key.pem and Download public-key.pem, or copy each key with its Copy button.
- Keep the private key secret. Share only the public key.
What you get
Private key
The private key is written as PKCS#8 PEM, beginning -----BEGIN PRIVATE KEY-----. It holds the modulus, the public exponent 65537, the private exponent and the two primes with their precomputed values. It is not protected by a passphrase; if you store it on disk, add one with openssl pkey -in private-key.pem -aes256 -out protected.pem.
Public key
The public key is written as SubjectPublicKeyInfo (SPKI) PEM, beginning -----BEGIN PUBLIC KEY-----, the format OpenSSL, Java, .NET, Node.js and Go read by default. If a system wants the older PKCS#1 form (BEGIN RSA PUBLIC KEY), convert it with openssl rsa -pubin -in public-key.pem -RSAPublicKey_out.
Which key size to choose
- 2048 bits is the accepted minimum and what most certificate authorities and services expect.
- 3072 bits is what NIST recommends for protection beyond 2030, at about the strength of a 128-bit symmetric key.
- 4096 bits gives extra margin for long-lived keys, at the cost of slower signing and decryption.
- 1024 bits is offered only for tests and legacy systems. It is not secure, and the page warns you when you pick it.
Privacy
Generation runs entirely in your browser through the Web Cryptography API. The private key is never sent to our servers and is not kept once you close or reload the tab. For keys that guard production systems, generating them on the machine that will use them is still the safest habit, and the equivalent OpenSSL command is openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key.pem.
Using the keys
Once you have a pair, switch to the Encrypt, Decrypt, Sign or Verify mode of the RSA Tool; the keys you generated are filled in for you. Signed tokens made with these keys can be inspected with the JWT Decoder. To create a strong passphrase for the private key, use the Password Generator.
Open-source credits
- Key generation uses the browser's built-in Web Cryptography API (W3C Recommendation); no third-party library is loaded.
- RSA key generation and the key formats follow RFC 8017 (PKCS #1 v2.2), RFC 5208 (PKCS#8) and RFC 5280 (SubjectPublicKeyInfo), and PEM follows RFC 7468.