⌘ K
rsa · 2048/3072/4096 · pem · local

Generate RSA key pairs in PEM

Mint 2048-, 3072-, or 4096-bit RSA-OAEP key pairs. Exports SPKI public key and PKCS#8 private key as PEM. Runs entirely in your browser.

RSA Key Pair Generator
Bits
2048
default
Hash
SHA-256
OAEP
Exponent
65537
0x10001
Status
idle
web crypto
Bits:
input · controls
Modulus size

2048-bit ≈ 112-bit security · 3072-bit ≈ 128-bit · 4096-bit ≈ 152-bit. 4096-bit generation can take several seconds.

For new systems, prefer Ed25519 — smaller, faster, and as secure as 3072-bit RSA.

output · pem key pair

Click Generate to mint a key pair

Quick Start

How to generate an RSA key pair

Pick a modulus size, click Generate, and copy the PEM-encoded SPKI (public) and PKCS#8 (private) keys. The browser uses Web Crypto — keys never leave your machine.

  1. 01

    Choose modulus size

    2048-bit is the most common. 3072+ for new long-lived systems.

    Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.

    sizeUTF-8TextEncoderlosslesslive
    bits · raw bytes2048 · UTF-8
    2048 · 3072 · 4096
    loaded · UTF-8MIME · ready
  2. 02

    Generate

    2048 is sub-second. 4096 may take a few seconds.

    Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.

    generateWeb Cryptosubtledeterministiclive
    alg · optionsRSA-OAEP · live
    SHA-256, e=65537
    options applied · livelive
  3. 03

    Export PEM

    SPKI for public, PKCS#8 for private — the OpenSSL defaults.

    Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.

    pemmemoisedoptionsinstantreactive
    out · encodedPEM · ready
    -----BEGIN PUBLIC KEY-----
    encoded · livelossless
  4. 04

    Save and use

    Private goes in your vault. Public can be widely shared.

    Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.

    exportclipboardblobMIME-correctclient-side
    ok · copiedready · done
    Copied
    shipped · ready to shipsuccess
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsRSA Encrypt/DecryptEd25519 KeysAES EncryptJWT EncoderSHA-256HMAC
Use Cases

When to use RSA

Long-lived public keys, legacy compatibility, JWS RS256.

JWT RS256 signing

Asymmetric JWTs verified by any party with the public key. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

TLS / X.509 certificates

RSA still ubiquitous in PKI and CA chains. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

S/MIME, PGP fallback

Email signing & encryption where RSA is the default. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

License keys

Sign offline-validatable license payloads. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Hybrid encryption

Wrap an AES session key with RSA-OAEP. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Backwards compat

When clients can't handle EdDSA/ECDSA yet. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

2048 is fine for short-lived keys. Use 3072+ for keys that will be in use for 5+ years.
Finding two safe primes large enough takes work. Generation is O(b³) in the modulus size.
These are generated with RSA-OAEP usage. For signing (RSA-PSS, RSASSA-PKCS1-v1_5) export the key and re-import with the right usage.
0x10001 — the standard public exponent. Small enough to be fast, large enough to avoid attacks against tiny exponents.
No. Keys are generated locally via Web Crypto — they never leave your browser, all runs locally.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!