RSA & ECDSA Keypair Generator
Generates an RSA (2048/3072/4096-bit) or ECDSA (P-256/P-384/P-521) key pair using the browser's native Web Crypto API — the same cryptographically secure random number generator your browser already uses for TLS. Exports as standard PEM (SPKI public key, PKCS8 private key), the same format OpenSSL itself produces, so the output drops directly into any tool or config expecting a PEM-encoded key. The private key is hidden behind a reveal toggle by default. Runs entirely client-side — nothing is uploaded, and nothing is saved once you leave the page.
About this tool
Generates an RSA or ECDSA key pair entirely in your browser, using the Web Crypto API's own key generation — the same cryptographically secure random number source your browser already relies on for TLS, not a JavaScript-implemented random number generator. RSA (2048, 3072, or 4096-bit) is the broadly compatible choice, used everywhere from RS256 JWTs to legacy systems; ECDSA (P-256, P-384, or P-521) produces much smaller keys at an equivalent security level and is the modern default for new systems that don't need RSA specifically. Both export as standard PEM — SPKI for the public key, PKCS8 for the private key — the same format OpenSSL itself produces, so the output drops directly into any tool or config that expects a PEM-encoded key. The private key is hidden behind a "Show private key" toggle by default, purely so it isn't visible on screen the moment you generate it.
What you can do
- RSA (2048/3072/4096-bit) and ECDSA (P-256/P-384/P-521) — generated with the browser's native Web Crypto API
- Standard PEM output (SPKI public key, PKCS8 private key) — the same format OpenSSL produces
- Copy or download each key as a .pem file
- Keys are generated locally and never transmitted — the private key exists only in your browser's memory
How to use
Step 1
Choose an algorithm
RSA for broad compatibility, or ECDSA for smaller, faster keys at an equivalent security level.
Step 2
Generate
Uses the browser's cryptographically secure random number generator — the same one behind TLS.
Step 3
Copy or download
The private key is hidden by default — reveal it only when you're ready to copy or save it.
Example
A generated public key looks like this:
public-key.pem
-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... -----END PUBLIC KEY-----
The private key uses the same PEM structure with a "PRIVATE KEY" label — standard PKCS8, readable by OpenSSL and virtually every crypto library.
How your data is handled
This tool is labeled 🟢 Runs in your browser: both keys are generated entirely locally using the Web Crypto API — nothing is uploaded, logged, or transmitted anywhere. That said, a key pair generated in a browser tab exists in that tab's memory and is gone once you close it (nothing is saved automatically) — copy or download the keys before navigating away. Because the private key never leaves your machine at any point, this is safe to use for keys you intend to actually use, not just for testing, but you're responsible for storing the downloaded private key securely afterward.
Frequently asked questions
Should I choose RSA or ECDSA?+
ECDSA produces much smaller keys and signatures at an equivalent security level and is the modern default for new systems. RSA remains the safer choice when you need compatibility with older systems or specific standards that require it (e.g. certain JWT libraries defaulting to RS256).
Is this safe to use for real keys, not just testing?+
Yes — key generation uses the Web Crypto API's cryptographically secure random number generator, the same one your browser uses for TLS, not a weaker JavaScript implementation. The private key never leaves your browser at any point.
Why is the private key hidden by default?+
Purely so it isn't sitting visible on screen (and in any screen-recording or shoulder-surfing scenario) immediately after generation. Click "Show private key" when you're ready to copy or download it.
What format are the keys in?+
Standard PEM: the public key is SPKI-encoded, the private key is PKCS8-encoded, both base64 wrapped at 64 characters per line with BEGIN/END markers — identical to what OpenSSL produces, so they work directly with OpenSSL, most language crypto libraries, and JWT signing libraries.
Does this store or remember my generated keys?+
No — nothing is saved. Once you navigate away from the page or close the tab, the keys are gone unless you copied or downloaded them first.