RSA Key Generator

How to use it

1. Choose a key size: 2048 bits is the common default, 4096 bits trades speed for a longer margin.
2. Click Generate — larger keys take a few seconds to compute.
3. The public key appears as SPKI PEM and the private key as PKCS#8 PEM, each in its own panel.
4. Use Copy or Download on both panels; the page does not keep the keys after you leave.
5. Store the private key in a secrets manager and publish only the public part.

Common use cases

• JWT RS256 signing — hand the PKCS#8 private key to your auth server and the SPKI public key to verifiers.
• Encrypted payloads — encrypt short secrets with the RSA-OAEP public key where a hybrid scheme needs one.
• Local tooling — produce a throwaway pair for tests instead of shelling out to OpenSSL.
• Configuration files — fill in PEM slots in servers and SDKs that expect standard SPKI and PKCS#8 armor.

Why it stays private

Key generation runs on the Web Crypto API inside your browser tab. The private key is never transmitted, logged or stored — once you navigate away it is gone, so download both parts before leaving.

FAQ

Q: Which formats are the PEM blocks in? A: The public key is SubjectPublicKeyInfo (SPKI, "BEGIN PUBLIC KEY") and the private key is PKCS#8 ("BEGIN PRIVATE KEY") — the two shapes OpenSSL and most libraries expect for RSA-OAEP and RS256.

Q: 2048 or 4096 bits? A: 2048 bits is the widely used baseline for RSA today and signs or verifies faster. 4096 bits adds margin at the cost of slower operations; pick it when your threat model justifies the overhead.

Q: Why can I not choose the hash or padding? A: The key pair itself is hash-neutral. The generator creates an RSA-OAEP-capable pair with SHA-256 as the algorithm parameter; the same key material works with RS256 and other schemes that consume standard RSA keys.