RSA PEM Key Generator

How to use it

1. Choose a key size: 2048 bits is the common default, 3072 or 4096 bits trade speed for a longer margin, 1024 is for legacy tests only.
2. Choose the export format: PEM (SPKI public key, PKCS#8 private key, base64 wrapped at 64 characters) or JWK (JSON Web Key for both).
3. Click Generate — larger keys take a few seconds to compute.
4. Copy or download both parts, and note the SHA-256 fingerprint shown under the panels.
5. Store the private key in a secrets manager and publish only the public part.

Common use cases

• Public key pinning — compare the SHA-256 fingerprint over a separate channel before trusting a public key.
• JWT RS256 signing — hand the private key to your auth server and the public key to verifiers, in whichever format your library reads.
• TLS and SSH-adjacent configs — fill PEM slots in servers and SDKs that expect standard SPKI and PKCS#8 armor.
• WebCrypto-based apps — grab the JWK pair directly for crypto.subtle.importKey in browser code.

Why it stays private

Key generation runs on the Web Crypto API inside your browser tab. The private key is never transmitted, logged or stored — once you navigate away it is gone, so download both parts before leaving.

FAQ

Q: Which formats does the export produce? A: PEM mode gives the public key as SubjectPublicKeyInfo ("BEGIN PUBLIC KEY") and the private key as PKCS#8 ("BEGIN PRIVATE KEY"). JWK mode gives standard JSON Web Keys for both, with the private JWK carrying the public parameters as well.

Q: What is the fingerprint for? A: It is the SHA-256 digest of the DER-encoded public key, shown as colon-separated hex like OpenSSL prints it. Use it to pin or verify a public key out of band — a key that does not match the fingerprint is not the key you generated.

Q: Which key size should I pick? A: 2048 bits is the widely used baseline for RSA today. 4096 bits adds margin at the cost of slower operations; pick it when your threat model justifies the overhead. 1024 bits is below current guidance and belongs in throwaway tests only.