RSA & EC Key-Pair Generator

Generate RSA or elliptic-curve key pairs as PEM — locally, never uploaded.

Generate RSA or elliptic-curve key pairs as PEM — locally, never uploaded. Free and 100% private — runs entirely in your browser, nothing is ever uploaded.

About RSA & EC Key-Pair Generator

The RSA & EC Key-Pair Generator creates cryptographic key pairs directly in your browser using the native Web Crypto API. Choose RSA 2048, RSA 4096, EC P-256, or EC P-384, click generate, and get ready-to-use PEM-encoded public and private keys you can copy or download. Use it when you need a signing key pair for testing, JWT signing, certificate requests, or development setup. Everything runs locally in your browser and the private key never leaves the page, so nothing is uploaded to any server.

How to use RSA & EC Key-Pair Generator

  1. Open the RSA & EC Key-Pair Generator and pick an algorithm: RSA 2048 or RSA 4096 for the widest compatibility, or EC P-256 / P-384 for smaller, near-instant keys.
  2. Click Generate key pair. RSA 4096 takes a few seconds while it finds primes; EC keys are nearly instant.
  3. Review the result: the public key is exported as SPKI PEM (safe to share) and the private key as unencrypted PKCS#8 PEM (keep secret).
  4. Use Copy to put a key on your clipboard, or Download to save public.pem and private.pem to disk.
  5. Store the private key somewhere safe (a secrets manager or encrypted vault). Anyone who has it can impersonate you.
  6. Click Generate another to create a fresh pair, or switch the algorithm and regenerate.

Frequently asked questions

What key types and sizes can I generate?
Four options: RSA 2048 and RSA 4096 (RSASSA-PKCS1-v1_5 with SHA-256 and the standard 65537 public exponent), plus elliptic-curve ECDSA keys on the P-256 and P-384 curves. RSA gives the widest compatibility; EC keys are much smaller and generate instantly.
What format are the keys in?
Both keys are PEM-encoded. The public key uses SPKI (SubjectPublicKeyInfo) wrapped in a BEGIN PUBLIC KEY envelope, and the private key uses PKCS#8 wrapped in BEGIN PRIVATE KEY. The PKCS#8 private key is unencrypted, so store it securely yourself.
Is my private key sent anywhere?
No. Keys are generated entirely in your browser with the Web Crypto API. The private key is created locally and never leaves the page, nothing is uploaded, and there is no server round-trip. You can confirm this by generating a key with your network disconnected.
Can I use these keys for SSH?
These are general-purpose PEM key pairs (SPKI public, PKCS#8 private) suited to signing, JWT, certificate requests, and library use. They are not in the OpenSSH authorized_keys format, so for SSH you would need to convert them with a tool like ssh-keygen first.
Why does RSA 4096 take a few seconds?
RSA key generation has to find large random prime numbers, and the work grows with key size. RSA 4096 is noticeably slower than RSA 2048. If you need instant generation and modern security, choose an EC P-256 or P-384 key instead.
Should I use RSA or EC?
Use RSA when you need maximum compatibility with older systems or specific tooling. Use EC (P-256 or P-384) when you want smaller keys, faster generation, and strong modern security. P-256 is a common default; P-384 offers a higher security margin.