RSA Key Generator
RSA or Ed25519 key pairs in PEM, JWK and OpenSSH formats, made in your browser.
About this tool
Choose RSA or Ed25519, a key size and what the key is for, then press Generate. The key pair is created on your device and shown as PEM files, JSON Web Keys and an OpenSSH public key line with its fingerprint, each with copy and download buttons. Nothing is stored, so save the private key before leaving the page.
Public keys, private keys and formats
Public-key cryptography uses a pair of keys. Anything signed with the private key can be checked with the public key, and anything encrypted with the public key can only be decrypted with the private key. That's how SSH logins, JWT signatures (RS256), TLS certificates and many API integrations work. You can share the public key freely, but the private key must stay secret. This generator uses your browser's built-in Web Crypto API, which draws on the operating system's secure random number generator, so the key never exists anywhere except this page. The same key can be written in several formats. PEM is base64 text between BEGIN and END lines: SPKI for public keys and PKCS#8 for private keys, which OpenSSL, Node, Python and Java all read. JWK is JSON, used by JWT libraries and identity providers. The OpenSSH line (ssh-rsa or ssh-ed25519 AAAA…) goes into authorized_keys or your GitHub settings, and its SHA256 fingerprint matches what ssh-keygen -lf prints. For size, 2048-bit RSA is today's minimum, 3072-bit gives about 128-bit security, and 4096-bit is slower for little extra benefit. Ed25519 keys are tiny and fast, and current browsers support them. Honest limits: the private key isn't password-protected, so encrypt it before storing it. For long-lived production or SSH keys, running ssh-keygen or openssl on your own machine is still best practice. The certificate decoder, the JWT encoder and the hash generator are related, and Hashing, encryption and encoding explains the difference.
Frequently asked questions
Is it safe to generate an RSA key online?
Here the key is made by your browser's Web Crypto API on your own device and never sent anywhere. For high-value keys, generating them offline with ssh-keygen or openssl is still the gold standard.
What RSA key size should I use?
3072-bit is a good default. 2048-bit is the minimum still considered acceptable, and 4096-bit is slower for little practical gain.
Can I use this key for SSH?
Yes. Add the OpenSSH public key line to ~/.ssh/authorized_keys or your Git host, and keep the private PEM file with permissions 600.
Are my keys stored?
No. Nothing is saved or uploaded. The keys disappear when you leave the page, so download them first.