RSA Key Pair Generator
Generates an RSA key pair (public and private) in PEM, entirely in your browser.
Key size
What an RSA key pair is
RSA is an asymmetric cryptography algorithm: it generates two mathematically related keys with opposite roles. The public key can circulate freely — it's what others use to verify your signature or encrypt something only you can read. The private key must stay with you alone — it's what you use to sign or decrypt. Unlike HMAC (a single shared key), only whoever holds the private key can prove possession; the public key never reveals the private one.
PEM format (SPKI/PKCS8) — what it means
PEM is a text format (Base64 between a header and footer, RFC 7468) for carrying keys and certificates. The public key comes out as SPKI ("-----BEGIN PUBLIC KEY-----"), the private key as PKCS8 ("-----BEGIN PRIVATE KEY-----") — the same format the JWT Generator's private key field already expects for signing with RS256/PS256, and the format accepted by most tools and libraries in the ecosystem. Different from PKCS1 ("-----BEGIN RSA PRIVATE KEY-----"), the format the legacy "openssl genrsa" command produces by default.
Why 2048/3072/4096 matter
Key size (in bits) is RSA's main security factor — the larger it is, the harder it is to break by mathematical brute force, and the slower it is to generate. 2048 bits is the historical default and still considered secure by NIST at least through 2030. 3072 bits is the floor already recommended for new, long-lived keys, with generation still fast. 4096 bits is the strongest level available here — more secure, but noticeably slower to generate (the search for large enough prime numbers grows in time, sometimes well beyond the average).
This is not an SSH key
The pair generated here is generic PEM (SPKI/PKCS8) — the format used by certificates, JWTs signed with RS256/PS256, and most integrations expecting a plain "RSA key". An SSH key uses its own formats (OpenSSH, or PEM with a specific comment header) and is normally produced by "ssh-keygen", not this tool. To generate SSH keys, the catalog has a dedicated tool: the SSH Key Generator.
Frequently asked questions
No. Generation happens entirely in your browser, using the native Web Crypto API (crypto.subtle.generateKey) — this tool makes no network calls.
Yes — the private key already comes out in the PEM/PKCS8 format the JWT Generator expects. Paste the private key generated here directly into the JWT Generator's key field, with RS256, RS384, RS512, PS256, PS384 or PS512 selected.
Not directly — see "This is not an SSH key", above. The pair generated here is generic PEM (SPKI/PKCS8), a different format from what SSH expects. Use the SSH Key Generator, the catalog's dedicated tool (it generates Ed25519 and RSA keys already in the formats SSH expects).
4096 bits (this tool's default) is the strongest level available here — generation is fast in practice (a few seconds on most browsers/devices), so there's no reason to open at a smaller size. 3072 bits is the floor already recommended by NIST for new, long-lived keys and remains a solid choice; 2048 bits is still considered secure and generates faster, useful on a more limited device.
The first is PKCS8 (the format this tool generates), the second is PKCS1 — an older, RSA-specific format that tools like "openssl genrsa" still produce by default. PKCS8 is more modern and widely accepted; if you need PKCS1 for compatibility with something specific, you can convert it with "openssl rsa -in pkcs8-key.pem -out pkcs1-key.pem".
Yes. The Web Crypto API uses the operating system's own cryptographically secure random number generator (the same one used by native cryptography libraries), not a plain JavaScript pseudo-random generator (Math.random).
Nexinon Principles
Privacy
Your data never leaves your browser.No account needed
Use it now, no account or password.Free
No usage limits, no paid plan.Trustworthy content
Full explanation behind every tool, not just the result.