RSA Key Pair Generator
Generate RSA public/private key pairs in PEM format. Choose key size and format — everything stays in your browser.
Private Key — PKCS#8 / 2048-bit
Private key will appear here
Click Generate Key Pair to create a new 2048-bit PKCS#8 key pair
How to use it
- 1Choose a key size (2048-bit is the standard; 4096-bit offers a higher security margin at the cost of speed).
- 2Select a format — PKCS#8 is the modern default; PKCS#1 is needed for some older libraries.
- 3Click Generate Key Pair — both keys appear below.
- 4Switch between Private Key and Public Key tabs, then Copy or Download each as a .pem file.
Common use cases
- Generate a key pair for JWT RS256 signing — use the private key to sign tokens and the public key to verify them.
- Create an RSA key pair for SSH access or for encrypting data between services.
- Generate a self-signed certificate key in development environments.
- Produce test keys for security audits, penetration testing, or automated testing pipelines.
Frequently asked questions
- Are the keys generated securely?
- Yes. Keys are generated using node-forge's RSA implementation which uses a cryptographically secure random number generator. Generation happens entirely in your browser — the keys never touch a server.
- What is the difference between PKCS#1 and PKCS#8?
- PKCS#1 is the older format specific to RSA (-----BEGIN RSA PRIVATE KEY-----). PKCS#8 is a general-purpose format that wraps the key with algorithm metadata (-----BEGIN PRIVATE KEY-----). Most modern libraries (OpenSSL, Java, Node.js) accept both; PKCS#8 is preferred for new work.
- Should I use 2048 or 4096 bits?
- 2048-bit keys are considered secure until at least 2030 and are sufficient for most use cases. 4096-bit keys offer a larger security margin but are roughly 4x slower to generate and use. For most web applications, 2048-bit is the right choice.
- Can I use these keys in production?
- Technically yes — the keys are cryptographically valid. However, for sensitive production secrets, generating keys on an air-gapped machine or via a hardware security module (HSM) is best practice.
Try next
JWT Generator
Sign JSON Web Tokens with HS256/384/512, RS256/384/512, or ES256/384. In-browser key generation, no server.
X.509 Certificate Decoder
Paste a PEM-encoded X.509 certificate — inspect subject, issuer, validity, SANs, key usage, and SHA fingerprints. Free, in your browser.
Bcrypt Hash Generator
Hash passwords with bcrypt and verify hashes — entirely in your browser.