By · Updated

EC Key Generator

ECDSA P-256 and Ed25519 Key Pairs as PEM or JWK, Made in Your Browser

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the EC Key Generator works

This EC key generator makes an elliptic curve key pair in your browser: the NIST curves P-256, P-384 and P-521 for ECDSA, Ed25519 for EdDSA signatures, or X25519 for key agreement. Download it as PEM or JWK. The private key is created by the Web Crypto API and never leaves the page.

What the EC key generator produces

PEM output is a PKCS#8 private key and an SPKI public key, the formats OpenSSL, Node.js, Go and Java all read. JWK output gives both keys with kty, crv, the curve coordinates and a kid set to the RFC 7638 thumbprint, with alg set for signing curves. The public key's SHA-256 fingerprint is shown so you can check a deployed key matches.

Which curve to pick

P-256 with ES256 is the most widely supported choice for JWTs, TLS and WebAuthn. Ed25519 is faster, simpler to implement safely and has deterministic signatures, and is now supported by most libraries. P-384 and P-521 are for policies that require them. X25519 cannot sign; it is used to agree a shared secret, as in TLS 1.3 and age.

FAQ

Why does Ed25519 show an error?

Ed25519 and X25519 arrived in browsers' Web Crypto later than the NIST curves. Current Chrome, Edge, Firefox and Safari support them, but older versions do not. If you see the error, update your browser, or choose P-256, which every browser supports.

Is an EC key as strong as a large RSA key?

Yes. A 256-bit elliptic curve key gives about the same security as a 3072-bit RSA key, and P-384 matches RSA at 7680 bits. EC keys are much smaller, and signing is faster, which is why modern protocols prefer them.

How do I convert the key to OpenSSH format?

OpenSSH reads PKCS#8 private keys for these curves. Save the private key and run ssh-keygen -y -f key.pem to print the public key in OpenSSH format. For Ed25519, newer versions of ssh-keygen can also import the key into the native OpenSSH private key format.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

RSA Key Generator

RSA key pairs as PEM or JWK, made in your browser.

PEM To JWK Converter

Convert public and private keys between PEM and JWK.

PEM Inspector

Decode PEM and DER into a readable ASN.1 tree.

JWT Decoder

Decode a JWT and read its claims and expiry.

Signature Verifier

Check whether a signature over a message matches a public key.