By · Updated

RSA Key Generator

PKCS#8 and SPKI PEM or JWK Output With Thumbprint Key ID, Made Locally

No ratings yet

OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.

How the RSA Key Generator works

This RSA key generator makes a fresh RSA key pair in your browser using the Web Crypto API, at 2048, 3072 or 4096 bits. Download it as PEM, the format OpenSSL and most servers expect, or as JWK for JSON Web Token libraries and JWKS endpoints. The private key is never sent anywhere.

What the RSA key generator gives you

In PEM mode you get the private key in PKCS#8 form (BEGIN PRIVATE KEY) followed by the public key in SPKI form (BEGIN PUBLIC KEY). In JWK mode you get both halves as JSON Web Keys with alg, use and a kid set to the RFC 7638 thumbprint, so the public key can go straight into a JWKS document. The public key's SHA-256 fingerprint is shown so you can confirm which key a server has loaded.

Choosing a size and use

2048 bits is the minimum accepted today and is fine until around 2030. 3072 bits matches 128-bit security and is the safer default for keys that will live for years. 4096 bits takes noticeably longer to generate and use. Keep signing and encryption keys separate; the choice here sets the alg in the JWK.

FAQ

Is a browser-generated key secure?

Yes. The key is generated by your browser's Web Crypto implementation, which uses the operating system's secure random number generator, the same source OpenSSL uses. The key exists only in this page until you download it, and closing the tab discards it.

How do I use the key with OpenSSL?

Save the output as a .pem file. OpenSSL reads PKCS#8 private keys directly, so openssl pkey -in key.pem -text will show it. To get the old BEGIN RSA PRIVATE KEY format, run openssl pkey -in key.pem -traditional. The public key block can be split out into its own file.

Should I use RSA or elliptic curve keys?

For new systems, elliptic curve keys such as P-256 or Ed25519 are smaller and faster with equal security. RSA remains the most widely supported, and some older systems, hardware tokens and integrations only accept RSA, so it is still the safe choice for compatibility.

See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.

Related tools

EC Key Generator

Elliptic curve and Ed25519 key pairs as PEM or JWK.

PEM To JWK Converter

Convert public and private keys between PEM and JWK.

PEM Inspector

Decode PEM and DER into a readable ASN.1 tree.

JWT Decoder

Decode a JWT and read its claims and expiry.

CSR Decoder

Decode a CSR, verify its signature and spot problems before submitting.