RSA Key Pair Generator (2048/4096)
Generate an RSA public/private key pair in PEM format — runs 100% in your browser with the Web Crypto API, nothing is uploaded.
Larger keys are more secure but slower to generate — 4096-bit can take several seconds.
🔒 Keys are generated in your browser with the Web Crypto API — nothing is uploaded. Keep your private key secret and never share it.
What this RSA key generator does
This tool creates a fresh RSA public/private key pair entirely inside your browser using the built-in Web Crypto API. Choose a 2048-bit or 4096-bit modulus and click Generate, and you get two ready-to-use PEM blocks: the public key in SPKI format (-----BEGIN PUBLIC KEY-----) and the private key in PKCS#8 format (-----BEGIN PRIVATE KEY-----). Both are standard base64-encoded DER wrapped at 64 characters per line, so they drop straight into OpenSSL, SSH tooling, JWT libraries, TLS configs, and most languages' crypto stacks. Copy either key with one click or download it as a .pem file.
Which key size, and how your private key stays private
2048-bit keys are the common default and generate almost instantly; 4096-bit keys offer a larger security margin but can take several seconds to produce, because the browser has to find suitable large primes. The public key is safe to share — you hand it to anyone who needs to encrypt data for you or verify your signatures — while the private key must be kept secret. Because generation runs locally through crypto.subtle.generateKey, your private key is never transmitted, logged, or stored on any server; it exists only in your browser tab until you copy or download it. Note that Web Crypto requires a secure context, so the generator works over https or on localhost.
Frequently asked questions
Are the keys generated on a server?
No. Everything happens locally in your browser with the Web Crypto API. The public and private keys are never sent to, logged by, or stored on any server — they are created only inside your browser tab.
What format are the keys in?
The public key is SPKI PEM (-----BEGIN PUBLIC KEY-----) and the private key is PKCS#8 PEM (-----BEGIN PRIVATE KEY-----). Both are standard base64-encoded DER wrapped at 64 characters per line, so they are compatible with OpenSSL and most crypto libraries and tools.
Should I choose 2048 or 4096 bits?
2048-bit is a fine default for most uses and generates almost instantly. 4096-bit gives a larger security margin but is slower to create and can take several seconds. Pick 4096-bit when you want extra headroom for long-lived or high-value keys.
Can I use these keys in production?
They are real, standards-compliant RSA keys, but treat browser-generated keys with care. For high-value production keys, generate them on a trusted machine or HSM. In every case, keep the private key secret and never share it.