RSA Key Pair Generator (2048/4096)
Generate a 2048- or 4096-bit RSA key pair in PEM format with the Web Crypto API — the private key is created locally and never transmitted.
Larger keys are more secure but slower to generate — 4096-bit can take several seconds. A fresh pair is made each time the page opens; Generate makes another.
Keys are generated with the Web Crypto API. Keep your private key secret and never share it.
What this RSA key generator does
This tool creates a fresh RSA public/private key pair entirely inside your browser using the built-in Web Crypto API. A 2048-bit pair is made as soon as the page opens; choose a 2048-bit or 4096-bit modulus (or another size from the menu) and click Generate for a new one. Either way you get two ready-to-use PEM blocks: the public key in SPKI format (-----BEGIN PUBLIC KEY-----) and the private key in PKCS#8 format (-----BEGIN PRIVATE KEY-----), or, with Private key format set to PKCS#1, the traditional -----BEGIN RSA PRIVATE KEY----- block — the same key without its PKCS#8 wrapper, switchable without making a new pair. Both are standard base64-encoded DER wrapped at 64 characters per line, so they drop straight into OpenSSL, SSH tooling, JWT libraries, TLS configs, and most languages' crypto stacks. Copy either key with one click or download it as a .pem file.
Which key size, and how your private key stays private
2048-bit keys are the common default and generate almost instantly; 4096-bit keys offer a larger security margin but can take several seconds to produce, because the browser has to find suitable large primes. The public key is safe to share — you hand it to anyone who needs to encrypt data for you or verify your signatures — while the private key must be kept secret. Because generation runs locally through crypto.subtle.generateKey, your private key is never transmitted, logged, or stored on any server; it exists only in your browser tab until you copy or download it. Note that Web Crypto requires a secure context, so the generator works over https or on localhost.
Frequently asked questions
Are the keys generated on a server?
No. Your browser's crypto.subtle.generateKey makes the pair, with exponent 65537, and exports SPKI and PKCS#8; the PKCS#1 form is unwrapped from that in the page. The keys exist only in this tab.
What format are the keys in?
The public key is SPKI PEM (-----BEGIN PUBLIC KEY-----) and the private key is PKCS#8 PEM (-----BEGIN PRIVATE KEY-----) by default, or PKCS#1 PEM (-----BEGIN RSA PRIVATE KEY-----) when Private key format is set to PKCS#1. Both are standard base64-encoded DER wrapped at 64 characters per line, so they are compatible with OpenSSL and most crypto libraries and tools.
Should I choose 2048 or 4096 bits?
2048-bit is a fine default for most uses and generates almost instantly. 4096-bit gives a larger security margin but is slower to create and can take several seconds. Pick 4096-bit when you want extra headroom for long-lived or high-value keys.
Can I use these keys in production?
They are real, standards-compliant RSA keys, but treat browser-generated keys with care. For high-value production keys, generate them on a trusted machine or HSM. In every case, keep the private key secret and never share it.
Can I choose any key size?
Yes. Besides the common sizes in the menu, Custom takes any size in whole bytes within the range the page states. Sizes below the usual minimum get a warning, and a size your browser refuses is reported as exactly that.
Can I get the private key as BEGIN RSA PRIVATE KEY?
Yes. Set Private key format to “PKCS#1 — BEGIN RSA PRIVATE KEY” and the private block becomes the traditional RSA-only form that older OpenSSL releases wrote and some libraries still insist on. It is the same key as the PKCS#8 block, unwrapped, so switching back and forth changes the format without generating a new pair, and Copy and Download give whichever form is shown.