About this RSA key generator
This tool creates an RSA key pair, a public key you can share and a private key you must keep secret, using the Web Crypto API built into your browser. The keys are generated on your device. They are not sent to a server and not stored, so the page works with the network off once it has loaded.
How to use it
- Choose a key size. 2048 bits is the common minimum today and is quick to make. 3072 and 4096 bits are larger and slower to generate; 4096 can take several seconds on a phone.
- Choose a format. The default, PKCS#8 for the private key and SPKI for the public key, produces
-----BEGIN PRIVATE KEY-----and-----BEGIN PUBLIC KEY-----, which OpenSSL, Node.js, Java, Python and most libraries read directly. Pick PKCS#1 if a tool asks for-----BEGIN RSA PRIVATE KEY-----. - Press Generate, then copy or download each key. The fingerprint line is the SHA-256 hash of the public key, which lets you check that two copies are the same key.
What the keys are
An RSA key pair is built from two large primes. The public key (the modulus and the exponent 65537) can encrypt data or check signatures, and only the private key can decrypt it or create the signature. The PEM text is the binary key encoded in Base64 between header and footer lines. This page uses the exponent 65537, the standard choice.
Good to know
- No password on the private key. The downloaded private key is not encrypted. Protect the file, or add a passphrase afterwards with
openssl pkcs8 -topk8orssh-keygen. - Not an SSH key file. The output is PEM, not the
ssh-rsaformat used inauthorized_keys. Usessh-keygenfor SSH keys. - Generated in the browser. Keys come from the browser's secure random generator. For high-value keys, such as a certificate authority, generate them on a trusted offline machine with hardware you control.
- RSA is slow and size-limited. It is used mostly for signing and for wrapping small keys. For bulk data, use it to protect a symmetric key such as one for AES.
To check what a pair does, encrypt a short message with the public key in your own code and decrypt it with the private one. The hash generator can confirm a fingerprint.
Frequently asked questions
The keys are made by the browser's own cryptography on your device, and nothing is uploaded. That is fine for development, testing and many personal uses. For high-value keys, generate them offline on a machine you fully control.
No. They exist only in the page while it is open. Refreshing or closing the tab erases them, so download the private key first if you need it.
2048 bits is the usual minimum and is accepted nearly everywhere. 4096 bits offers a larger margin and is slower to generate and to use. 3072 is a middle choice.
They are two ways to encode the same private key. PKCS#8 is a general wrapper that works for any key type and begins BEGIN PRIVATE KEY. PKCS#1 is RSA-specific and begins BEGIN RSA PRIVATE KEY. Use whichever your software asks for.
Not directly. SSH uses its own public key format. Use ssh-keygen to create SSH keys, or convert a PEM key with ssh-keygen -y.
The tool outputs the raw key so that any software can read it. Add a passphrase afterwards with OpenSSL if you will store it on a shared or synced disk.