What is RSA Key Generator
The RSA Key Generator creates a matched pair of RSA public and private keys directly in your browser using the Web Crypto API's SubtleCrypto.generateKey interface. It supports key sizes of 1024, 2048, and 4096 bits, with 2048-bit being the current recommended minimum for production use. The output includes both keys in PEM format — the standard text encoding used by OpenSSL, SSH, and most certificate management tools.
RSA (Rivest–Shamir–Adleman) is an asymmetric cryptographic algorithm: the public key encrypts data, and only the corresponding private key can decrypt it. This tool generates fresh key pairs for each request, meaning the private key exists only in your browser during the generation session and is never transmitted to any server.
How to Use RSA Key Generator
- Select the key size from the options panel. 2048-bit is the default and recommended for most applications. Use 4096-bit for high-security requirements (at the cost of slower generation and encryption operations).
- Click Generate to create the key pair. Generation typically takes 1-5 seconds for 2048-bit keys and up to 15 seconds for 4096-bit keys, depending on your device.
- Copy the public key — this is the key you share with others or embed in configuration files. It begins with
-----BEGIN PUBLIC KEY-----. - Copy the private key — this must remain confidential. It begins with
-----BEGIN PRIVATE KEY-----. Store it in a secure location, never in source control or shared drives. - Use the keys in your application, SSH configuration, or certificate signing workflow. The PEM format is compatible with OpenSSL, most programming languages, and CI/CD pipelines.
Why Use RSA Key Generator
Developers need RSA key pairs for several concrete workflows. SSH key authentication is the most common — generating a fresh key pair for a new server or CI/CD pipeline, then copying the public key to the authorized_keys file. JWT RS256 signing requires an RSA key pair where the private key signs tokens and the public key verifies them. API authentication systems like GitHub's JWT-based apps and certain OAuth flows also require RSA keys.
Using a browser-based generator means you can create keys on any machine — including managed workstations where installing OpenSSL or ssh-keygen may require admin privileges. Since generation happens locally, there is no risk of a server-side key escrow or logging incident.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
Which key size should I choose?
2048-bit is the current industry standard and is recommended for most use cases. It provides adequate security against known attacks and is supported by all major libraries and platforms. 4096-bit offers a higher security margin but generates slower and produces larger keys — use it when compliance requirements mandate it or for long-term secrets (like root CA keys) that need to remain secure for decades.
Are these keys secure enough for production?
The keys themselves are cryptographically sound — generated using the browser's native CSPRNG (Cryptographically Secure Pseudo-Random Number Generator). However, for production use, consider whether you need a key management strategy: who has access to the private key, how is it rotated, and how is it stored? A key generated in a browser tab is fine for development and testing, but production private keys should ideally live in a hardware security module (HSM) or a managed secrets vault.
Can I use these keys with OpenSSL?
Yes. The output PEM format is directly compatible with OpenSSL commands like openssl rsa -in private.pem -pubout -out public.pem. You can also use the keys with ssh-keygen (after converting the format), with Java's keytool, or with any language that supports PKCS#8 private keys and SPKI public keys.
Why not just use ssh-keygen or openssl?
Those tools are excellent and should be your first choice when available. This browser-based generator exists for situations where command-line access is restricted — managed corporate laptops, air-gapped environments, or quick one-off key generation where opening a terminal feels like overkill. It produces equivalent keys in the same standard format.