RSA Key Pair Generator

Overview

Generates a genuine RSA key pair entirely in your browser with the Web Crypto API, at 2048, 3072 or 4096 bits, and presents the public key as SPKI PEM and the private key as PKCS#8 PEM. Generation happens on your machine, the keys exist only on the page, and the private key can be copied or downloaded as a .pem file.

How It Works

Pick a key size and press Generate key pair. The browser's crypto.subtle.generateKey builds the pair - this takes a moment at 4096 bits, which is normal for modular exponentiation over large primes. The public key appears first, followed by the private key, each with a copy button; the private key also has a download button that saves an rsa-<bits>-private.pem file. Nothing is transmitted, stored, or cached by the tool.

Step-by-Step Usage Guide

1. Choose the modulus size. 2048-bit is the sensible default for compatibility; pick 4096 only if you have a specific requirement and can wait for generation.
2. Press Generate key pair and wait. Large moduli need the browser to find suitable primes, which can take several seconds.
3. Copy the public key wherever it needs to be published. It is not secret.
4. Copy or download the private key and store it in a real secrets manager. Once you close the tab it is gone - the tool keeps no copy, which is a feature, not a recovery story.

Technical Specifications & Standards

The parameters are RSA-OAEP with SHA-256 and the standard public exponent 65537 (0x10001), extracted and armored by hand: exportKey('spki') and exportKey('pkcs8') return DER, which the tool base64-encodes and wraps in BEGIN/END PEM delimiters. This is real, interoperable key material - OpenSSL and most libraries import these PEM blocks directly - which distinguishes it from keys dressed in a format they are not. One Web Crypto subtlety matters for reuse: the pair is generated with usages ['encrypt', 'decrypt'] under RSA-OAEP, so within the Web Crypto API these keys cannot sign or verify, including with RSA-PSS; to reuse them for signing in the same browser API you would re-import the PKCS#8 with signing usages. Key size trade-offs are the usual ones: 2048 bits is the current floor for new keys, 3072 roughly matches 128-bit symmetric strength, and 4096 costs noticeably longer generation and slower operations for strength you rarely need for message encryption.

Targeted Use Cases

• Creating a throwaway RSA key pair for testing an encryption endpoint or an SSO integration without touching production keys.
• Checking that your server-side parsing accepts the SPKI and PKCS#8 PEM encodings your client will produce.
• Generating classroom examples of real PEM blocks without installing OpenSSL.
• Producing distinct key pairs for multi-tenant test environments, one run at a time, with the private keys never leaving the machine.

Notes & Gotchas

• Download or copy the private key immediately. The page does not persist it, and there is no way to regenerate the same pair.
• Generate on a machine you trust. Local generation protects the key from the network, not from a compromised browser or a shoulder-surfer.
• Do not expect to reuse this pair for signatures inside Web Crypto without re-importing it - the generated pair is bound to encrypt/decrypt usage.
• For long-lived production keys, prefer an offline or HSM-backed process. A browser tab is a fine workbench and a poor vault.

Frequently Asked Questions