Skip to main content

You are responsible for key management and output validation.

RSA Key Pair Generator

Generate RSA-OAEP key pairs in your browser and export them as PEM (SPKI public key, PKCS#8 private key). Keys never leave your device.

Key Size

RSA-OAEP with SHA-256, exportable for your own use. Generation runs locally with the Web Crypto API.

How to Generate an RSA Key Pair Online

Learn how to generate RSA key pairs locally in your browser and export them as PEM without uploading anything.

  1. 1

    Choose a key size

    Select 2048, 3072, or 4096 bits.

  2. 2

    Generate the key pair

    Click Generate Key Pair. The Web Crypto API creates it locally.

  3. 3

    Copy or download the keys

    Export the SPKI public key and PKCS#8 private key as PEM files.

  4. 4

    Store the private key safely

    Save the private key offline, encrypted, and with restricted access.

Common Use Cases

  • 1Generate RSA key pairs for local development and testing
  • 2Create PEM keys for tools, scripts, or TLS-related experiments
  • 3Learn how SPKI and PKCS#8 PEM formats differ by inspecting the output
  • 4Pair with client-side encryption workflows that need asymmetric keys

Security Tips

  • Private keys are credentials: store them encrypted and control access
  • Never paste a private key into a web form or chat, including 'verification' services
  • Generate keys on a device you trust and back up the private key securely
  • Use longer keys (3072 or 4096 bits) where the runtime supports them, and retire keys on a schedule

Frequently Asked Questions

Are the keys generated locally?

Yes. The Web Crypto API generates the key pair inside your browser using your device's secure random number source. Nothing is sent to a server.

Which algorithm and formats are used?

RSA-OAEP with SHA-256. The public key is exported as SPKI PEM and the private key as PKCS#8 PEM, both common interchange formats.

Is a 2048-bit RSA key enough?

2048-bit keys remain the common minimum and are still broadly supported, while 3072 and 4096 provide more margin at the cost of speed. Choose based on the sensitivity and lifetime of the data, and follow your organization's key-management policy.

Related Guides

RSA Key Pair Guide: Generate PEM Keys

Public and private keys, PEM headers, key sizes, and storage habits. Generate a pair locally and…

Web Crypto API: Guide for Developers

What the Web Crypto API can do: generateKey, encrypt, decrypt, hash, and sign operations — and why native…

How to Decrypt AES-256-GCM Locally

Decrypting AES-256-GCM is straightforward when you have the password and the right metadata. Here is the…

Related Tools

AES Encryptor

Encrypt files and text with symmetric AES-256-GCM

Hash Generator

Fingerprint keys and files with SHA-256

HMAC Generator

Sign requests and payloads with shared secrets

JWT Decoder

Inspect tokens that public keys verify

Your inputs remain on your device.