Skip to main content

RSA Key Pair Generator

Generate RSA-OAEP key pairs in your browser or import an existing SPKI/PKCS#8 pair, then export both as PEM. Keys never leave your device.

Generate an RSA-OAEP key pair or import an existing SPKI/PKCS#8 pair; the browser verifies that the public and private keys match and accepts moduli from 2048 to 4096 bits. Everything stays local.

Tool workspace

Key Size

RSA-OAEP with SHA-256, exportable for your own use. Generation runs locally with the Web Crypto API.

No result yet

Enter your input above and the result will appear here.

How to Generate an RSA Key Pair Online

Learn how to generate RSA key pairs locally in your browser and export them as PEM without uploading anything.

  1. 1

    Choose a key size

    Select 2048, 3072, or 4096 bits.

  2. 2

    Generate the key pair

    Click Generate Key Pair. The Web Crypto API creates it locally.

  3. 3

    Copy or download the keys

    Export the SPKI public key and PKCS#8 private key as PEM files.

  4. 4

    Store the private key safely

    Save the private key offline, encrypted, and with restricted access.

Common Use Cases
  • 1Generate RSA key pairs for local development and testing
  • 2Create PEM keys for tools, scripts, or TLS-related experiments
  • 3Learn how SPKI and PKCS#8 PEM formats differ by inspecting the output
  • 4Pair with client-side encryption workflows that need asymmetric keys
Security Tips
  • Private keys are credentials: store them encrypted and control access
  • Never paste a private key into a web form or chat, including 'verification' services
  • Generate keys on a device you trust and back up the private key securely
  • Use longer keys (3072 or 4096 bits) where the runtime supports them, and retire keys on a schedule

Frequently Asked Questions

Are the keys generated locally?

Yes. The Web Crypto API generates the key pair inside your browser using your device's secure random number source. Nothing is sent to a server.

Which algorithm and formats are used?

RSA-OAEP with SHA-256. The public key is exported as SPKI PEM and the private key as PKCS#8 PEM, both common interchange formats.

Is a 2048-bit RSA key enough?

2048-bit keys remain the common minimum and are still broadly supported, while 3072 and 4096 provide more margin at the cost of speed. Choose based on the sensitivity and lifetime of the data, and follow your organization's key-management policy.

What is the difference between SPKI and PKCS#8?

SPKI is the standard envelope for a public key and PKCS#8 for a private key, both encoded as PEM. Share the public key for encryption and keep the private key offline.

Can I import an existing PEM key pair?

Yes. Switch to Import existing, paste an SPKI public key (BEGIN PUBLIC KEY) and its PKCS#8 private key (BEGIN PRIVATE KEY), and the tool verifies that the two keys match before showing them. PKCS#1 (BEGIN RSA PRIVATE KEY) is not accepted.

Related Guides

Related Tools

Network-verified: see this tool's measured requests

Encryption background on zeyrovault.com

Your inputs remain on your device.

You are responsible for key management and output validation.