RSA Key Pair Generator
Generate an RSA public/private key pair as PEM.
An RSA key pair is a private key you keep secret and a public key you give out: what one signs or encrypts, the other verifies or decrypts. This tool makes a new pair with your browser's built-in Web Crypto and writes both keys as PEM text that OpenSSL and most libraries read. The keys are made on your device and never uploaded or stored; it's free and needs no sign-up.
How to generate an RSA key pair
- Choose the key size: 2048 bits is the usual minimum, 3072 or 4096 for keys meant to last.
- Choose the format: PKCS#8 (BEGIN PRIVATE KEY) unless a tool asks for BEGIN RSA PRIVATE KEY.
- Click Generate key pair. A 4096-bit key can take a few seconds.
- Copy or download the private and public key (.pem) before you leave the page.
Features
- 2048, 3072 or 4096-bit keys with the public exponent 65537
- PKCS#8 and SPKI PEM (BEGIN PRIVATE KEY, BEGIN PUBLIC KEY), or PKCS#1 (BEGIN RSA PRIVATE KEY) for older tools
- Switch the format after generating: the same key, written the other way
- Copy each key, or download it as a .pem file
- Made with your browser's built-in Web Crypto; OpenSSL reports the keys as valid
Is it private?
Yes. The key pair is made by your browser's built-in Web Crypto and exists only on this page: nothing is uploaded or stored. Copy or download both keys before you leave or reload the page.
Frequently asked questions
PKCS#8 or PKCS#1 — which one do I need?
Both hold the same key. PKCS#8 (BEGIN PRIVATE KEY, with the public key as BEGIN PUBLIC KEY) is what OpenSSL 3 writes and most libraries expect. PKCS#1 (BEGIN RSA PRIVATE KEY, BEGIN RSA PUBLIC KEY) is the older RSA-only form some tools still ask for. Switching after generating shows the same key in the other form.
Can OpenSSL read these keys?
Yes. openssl pkey -in private.pem -check reports the key as valid, and openssl rsa -in private.pem -traditional prints exactly the PKCS#1 version this page shows (checked with OpenSSL 3.0).
Which key size should I choose?
2048 bits is the minimum accepted today; NIST considers it adequate until 2030. Choose 3072 or 4096 bits for keys that must stay secure beyond that. Bigger keys are slower to make and to use.
How do I protect the private key with a password?
The key is shown unencrypted so any tool can read it. To store it encrypted, run openssl pkey -in private.pem -aes256 -out private-encrypted.pem and choose a passphrase.
Can I use this key for SSH?
Use the SSH Key Generator instead: it writes the OpenSSH files (id_rsa or id_ed25519 and the .pub line) that ssh and servers expect.