Your private key is sensitive — store it somewhere safe. The key pair is generated entirely in your browser, never uploaded and never saved (it disappears when you refresh the page).
Help
About this tool
Generate a public/private key pair entirely in your browser with the WebCrypto API. Pick RSA (2048, 3072 or 4096 bits) or ECDSA (P-256 or P-384), then export both keys as PEM (SPKI public key / PKCS#8 private key) or JWK JSON. Nothing is uploaded and the private key is never stored — it only exists in this page and is gone the moment you refresh, so copy it to a safe place right away. Handy for creating keys for JWT signing or local development without trusting a third-party server.
How to use
- Choose RSA or ECDSA and pick the key size (modulus length or named curve).
- Select the export format: PEM or JWK.
- Click Generate, then copy the public and private keys and store the private key safely.
Should I choose RSA or ECDSA?
RSA is the most widely compatible choice and is supported by virtually every tool, server and library. ECDSA produces far smaller keys for an equivalent security level (P-256 ≈ RSA 3072, P-384 ≈ RSA 7680) and is faster to generate and use, but the verifying side must support elliptic curves. Pick ECDSA when you control both ends, and RSA for maximum compatibility.
2048-bit or 4096-bit RSA?
2048-bit RSA is still considered secure for the foreseeable future and generates quickly. 4096-bit gives a wider security margin, but the keys are larger and generation can take several seconds. Use 2048 unless a policy explicitly requires more.
Is my private key uploaded or saved?
No. The key pair is generated locally with the browser's WebCrypto API and no network request is made. The private key is never written to localStorage, cookies or IndexedDB — it lives only in this page's memory, so refreshing the page erases it. Copy it to a safe place before you leave.
What is the difference between PEM and JWK?
PEM is the classic text format with -----BEGIN/END----- headers used by OpenSSL, servers and TLS tooling; it is the safe default for key files. JWK is JSON that stores the key parameters as fields, which is what JSON Web Tokens (JWT) and many web APIs consume directly. Export JWK when you need to paste the key into a JSON configuration.