About RSA / EC Key Pair Generator

RSA / EC Key Pair Generator creates a key pair in the page with the Web Crypto API and exports it as PEM: the public key in SPKI form and the private key in PKCS#8 form.

The keys are generated locally and are not sent anywhere. The private key is shown once, so save it before you leave.

How to use it

  1. Pick a key type: RSA 2048 to 4096, or an elliptic curve P-256, P-384, or P-521.
  2. Click Generate. Large RSA keys take a few seconds.
  3. Copy or download the public and private PEM files.

Common questions

RSA or EC?

Elliptic-curve keys are smaller and faster for the same security level and are a good default for signing. RSA is still widely required for compatibility. P-256 or RSA 3072 are reasonable choices.

What formats are the PEM files?

The public key is SPKI (BEGIN PUBLIC KEY) and the private key is unencrypted PKCS#8 (BEGIN PRIVATE KEY). Most tools and libraries read both.

Is the private key encrypted?

No. It is exported in the clear, so store it somewhere safe and consider wrapping it with a passphrase using your own tooling.

Does the key leave my browser?

No. Generation and export both run locally with Web Crypto.