How to use the RSA Key Generator tool
- Choose the key type and size.
- Choose the private key format.
- Click “Generate key pair”.
- Copy or download the public and private key.
Which key should I choose?
- RSA 2048: the minimum accepted today, fast and compatible with everything.
- RSA 3072 or 4096: more security margin, slower to generate and use.
- ECDSA P-256: the same security as RSA 3072 with much smaller keys and faster signatures. Supported by all modern TLS and JWT libraries (ES256).
Formats
The public key is in SubjectPublicKeyInfo PEM (BEGIN PUBLIC KEY), which OpenSSL, Node.js, Java, Python and Go read directly. The private key can be PKCS#8 (BEGIN PRIVATE KEY) or the older PKCS#1 / SEC1 format (BEGIN RSA PRIVATE KEY / BEGIN EC PRIVATE KEY) that some tools still expect. The public key is also shown as JWK for web applications.
Security
Keys come from the Web Crypto API, the same secure random generator your browser uses for HTTPS. For production servers, many teams still prefer to generate keys on the machine where they will be used, so the private key is never copied. Everything runs in your browser. Your files and text are not uploaded to our server or stored anywhere.
Frequently asked questions
Is it safe to generate keys in a browser?
The Web Crypto API uses the operating system’s secure random source, and the key never leaves this page. Close the tab when you are done.
How do I use the key with OpenSSL?
Save the private key as private.pem, then for example: openssl req -new -key private.pem -out request.csr.
Can I add a passphrase?
Not here. You can encrypt the key afterwards with: openssl pkey -in private.pem -aes256 -out private-enc.pem.
Why does 4096-bit take longer?
Finding large prime numbers takes more work. A few seconds is normal.