// generate RSA key pairs, sign and verify — all in the browser
Generate RSA key pairs (1024, 2048, 4096 bit) in the browser. PKCS#8 private key, SPKI public key, PEM format, fingerprint. Sign and verify messages. Free, no signup, keys never leave your device.
Click "Generate Key Pair" to create RSA keys
Keys are generated in your browser using the Web Crypto API and never transmitted anywhere.Choose key size (2048-bit recommended), hash algorithm (SHA-256 or SHA-384), and click "Generate Key Pair". Generation takes a moment for larger keys.
Copy or download both keys as .pem files. The private key stays with you; the public key can be shared with anyone who needs to verify your signatures or encrypt data for you.
Use the Sign/Verify section to test the keys. Sign any message with your private key and verify it with the public key — confirming the key pair works correctly.
2048-bit is the current NIST minimum for RSA and sufficient for most use cases through 2030+. 4096-bit provides a higher security margin at the cost of slower operations. 1024-bit is insecure and only for legacy compatibility testing. For new systems, consider ECDSA (P-256) instead for equivalent security with much smaller keys.
RSA (Rivest–Shamir–Adleman) is the most widely deployed asymmetric key algorithm. A key pair consists of a public key (shareable) and a private key (secret). The private key signs data; the public key verifies signatures. The private key decrypts data encrypted with the public key. This tool generates keys using the browser's native crypto.subtle.generateKey() — no JavaScript math, native hardware acceleration.
The keys are cryptographically generated using the browser's native Web Crypto API — the same API used by browser extensions, password managers, and secure web applications. The key material is generated by your operating system's CSPRNG. However, for critical production systems, key management includes more than generation — you also need secure storage (HSMs, key vaults), rotation policies, and audit logging. Use this tool for development, testing, JWT signing, and learning.
PKCS#8 is the standard format for private key storage, defined in RFC 5958. It wraps the key in a standardised envelope that includes the algorithm identifier. Most modern tools (OpenSSL, Node.js, Java, Python) support PKCS#8 natively. The older PKCS#1 format (which omits the algorithm header) is also widely supported. This tool produces PKCS#8 private keys and SPKI public keys — the formats expected by crypto.subtle.importKey().
In RSA, the public key consists of a modulus (the large number) and an exponent. The public exponent e = 65537 (2^16 + 1) is the standard choice because it is a Fermat prime with only two 1-bits, making modular exponentiation efficient (only 17 squarings for encryption/verification). The value 3 was historically used for speed but has known vulnerabilities when used without proper padding. Always use 65537 unless you have a specific reason for otherwise.
A key fingerprint is a short hash of the public key — a compact representation that allows you to quickly verify that a public key hasn't been substituted. When you see "SHA-256 fingerprint: ab:cd:ef:…", you can compare that against a known-good fingerprint to confirm you have the right key. SSH uses SHA-256 fingerprints to identify host keys; TLS certificates use them for trust anchors.
RSA key generation requires finding two large prime numbers. The primality testing algorithm (Miller-Rabin) runs faster on smaller numbers — 2048-bit primes are found much more quickly than 4096-bit primes. Generation time scales roughly as O(n^3) with key size, so a 4096-bit key takes approximately 8× longer than a 2048-bit key. For most applications, 2048-bit RSA is sufficient security through the foreseeable future.
RSA-OAEP (Optimal Asymmetric Encryption Padding) is used for encryption — encrypting data with the public key so only the private key holder can decrypt it. RSA-PSS (Probabilistic Signature Scheme) is used for digital signatures — signing data with the private key so anyone with the public key can verify it. This tool uses RSA-PSS for the sign/verify feature. RSA-OAEP encryption is not included because it is rarely used directly (symmetric encryption with RSA-wrapped keys is preferred for larger data).
RSA key generation has traditionally required command-line tools like OpenSSL or server-side code. Modern browsers have changed this — the Web Crypto API provides native RSA key generation that runs at near-native speed, uses the operating system's CSPRNG for randomness, and never exposes the key material to JavaScript code in a way that could be intercepted by other scripts on the page.
RSA is the established standard with near-universal compatibility. ECDSA (Elliptic Curve Digital Signature Algorithm) provides equivalent security with dramatically smaller keys — a 256-bit ECDSA key is approximately as secure as a 3072-bit RSA key. ECDSA keys are faster to generate, produce shorter signatures, and are preferred for new systems. RSA remains important for legacy compatibility, particularly with older TLS clients, PKCS standards, and systems that predate elliptic curve support. When in doubt: use RSA-2048 for maximum compatibility, ECDSA P-256 for performance.
PEM (Privacy Enhanced Mail) is the Base64-encoded format for cryptographic keys, bookended by -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- headers. Despite its name, PEM is the universal format for TLS certificates, SSH keys, JWT RS256 keys, and GPG subkeys. The Base64 content encodes the binary ASN.1/DER representation of the key structure defined in the relevant PKCS standard.