RSA Key Pair Generator
Generate an RSA public/private key pair in your browser via the native Web Crypto API, exported as standard PEM text.
Private by architecture:
All processing is 100% client-side memory. Your data never leaves this browser tab.
Nothing leaves your browser: the private key is generated and held only in page memory via
crypto.subtle. It is not saved anywhere: reloading or closing this tab destroys it.
Download or copy the private key now if you need to keep it.
Generating 2048-bit key pair... this can take a few seconds for larger sizes.
Ready to Generate Key Pair
Select purpose and bit length above, then click Generate Key Pair. Public and private keys will appear side by side in standard PEM formatting.
About This Tool
Generates an RSA public/private key pair directly in your browser using the native Web Crypto API (crypto.subtle.generateKey). Pick a purpose (RSA-OAEP for encrypting payloads, or RSASSA-PKCS1-v1_5 for signing), a modulus length, and a hash algorithm, then export both keys as standard PEM text (SPKI for the public key, PKCS8 for the private key).
This is a key-pair generator: it creates raw cryptographically secure keys in standard OpenSSL-compatible PEM format.
Key Features
- Two RSA algorithms: RSA-OAEP for asymmetric encryption and RSASSA-PKCS1-v1_5 for digital signatures.
- Selectable modulus length: 2048, 3072, or 4096 bits based on required security level.
- Selectable hash algorithm: SHA-256, SHA-384, or SHA-512 used internally by OAEP padding or PKCS1 signatures.
- Standard PEM formatting: SPKI public key and PKCS8 private key wrapped at 64 characters per line.
- Independent copy & download: Each key features individual clipboard copying and .pem file export.
- Ephemeral in-memory privacy: Keys exist strictly in page memory and are destroyed immediately on reload.
Frequently Asked Questions
Is my private key sent anywhere?
No. Key generation and PEM export run entirely through the browser built-in Web Crypto API; nothing is transmitted to a server, and the key only exists in this tab memory.
Why pick RSA-OAEP vs RSASSA-PKCS1-v1_5?
They are not interchangeable: RSA-OAEP keys can only be used to encrypt/decrypt, and RSASSA-PKCS1-v1_5 keys can only be used to sign/verify. Pick based on what you intend to do with the key.
Can I encrypt a large file directly with the generated RSA-OAEP key?
No. RSA-OAEP can only encrypt payloads smaller than the modulus size minus padding overhead: for a 2048-bit key with SHA-256, that is roughly 190 bytes. In practice RSA encrypts a symmetric (AES) key, and the symmetric key does bulk encryption.
Why does 4096-bit generation take longer?
RSA key generation involves finding large prime numbers; the search gets slower as the modulus size grows. 2048-bit is near-instant in most browsers, while 4096-bit can take several seconds.
Will the key still be here if I refresh the page?
No, by design. The key is never persisted to storage: refreshing or closing the tab discards it permanently. Download the PEM files if you need to keep them.
