RSA Key Generator
Generate RSA key pairs as PEM, OpenSSH and JWK
About RSA Key Generator
Creates 2048, 3072 or 4096-bit RSA key pairs client-side with the Web Crypto API and exports the public key as SPKI PEM, an OpenSSH ssh-rsa line and JWK, the private key as PKCS#8 PEM and JWK, plus the SHA256 fingerprint ssh-keygen shows. The private key has no passphrase, so use these keys for testing, local development and JWT signing demos.
Category: Generators.
Frequently asked questions
Is it safe to generate RSA keys in a browser?
▾
Keys are created with the browser's Web Crypto API and are never sent anywhere, but they live in page memory and in whatever you copy or download. That is fine for testing and development; for production, run ssh-keygen or openssl on the machine that will use the key and never share the private key.
Which key size should I choose?
▾
2048 bits is the minimum current guidance accepts and is the fastest to generate and use, while 3072 bits gives roughly 128-bit security. 4096 bits adds margin but often takes several seconds to generate and makes every signature slower.
How do I use the keys with SSH?
▾
Append the ssh-rsa line to ~/.ssh/authorized_keys on the server, and save the private PEM with chmod 600 to use it with ssh -i, since OpenSSH reads unencrypted PKCS#8 keys. The private key has no passphrase; add one with ssh-keygen -p -f private.pem, and compare the SHA256 fingerprint with ssh-keygen -lf.
What is the difference between RS256 and PS256 here?
▾
Both produce the same RSA key with exponent 65537, so the PEM and OpenSSH outputs look the same. The choice only sets the JWK alg to RS256 (PKCS#1 v1.5) or PS256 (RSA-PSS), both with SHA-256, and the JWK kid is the key's RFC 7638 thumbprint.