RSA Key Pair Generator — Free Online

RSA key pairs are the foundation of asymmetric cryptography — one key locks, the other unlocks, and neither can do the other's job. This generator produces a fresh pair in seconds using your browser's built-in crypto.subtle API, exports them as standard PEM files, and lets you download or copy each key individually. Nothing is sent to a server at any point.

Pick a key size (2048, 3072, or 4096 bits), a hash algorithm (SHA-256 or SHA-512), and a usage pattern (encrypt/decrypt with OAEP, or sign/verify with PSS). Then click Generate Key Pair. Both keys appear immediately below in PEM format, ready to paste into OpenSSL, Node.js, Python, or any other toolchain that speaks standard PKCS#8 / SPKI.

The Controls: What Each Setting Does

• 2048-bit: the industry minimum for new deployments, accepted by all modern TLS and SSH stacks. Fast to generate.
• 3072-bit: recommended by NIST for keys expected to stay secure past 2030. A reasonable middle ground if performance is not a concern.
• 4096-bit: provides the most headroom against advances in factoring. Generation takes several seconds on older hardware.
• SHA-256 / SHA-512: the digest used internally by the OAEP or PSS scheme. SHA-256 is the standard default; SHA-512 pairs with larger key sizes for maximum security margin.
• Encrypt / Decrypt (OAEP): the public key encrypts, the private key decrypts. Use for securely transmitting a symmetric key, a secret, or a short message to the holder of the private key.
• Sign / Verify (PSS): the private key signs, the public key verifies. Use for proving authorship or integrity — JWTs, code signatures, document signing.

Output Format Notes

• The public key exports in SPKI (Subject Public Key Info) format, which is the standard for PEM public keys used by most libraries.
• The private key exports in PKCS#8 (unencrypted). If your application requires a passphrase-encrypted private key, wrap it with openssl pkcs8 -topk8 after downloading.
• The Download .pem button saves the key as a plain-text .pem file named rsa-2048-public.pem or rsa-2048-private.pem (with the chosen bit size in the filename). Click inside the textarea to select the full text for manual copying.
• OAEP and PSS keys are not interchangeable with each other or with PKCS#1 v1.5 keys, even at the same bit length. The scheme you select here must match what your application expects.

When Not to Use This Tool

• For TLS certificates, generate keys with openssl genrsa and a proper Certificate Authority workflow. Browser-generated keys cannot be embedded in a signed certificate without additional tooling.
• RSA encryption is not designed for large files. Use it to encrypt a short symmetric key (AES-256), then use that key to encrypt the file. The AES File Encryptor on this platform handles the symmetric half.
• If your library requires a passphrase-protected private key, the output here is unencrypted — add the passphrase with openssl pkcs8 -topk8 -in private.pem -out private-enc.pem.