BYTETOOLS

RSA Key Pair Generator

Generate an RSA public and private key pair at 2048, 3072 or 4096 bits, exported as PEM and JWK. Created in your browser and never uploaded.

Keys are created by your browser's Web Crypto engine and stay on this device. Nothing is sent anywhere — but for that same reason, a lost private key cannot be recovered.

What is the RSA Key Pair Generator?

An RSA key pair generator creates a matching public and private key: the public key can be shared so anyone can verify your signatures or encrypt to you, while the private key stays secret and does the signing or decrypting.

  • 2048, 3072 and 4096-bit RSA keys with the standard 65537 exponent
  • PEM output in SPKI (public) and PKCS#8 (private) formats
  • JWK output for JOSE, JWT and WebCrypto workflows
  • Signing (RSASSA-PKCS1-v1.5, RSA-PSS) and encryption (RSA-OAEP) key types
  • One-click copy and .pem download for each key
  • Runs entirely offline in your browser — no key ever leaves the device

How to use the RSA Key Pair Generator

  1. 1

    Choose whether the key is for signing (RSASSA-PKCS1-v1.5 or RSA-PSS) or encryption (RSA-OAEP).

  2. 2

    Pick a key size — 2048 bits is the common default, 4096 is slower but stronger.

  3. 3

    Select the hash algorithm the key will be bound to, usually SHA-256.

  4. 4

    Click Generate key pair and wait for the browser to finish the maths.

  5. 5

    Copy or download the public and private PEM files, and store the private key somewhere safe.

About the RSA Key Pair Generator

The ByteTools RSA Key Pair Generator creates a fresh public and private key using your browser's built-in Web Crypto engine. Choose 2048, 3072 or 4096 bits, pick whether the key is for signing or for encryption, and get the result as a standard PEM block plus the equivalent JWK.

Developers reach for this when they need an RS256 signing key for JSON Web Tokens, a key pair for an API integration, or a throwaway pair for a local test. The public key comes out in SubjectPublicKeyInfo form and the private key in PKCS#8, which is what OpenSSL, Node.js, Java and most libraries expect.

Generation happens entirely on your device. No key material is uploaded, logged or stored anywhere, and nothing is kept after you close the tab — so copy or download both files before you leave. A 4096-bit key can take several seconds to produce, which is normal.

Frequently asked questions

Is it safe to generate an RSA key in a browser?

The maths is done by the Web Crypto API, the same audited implementation your browser uses for HTTPS, and the key never leaves your machine. The real risk is the device itself — generate production keys on a trusted, malware-free computer, and treat anything made on a shared machine as disposable.

Should I use a 2048-bit or 4096-bit RSA key?

2048 bits is still considered secure and is what most systems default to, with much faster signing and verification. Choose 4096 bits when a policy demands it or the key must stay trustworthy for a decade or more, and accept that generation takes several seconds.

What is the difference between RSASSA-PKCS1-v1.5 and RSA-PSS?

Both are signature schemes. PKCS#1 v1.5 is the older, deterministic padding that JWT's RS256 uses and that almost everything supports. RSA-PSS adds randomised padding and has a stronger security proof, and it is what the PS256 JWT algorithm uses.

Can I convert this key to the older 'BEGIN RSA PRIVATE KEY' format?

Not here. This tool emits PKCS#8, the modern container that starts with BEGIN PRIVATE KEY. If a legacy tool insists on the PKCS#1 form, convert it locally with openssl rsa -in private.pem -traditional.

Can I recover the private key if I lose it?

No. Nothing is stored on our side, and the key is not derived from anything reproducible — it comes from your browser's random number generator. If you close the tab without saving it, that key is gone and you simply generate a new pair.

Related tools