Generate an RSA key pair locally with the RSA Key Generator — SPKI public key and PKCS#8 private key as PEM, never leaving your browser.
What a key pair actually is
An asymmetric key pair is two mathematically linked values: a public key you can share freely, and a private key that must stay secret.
With encryption, the public key locks data and only the private key unlocks it. With signatures, the private key signs and anyone with the public key can verify. The roles never swap — sharing a private key breaks the model.
Key size: security margin versus speed
RSA key size means the modulus length in bits. 2048 bits is the long-standing common minimum and is still broadly supported; 3072 and 4096 add security margin at the cost of slower key generation and operations.
NIST guidance treats 2048-bit keys as acceptable for use through the current transition period, with 3072-bit keys recommended for security lifetimes beyond 2030. Match the size to the sensitivity and lifetime of the data.
PEM: the plain-text armor
PEM wraps DER-encoded key bytes in base64 between header lines. The header tells you what is inside:
`-----BEGIN PUBLIC KEY-----` is an SPKI SubjectPublicKeyInfo, the standard interchange format for public keys. `-----BEGIN PRIVATE KEY-----` is PKCS#8, the recommended container for private keys — it includes the algorithm identifier.
You may also see `-----BEGIN RSA PRIVATE KEY-----`, the older PKCS#1 format. Prefer PKCS#8 for new work.
-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...-----END PUBLIC KEY-----Why generate in the browser
The Web Crypto API generates keys using the operating system's secure random source, inside your browser session.
That means the private key is created on your device and never has to cross a network. A local generator removes a whole class of exposure compared with services that generate keys on their servers — where the private key exists, at least briefly, outside your control.
Storing private keys like credentials
A private key is equivalent to a password: anyone who holds it can impersonate you for the operations it authorizes.
Store it encrypted at rest, back it up in a location you control, restrict access, and rotate it on a schedule. If you suspect exposure, generate a new pair and retire the old one.
Never paste a private key into a web form, chat, or 'verification' service — legitimate services never need to see your private key.
Warning: Copy the private key into the tool once, generate, and close the tab. Treat any export — this page, a file, a clipboard — as an exposure event you should account for.
A key-generation workflow
- Choose a key size: 2048 for compatibility, 3072 or 4096 for more margin.
- Generate the pair and copy or download both PEM files.
- Store the private key offline and encrypted; keep the public key in the systems that need it.
- Record when the key was created and set a rotation reminder.
- Destroy any copies in temporary locations such as clipboards or scratch files.
FAQ
Q.Are the keys really generated locally?
A.Yes. The Web Crypto API generates the pair inside your browser with the secure random source of your device. No network request is involved.
Q.Which algorithm does the generator use?
A.RSA-OAEP with SHA-256, exported as an SPKI public key and a PKCS#8 private key in PEM. These are widely supported interchange formats.
Q.Should I choose 2048, 3072, or 4096?
A.2048 is the common minimum and broadly compatible; 3072 is recommended for data that must stay secure beyond 2030; 4096 adds more margin but costs speed. Choose based on sensitivity, lifetime, and the performance constraints of your environment.
References
This guide is based on the following standards and guidance:
- RFC 8017 – PKCS #1: RSA Cryptography Specifications: https://www.rfc-editor.org/rfc/rfc8017
- RFC 5280 – X.509 Public Key Infrastructure (SPKI format): https://www.rfc-editor.org/rfc/rfc5280
- NIST SP 800-57 Part 1 Rev. 5 – Recommendation for Key Management: https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
- NIST FIPS 186-5 – Digital Signature Standard: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf
Generate a key pair now
RSA-OAEP key pairs as PEM, generated locally in your browser — private key included, never uploaded.
The key is only as safe as its storage
Generating a key pair is seconds of work. Protecting the private key is a lifetime habit: encrypted storage, restricted access, rotation, and never pasting it into online forms.
Generate yours locally with the RSA Key Generator and store the private key before you need it.