RSA and ECDSA Key Pair Generator
Generate an RSA 2048, 3072 or 4096-bit or ECDSA P-256 or P-384 key pair in the browser, as PKCS#8 and SPKI PEM files and a JWK.
Free · No sign-up · Your inputs stay in your browser
Input
Generate an RSA or ECDSA key pair
Output
Press Generate
Generated by the browser's Web Crypto API and never sent anywhere. The private key is PKCS#8 and the public key SPKI, the formats openssl, Laravel Passport (oauth-private.key), Node's crypto and JWT libraries for RS256/ES256 read. The private key is not encrypted: store it as a secret.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What the formats are
-----BEGIN PRIVATE KEY----- is PKCS#8, which holds any algorithm's private key; -----BEGIN PUBLIC KEY----- is SPKI. OpenSSL, Node's crypto.createPrivateKey(), PHP's openssl_pkey_get_private() and JWT libraries for RS256 and ES256 read both. The older BEGIN RSA PRIVATE KEY (PKCS#1) holds RSA only; openssl pkey -in key.pem -traditional converts if a tool insists on it.
Which size
RSA 2048 is the minimum NIST SP 800-57 accepts through 2030; 3072 matches 128-bit security. ECDSA P-256 gives the same security as RSA 3072 with much smaller keys and faster signatures, which is why it is the common choice for new JWT signing keys.
Keep the private key secret
The private key is not encrypted. Store it in a secret manager or with file permissions 600, and to protect it with a passphrase use openssl pkcs8 -topk8 -v2 aes-256-cbc -in key.pem -out key.enc.pem.