Key Pair Generator
RSA and elliptic curve pairs in PEM or JWK, generated by your browser's own WebCrypto.
How to Use
- 1. Choose elliptic curve or RSA, and whether the key is for signing or encryption.
- 2. Pick a curve or modulus size.
- 3. Generate the pair — this happens entirely in your browser.
- 4. Copy or download the public and private keys in PEM or JWK format.
Choosing Between RSA and Elliptic Curve
For anything new, pick elliptic curve. A P-256 key offers roughly the same security as a 3072-bit RSA key while being a fraction of the size, faster to generate, and faster to sign with. RSA remains worth choosing only when something in your stack requires it — which is still common with older systems, some hardware, and a few JWT libraries.
Signing and encryption are genuinely different jobs and use different algorithms: ECDSA and RSASSA-PKCS1-v1_5 for signatures, ECDH and RSA-OAEP for confidentiality. Reusing one key pair for both is a real weakness rather than a stylistic preference, which is why the purpose is chosen before generation here and the algorithm follows from it.
On formats: PEM wraps the DER-encoded key in base64 between armour lines, using SPKI for public keys and PKCS#8 for private. That is what TLS, OpenSSL and most libraries expect. JWK is the JSON form used by JWT and OAuth tooling — if you are publishing a JWKS endpoint or configuring token verification, JWK is what you want.
One caveat worth being direct about. The randomness here comes from the browser's own cryptographic generator through WebCrypto, which is the same primitive a native tool uses, and nothing is transmitted. Even so, for a production signing key or a server host key, generate it on the machine that will hold it. And note these are not SSH keys — OpenSSH uses its own format, so for SSH just run ssh-keygen.
Related: JWT Decoder, Hash Generator, and Password Generator.
Frequently Asked Questions
Are these keys safe to use?
The randomness comes from the browser’s own cryptographic generator via WebCrypto, which is the same primitive a native tool would use, and nothing is transmitted. For high-value keys — a production signing key, a server host key — generate on the machine that will hold the key, with a tool you control end to end.
Should I choose RSA or elliptic curve?
EC for anything new. A P-256 key gives roughly the security of a 3072-bit RSA key while being a fraction of the size and much faster to generate and use. Choose RSA only when something in your stack requires it, which is still common with older systems and some JWT libraries.
What is the difference between signing and encryption keys?
Signing proves who produced something; encryption keeps it secret. They use different algorithms — ECDSA and RSASSA for signatures, ECDH and RSA-OAEP for confidentiality — and reusing one key for both purposes is a genuine weakness, so the purpose is selected up front here.
Can I use these as SSH keys?
Not directly. These are PKCS#8 and SPKI in PEM form, which is what TLS, JWT and most libraries expect. OpenSSH uses its own key format, so you would need to convert with ssh-keygen — for SSH specifically it is simpler and safer to run ssh-keygen directly.
What is JWK format for?
JSON Web Key, the format used by JWT and OAuth tooling. A JWKS endpoint publishes public keys this way so clients can verify tokens. If you are working with JWTs, JWK is usually what your library wants.
Was this tool helpful?
More Tools
Related Security
TOTP Generator
File Checksum Verifier
Barcode Generator
QR Code Scanner
You Might Also Like