Key Pair Generator (RSA, ECDSA, Ed25519)
Generate an RSA (2048–4096), ECDSA (P-256, P-384, P-521) or Ed25519 key pair in your browser. Get PEM, JWK and an OpenSSH public key with its fingerprint. Free.
How to use Key Pair Generator
- 1Pick RSA, ECDSA or Ed25519, then a key size or curve (RSA 3072 or ECDSA P-256 are good defaults).
- 2Press Generate key pair. RSA 4096 can take a few seconds, and the page keeps working meanwhile.
- 3Copy or download the public key, the private key (hidden until you press Show) and the OpenSSH line. Press Clear keys when finished.
What makes it better
- RSA 2048, 3072 and 4096 bits, ECDSA P-256, P-384 and P-521, and Ed25519 where the browser supports it
- PKCS#8 private key and SPKI public key in PEM, plus JWK for both
- OpenSSH public key line and SHA256 fingerprint, built from the standard SSH wire format
- Private key hidden by default, with Show, Copy, Download and Clear keys
- Keys exist only in the page: nothing is stored, logged or sent
About Key Pair Generator
Key Pair Generator creates a public and private key in your browser using Web Crypto and the platform's secure random generator. The private key is exported as PKCS#8 PEM, the public key as SPKI PEM, and both are also available as JWK. RSA, ECDSA and Ed25519 keys also get an OpenSSH public key line with its SHA256 fingerprint, ready for authorized_keys.
Common uses
- Create a throw-away key pair to test signing, verification or JWT code.
- Make a public key line to add to a server's authorized_keys while experimenting.
- Produce PEM and JWK keys for a test certificate request, webhook signing or API sandbox.
- Learn how key size, curve and key formats differ before choosing for a real project.
Example
Input
RSA 2048 / ECDSA P-256 / Ed25519 …
Result
-----BEGIN PUBLIC KEY-----
Good to know
- Keys are made in your browser with the platform's secure random generator. For keys that guard something valuable, prefer a hardware-backed key or an offline process over any web page.
- The PEM and JWK private keys are not encrypted: there is no passphrase, so anyone who obtains the file can use the key. Store it in a secrets manager or a protected file.
- RSA at 3072 bits or more, ECDSA P-256 and Ed25519 are the usual recommendations today. Ed25519 depends on browser support and is hidden or disabled where Web Crypto lacks it.
Key Pair Generator FAQ
Which key type should I choose: RSA, ECDSA or Ed25519?
Ed25519 and ECDSA P-256 give short keys, fast signatures and strong security, so they suit most new projects. RSA is the most widely supported, particularly on older systems; use 3072 bits or more if compatibility requires it.
What is the difference between PEM and JWK?
PEM wraps the binary DER key in Base64 with BEGIN and END lines and is what OpenSSL and most servers read. JWK describes the same key as a JSON object, which JWT and JOSE libraries expect.
How do I use the OpenSSH public key line?
Append the whole line to ~/.ssh/authorized_keys on the server you want to log in to. The SHA256 fingerprint shown next to it is the same value that ssh-keygen -l prints, so you can confirm you copied the right key.
Why does RSA 4096 take so long to generate?
RSA needs two very large random prime numbers, and finding them takes time that grows quickly with key size. 4096 bits can take several seconds on a phone, while ECDSA and Ed25519 keys appear instantly.
Is it safe to generate a production private key on a website?
Treat it with caution. Generation here runs in your browser and nothing is transmitted, but a compromised browser, extension or clipboard could still expose the key. For high-value keys use a hardware token, a key management service or an offline machine.