More
More
RSA Key Pair Generator
Public and private keys, generated in your browser.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
Keep the private key secret. To protect it with a passphrase, run openssl pkey -in private.pem -aes256 -out private-encrypted.pem. OpenSSH 7.8 and later reads this PEM format directly, for example with ssh -i private.pem.
Good for testing, learning and personal use. Keys made in a browser use the browser's own cryptographic random generator and are sound, but for servers, certificates and production systems, generate keys on the machine that will use them (for example with ssh-keygen or openssl) so the private key never exists anywhere else.
Keys are generated with your browser's Web Crypto API and never leave this page. RSA keys use the public exponent 65537. The public key is given as PEM (SubjectPublicKeyInfo) and in the one line OpenSSH format, with its SHA-256 fingerprint as ssh-keygen -l shows it.
How to use it
- Choose RSA or elliptic curve, and the key size or curve. RSA 3072 or ECDSA P-256 are sensible defaults.
- Press Generate key pair. RSA 4096 can take a few seconds.
- Copy or download the public and private keys. The OpenSSH line goes into ~/.ssh/authorized_keys on a server.
Questions
Which key size should I choose?
RSA 2048 is still accepted but is the minimum; 3072 is recommended for anything meant to last past 2030. ECDSA P-256 gives similar strength to RSA 3072 with much shorter keys and faster signing.
What is the difference between PEM and OpenSSH formats?
PEM is the Base64 text block between BEGIN and END lines used by OpenSSL, web servers and most libraries. The OpenSSH public key format is the single line starting ssh-rsa or ecdsa-sha2 that SSH servers read from authorized_keys.
Why is there no Ed25519 option?
Ed25519 is only available in the newest browsers' Web Crypto, so results would vary by browser. For an Ed25519 SSH key, run ssh-keygen -t ed25519 on your own computer.
Is the private key encrypted?
No. It is a plain PKCS#8 key, which is what most tools expect when importing. Add a passphrase with the openssl command shown under the key before you store it anywhere shared.
About this tool
About the key pair generator
Public key cryptography uses two keys that belong together: a private key you keep secret and a public key you can hand out. They are used for SSH logins, signing tokens, TLS certificates and encrypting data for one recipient. This tool creates a fresh pair with your browser's built-in Web Crypto engine.
Options
- RSA at 2048, 3072 or 4096 bits, with the public exponent 65537. 3072 is a sensible default for keys meant to last; 4096 can take a few seconds to generate.
- Elliptic curve (ECDSA) on the P-256 or P-384 curve. P-256 gives strength similar to RSA 3072 with much shorter keys and faster signing.
Formats you get
The public key comes as a PEM block, the format OpenSSL and most libraries read, and as a single OpenSSH line that goes into ~/.ssh/authorized_keys on a server, with its SHA-256 fingerprint as ssh-keygen shows it. The private key is a plain PKCS#8 PEM file. It is not encrypted, so add a passphrase with the openssl command shown before storing it anywhere shared.
Ed25519 is not offered because only the newest browsers support it. For an Ed25519 SSH key, run ssh-keygen on your own computer.
Keys are generated on your device and never leave the page.
Related tools
- Hash Generator & File ChecksumSHA and MD5 hashes of text or files, HMAC signatures, and checking a download against its published checksum.
- Bcrypt Generator & VerifierHash a password with bcrypt or check one against a hash.
- JWT Decoder & EncoderRead a JSON Web Token, check an HS256 signature or sign a test token.
- Base64 Encode & DecodeEncode and decode Base64 text.
- Chmod CalculatorUnix file permissions in numbers and letters.