ECDSA / Ed25519 Key Generator

Generate an elliptic-curve public/private key pair in seconds — Ed25519, ECDSA on the NIST curves P-256, P-384 and P-521, or secp256k1 — and export it as PEM, JWK, or raw hex. Every key is created with a cryptographically secure random number generator right in your browser, so nothing you generate ever leaves your machine.

Elliptic-curve keys are the modern default for signing and authentication: they are far smaller than RSA keys at equivalent strength, faster to generate, and supported everywhere from JWT libraries to SSH, TLS, and blockchain wallets. This tool covers the algorithms you actually reach for — EdDSA (Ed25519) for new systems, ECDSA P-256/P-384/P-521 for JWT (ES256/ES384/ES512) and X.509, and secp256k1 (ES256K) for Bitcoin and Ethereum.

How to use it

1. Pick an Algorithm. Ed25519 is the best all-round modern choice. Choose P-256 if a JWT library or standard asks for ES256, P-384/P-521 for higher security levels, or secp256k1 for blockchain work.
2. Pick an Output format — PEM for tools like OpenSSL and most servers, JWK for JavaScript/JWT libraries, or raw hex for low-level work.
3. Click Generate key pair. You get the private key, the public key, and the public key's JWK thumbprint (a stable key ID / kid).
4. Copy or download each key with the buttons on its output box.

Which algorithm should I choose?

Use Ed25519 unless something forces your hand — it is fast, has short keys, and resists many implementation pitfalls of ECDSA. Choose P-256 when you need broad compatibility (it is the most widely supported ECDSA curve and maps to JWT's ES256). Step up to P-384 or P-521 when a compliance profile demands a larger curve. Pick secp256k1 only for Bitcoin/Ethereum-style signing.

What is the difference between PEM, JWK, and hex?

PEM wraps the key in Base64 with -----BEGIN … KEY----- headers using PKCS#8 (private) and SPKI (public) — the format OpenSSL, most web servers, and SSH tooling expect. JWK is a JSON object used directly by JOSE/JWT libraries. Raw hex is just the key bytes (the private scalar/seed and the public point), for low-level cryptographic code.

What is the JWK thumbprint?

It is the RFC 7638 thumbprint of the public key: a SHA-256 hash of the key's canonical JSON, encoded as base64url. It gives you a compact, deterministic identifier for the key — commonly used as a JWK kid.

Are these keys safe to use in production?

Yes. Key material is generated with @noble/curves, an audited, widely used elliptic-curve library, seeded from your platform's secure random source. The output is standards-conformant and round-trips cleanly through OpenSSL and Web Crypto.

Privacy

Everything happens locally — key generation runs entirely in your browser and no key material is ever sent to a server or logged. Still, treat the private key like a password: never commit it to source control or paste it into services you do not trust. The PEM/JWK/hex output is unencrypted, so if you need protection at rest, encrypt the file yourself (for example, openssl pkcs8 -topk8 -in key.pem -out key.enc.pem).