RSA Key Generator

Generate a fresh RSA public/private key pair in PEM format — the standard for SSH, TLS/SSL certificates, JWT signing, PGP and countless other systems. Pick a key size, generate, and copy or download each key.

What is an RSA key pair?

RSA is a public-key (asymmetric) cryptosystem: you get two mathematically linked keys. The public key can be shared freely — others use it to encrypt messages to you or to verify your signatures. The private key stays secret — you use it to decrypt those messages or to sign. Anything encrypted with one key can only be undone with the other.

Which key size should I choose?

• 2048-bit — the modern minimum and the right default for almost everything. Fast, widely compatible, and considered secure well into the future.
• 3072-bit — a stronger middle ground, sometimes required by stricter compliance profiles.
• 4096-bit — the strongest option here. Noticeably slower to generate and to use for every operation, with a security margin most applications don't need. Choose it only when a policy demands it.

1024-bit keys are deliberately not offered — they're below today's security minimum and shouldn't be generated for any new use.

What format are the keys in?

Standard PEM — the -----BEGIN PUBLIC KEY----- / -----BEGIN PRIVATE KEY----- text blocks. The public key is SPKI-encoded and the private key is PKCS#8, the current defaults understood by OpenSSL, OpenSSH (via ssh-keygen/ssh-import), Node.js, Python, Java and virtually every crypto library.

How do I use the keys?

Save the private key to a file (e.g. private.pem) and keep it secret and backed up — if you lose it, anything it protected is unrecoverable; if it leaks, your security is gone. Share or deploy the public key wherever it's needed. For SSH, most systems expect the public key in OpenSSH format — convert with ssh-keygen -y -f private.pem.

Is this secure — where are the keys generated?

The pair is generated on the server, freshly, for your request, using Node.js's audited native crypto (the same OpenSSL underneath OpenSSH), and returned to you over HTTPS. The keys are not stored or logged. Still, for the highest-assurance keys — production CA roots, long-lived signing keys — generate them yourself on an offline machine with openssl genpkey; a private key that has crossed any network should be treated as lower-assurance.

Why does generation take a moment?

Creating an RSA key means finding two large random prime numbers, which is genuinely CPU-intensive — more so as the key size grows. A 4096-bit key can take a second or more. This is normal, and the reason the tool generates on demand rather than as you type.