Is this actually secure, or just a demo?

The keys are generated with the browser's native Web Crypto API (crypto.subtle.generateKey), the same underlying implementation browsers use for real TLS and WebAuthn operations, not a JavaScript reimplementation. That said, generating a private key in a browser tab and copying it out means it briefly existed in that tab's memory; for production certificate authorities or long-lived infrastructure keys, generating on an offline, dedicated system is still the more conservative choice.

Should I choose RSA or ECDSA?

ECDSA (particularly P-256) produces much smaller keys and signatures for equivalent security, and is the modern default for new systems, TLS, SSH, and most protocols now prefer it. RSA remains widely supported by older systems and is still the safer choice when you know a specific downstream system requires it.

What do the exported PEM blocks actually contain?

The public key is exported in SPKI (SubjectPublicKeyInfo) format, and the private key in PKCS8 format, both DER-encoded and then base64-wrapped with standard PEM headers/footers, the same formats OpenSSL and most TLS/SSH tooling expect.

Does this tool store or transmit the generated keys?

No. Generation and export both happen entirely in your browser via the Web Crypto API; nothing is logged, cached, or sent anywhere.

RSA/ECDSA Key Generator - Generate a PEM Key Pair

Overview

Introduction

Generating a real key pair usually means reaching for OpenSSL or `ssh-keygen` on the command line, which is fine until you just need a quick throwaway pair for testing.

This tool generates an RSA or ECDSA key pair with the browser's native Web Crypto API and exports both keys as standard PEM, entirely client-side.

What Is RSA/ECDSA Key Generator?

A key pair generator supporting RSA (2048/3072/4096-bit, RSASSA-PKCS1-v1_5 with SHA-256) and ECDSA (P-256/P-384/P-521 curves), both generated with `crypto.subtle.generateKey()`.

Both keys export as standard PEM: the public key in SPKI format, the private key in PKCS8 format, matching what OpenSSL and most TLS/SSH/JWT tooling expect.

How RSA/ECDSA Key Generator Works

Your chosen algorithm and parameters are passed directly to the Web Crypto API's `generateKey()`, which produces an extractable `CryptoKeyPair` using the browser's native (often hardware-backed) cryptographic implementation.

Both keys are then exported with `exportKey()` (`spki` for the public key, `pkcs8` for the private key), producing DER bytes that are base64-encoded and wrapped with standard PEM headers, line-wrapped at 64 characters per RFC 7468 convention.

When To Use RSA/ECDSA Key Generator

Use it to generate a throwaway key pair for local development, testing a JWT signing flow, or experimenting with a protocol that needs a key pair, without installing OpenSSL.

It's also useful for quickly comparing RSA and ECDSA key/output sizes side by side.

Often used alongside SSL Certificate Decoder & Inspector, CSR Decoder and JWT Builder.

Features

Advantages

Uses the browser's native Web Crypto implementation, not a JavaScript reimplementation of RSA or ECDSA math.
Exports directly to standard PEM, ready to paste into OpenSSL, a JWT library, or any tool expecting SPKI/PKCS8 PEM.
Supports both RSA and ECDSA with several common parameter choices, covering most everyday use cases in one tool.

Limitations

Doesn't generate a full X.509 certificate or CSR, only a raw key pair; use the CSR Decoder or an external CA workflow for those.
A key generated in a browser tab exists briefly in that tab's memory before you copy it out; for long-lived production infrastructure keys, an offline, dedicated key-generation environment is still the more conservative choice.

Examples

Generating a P-256 ECDSA key pair

Input

algorithm: ECDSA, curve: P-256

Output

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE...
-----END PUBLIC KEY-----

A P-256 public key exports to a compact SPKI PEM block, notably shorter than an equivalent-strength RSA public key.

Best Practices & Notes

Best Practices

Prefer ECDSA (P-256) for new systems unless a specific downstream requirement mandates RSA.
Treat any private key generated here as sensitive the moment it's created, don't paste it somewhere insecure, and discard it when you're done testing.
Use RSA-3072 or RSA-4096 instead of RSA-2048 for anything intended to remain secure for many years, since 2048-bit RSA's long-term margin is narrower than the larger sizes.

Developer Notes

RSA keys use `RSASSA-PKCS1-v1_5` with a fixed public exponent of 65537 (`0x010001`) and SHA-256; ECDSA keys use the browser's native curve implementations for P-256/P-384/P-521. Both key types are generated as `extractable: true` so they can be exported; PEM wrapping is a plain base64-encode-and-line-wrap of the exported DER bytes, matching RFC 7468's textual encoding conventions.

RSA/ECDSA Key Generator Use Cases

Generating a throwaway key pair for local development or testing
Producing keys to test a JWT RS256/ES256 signing and verification flow
Comparing RSA and ECDSA key and signature sizes for the same security level

Common Mistakes

Using a generated key pair for production infrastructure without considering that it briefly existed in browser tab memory during generation.
Choosing RSA-2048 by default when ECDSA P-256 offers equivalent modern security with a much smaller key and faster operations.

Tips

Use the CSR Decoder afterward if your next step is generating a certificate signing request from this key pair with OpenSSL.

RSA/ECDSA Key Generator