ToolFeather
Developer / SEORuns in your browser

RSA Key Generator

Generate an RSA key pair in your browser and get it in every common format: OpenSSH for servers and GitHub, PEM (PKCS#8 and PKCS#1) for TLS and code, and JWK for web apps. The private key never leaves your device.

Quick presets

RSA Key Generator

3072 bits matches 128-bit security (NIST SP 800-57). 2048 is the minimum still accepted.

Keys are generated by your browser's Web Crypto API and never leave this page. Nothing is uploaded or stored. For long-lived server keys you can also run ssh-keygen on the machine that will use them.

Generated by your browser's Web Crypto API. Keys never leave this page.

ToolFeather · Web Crypto
Scratchpad auto-saved
Stored in this browser (localStorage)
Step-by-step~40s read

How it works — in four simple steps

No signup and nothing to install — it all runs in your browser.

1

Choose a key size

3072 bits is a good default.

2

Add a comment

Usually you@machine; it labels the SSH public key.

3

Generate

It takes a second or two for larger keys.

4

Copy or download

Pick the formats you need, then protect the private key.

Pro tip

Encrypt the private key with ssh-keygen -p -f id_rsa after saving it.

Features

2048, 3072 or 4096 bits

Generated by the browser's native Web Crypto API.

OpenSSH formats

Public key line plus openssh-key-v1 private key for ssh.

PEM formats

PKCS#8, SPKI and PKCS#1 (BEGIN RSA PRIVATE KEY) PEM.

JWK

Private and public JSON Web Keys.

Fingerprint

SHA-256 fingerprint as ssh-keygen shows it.

Sign and verify

Prove the pair works with a quick signature test.

About the RSA Key Generator

Keys are created by your browser's Web Crypto API (crypto.subtle.generateKey), the same native cryptography that secures HTTPS, using the operating system's secure random number generator and the standard public exponent 65537. Nothing is sent to a server. Choose 3072 bits for the 128-bit security level NIST recommends for use beyond 2030. 2048 bits is still widely accepted, and 4096 bits is slower to generate and use, for a modest margin.

The same key pair is shown in every format you're likely to need. The OpenSSH public key (ssh-rsa AAAA… comment) goes in ~/.ssh/authorized_keys or your GitHub/GitLab settings. The OpenSSH private key is the openssh-key-v1 format that ssh and ssh-keygen use. PKCS#8 (BEGIN PRIVATE KEY) and PKCS#1 (BEGIN RSA PRIVATE KEY) PEM files are for OpenSSL, TLS servers and most programming libraries, and JWK is for JOSE/JWT tools. The SHA-256 fingerprint matches what ssh-keygen -lf prints and what ssh shows on first connection.

The private keys aren't encrypted with a passphrase. Add one with ssh-keygen -p -f id_rsa after saving, and store the file with chmod 600. For new SSH keys, Ed25519 (in the ECDSA & Ed25519 generator) is shorter and faster. RSA remains the most compatible choice for older systems.

Frequently asked questions

5 answers
Is it safe to generate an SSH key in a browser?
The key is made by your browser's built-in Web Crypto API with the system's secure random generator and never leaves the page. For long-lived server keys, many admins still prefer running ssh-keygen on the machine that will use them, which works just as well.
Which RSA key size should I use?
3072 bits gives about 128-bit security, which NIST recommends for use past 2030. 2048 bits is still accepted almost everywhere, and 4096 adds margin at the cost of speed.
What's the difference between PKCS#1 and PKCS#8?
Both hold the same RSA key. PKCS#1 (BEGIN RSA PRIVATE KEY) is RSA-specific; PKCS#8 (BEGIN PRIVATE KEY) wraps any key type with an algorithm identifier. Modern tools prefer PKCS#8, and some older ones expect PKCS#1.
How do I use the key with GitHub?
Copy the OpenSSH public key (starts with ssh-rsa) into GitHub → Settings → SSH and GPG keys. Save the private key as ~/.ssh/id_rsa with chmod 600.
Can I add a passphrase?
Not in this tool. Run ssh-keygen -p -f id_rsa after saving the private key to encrypt it with a passphrase.