01
Choose purpose before generation
RSA signing and RSA encryption use different Web Crypto usages; EC signing and agreement also differ. The purpose is chosen before a new pair is made.
- Changing the purpose makes the old result stale.
Hash & Crypto Helpers
key pair generatorRSA and EC test keys
Generate a test pair or inspect one existing key. Choose RSA or EC, then export the public and private halves separately.
key pair generator
Input or selection
Choose the algorithm and purpose below, then generate explicitly. No key is created on page load.RSA · 2048 · Signing · PEM
Key output
No key yet.
Keys stay in this tab; nothing is uploaded or saved. Use disposable test keys.
No key yet.
When an API demo needs a fresh signing key, a key pair generator is quicker than switching between OpenSSL flags and format converters. You can see exactly which half is shareable.
This key pair generator keeps a generated pair in this tab while you compare PEM and JWK. Its viewer accepts one existing RSA or EC key and extracts only the public half from a private input.
Why use this key pair generator
The same material stays together, even when its container changes.
One pair, two export formats
This key pair generator re-encodes the same matching keys when you switch PEM and JWK; it does not silently create a new private key.
Inspect before sharing
Paste one private PEM or JWK to obtain its public half. The derived output is separate, and generated private material stays covered until you reveal it.
Know what changes before you export
02
Switch the container, not the pair
After generation, PEM and JWK are views of the same in-memory key pair. PEM public output is SPKI; private output is unencrypted PKCS8.
- A format switch does not roll new randomness.
03
Check the export boundary
Public and private downloads are separate actions. Inspect accepts one pasted key; Ctrl/Cmd+Enter runs the current action.
- The private display starts hidden, but copying it is an explicit action.
What the workbench actually handles
RSA and EC choices
Choose RSA 2048, 3072 or 4096 bits, or EC P-256, P-384 or P-521; the RSA public exponent stays at 65537.
PEM and JWK outputs
Get distinct SPKI public and PKCS8 private PEM files, or public and private JWK JSON for a test integration.
Single-key viewer
Inspect one RSA or EC public or private PEM/JWK; a private input can yield its matching public representation.
Secret-aware controls
Private output is covered by default; changed settings disable exports of the older result.
Limits that affect your test keys
- Test material, not production custody
- This key pair generator keeps keys only in tab memory. A production secret belongs in a controlled host, HSM or approved key manager, not a web page or clipboard.
- Standard containers only
- The viewer accepts SPKI PUBLIC KEY, unencrypted PKCS8 PRIVATE KEY and one RSA/EC JWK. It rejects PKCS1, OpenSSH, encrypted keys and multi-key JWKS.
- No weak RSA presets
- The smallest RSA choice is 2048 bits. This page does not generate 512/1024-bit keys or arbitrary lengths.
- Secure context required
- Generation and inspection require Web Crypto in a trusted HTTPS or local context; there is no server or Math.random fallback.
- No cryptographic operations on messages
- The output identifies a key pair; the page does not sign a JWT, create a certificate, publish JWKS or encrypt a payload.
Key pair generator FAQ
Is it safe to generate a private key on a website?
The browser runs Web Crypto locally, but extensions, clipboard history and downloaded files still matter. Use this page for disposable development keys; create production keys where they will be used.
What is the difference between PEM and JWK output?
PEM is a text wrapper around the SPKI public or unencrypted PKCS8 private key. JWK stores key fields as JSON. Both exports describe the same generated pair; choose the format your test system accepts.
How do I get a public key from a private key?
In Inspect mode, paste one RSA private PEM or JWK and run inspection. The public output is derived locally; a public input cannot be reversed into a private key.
Can I use these keys to sign JWTs?
Compatible JWT libraries can use these RSA or EC keys, but this page does not sign or verify tokens. Keep the private half with the signer and share only the public half.
Can this generate an SSH key?
This page exports SPKI and PKCS8 PEM or JWK, not the OpenSSH public-key line or private-key file expected by SSH tools. Use an SSH key generator when you need authorized_keys or an SSH identity.
Still have a key-format question?
Use the key pair generator
Make a disposable test pair, or inspect one existing key before sharing its public half. The key pair generator leaves export decisions in your hands.
Generated secrets stay in this tab until you leave.