RSA Key Pair Generator
Generate RSA public and private key pairs instantly in your browser. Supports 512–8192 bit key lengths, PEM format (PKCS#8 / X.509). Compatible with OpenSSL, SSH, JWT, and SSL/TLS. No login required. Keys never leave your browser.
Default: 2048 bits
PEM Key Validation
Paste a PEM public/private key and verify whether it is valid.
How to use
About this tool
Use this RSA key pair generator when you need a public and private key for development, SSH, TLS, or JWT experiments. Choose a key size such as 2048-bit for everyday testing or 4096-bit when you want a stronger pair, then export PEM suitable for OpenSSL-style workflows (PKCS#8 private key and X.509 public key). Generation runs entirely in your browser. Your keys are created on your device and are not uploaded to Handy Dev Tools servers—important when you are handling private material, even in non-production use. The tool is free and does not require an account. Treat generated keys as development credentials unless you follow your own secure key-management process. Prefer 2048-bit or higher for realistic testing, and keep private keys out of source control and shared chats.
How to use
1. When you open the page, a key pair is automatically generated with the default (2048 bits), and the public and private keys are displayed. 2. To change key length: Enter a value that is a multiple of 8 between 512 and 8192 bits in the key length field, then click "Generate". 3. To generate a new key pair with the same key length: Click the "Regenerate" button. 4. Copy keys: Click the copy button in each key's display area to copy to the clipboard. 5. Download keys: Click the download button in each key's display area to download as a PEM file (public key: public_key.pem, private key: private_key.pem).
Options
Key length: Must be between 512 and 8192 bits and a multiple of 8. Default is 2048 bits. Use the up/down buttons in the number input to increment/decrement by 8. Invalid values (out of range or not a multiple of 8) show an error message and disable the "Generate" and "Regenerate" buttons.
Use cases
• Generating key pairs for SSH connections (public key authentication setup) • Creating private keys for SSL/TLS certificates • Generating key pairs for JWT signing • Creating key pairs for encrypted communication • Temporary key pair generation for development and testing • Generating key pairs for code signing
Code Examples
1// Generate key pair
2const keyPair = await window.crypto.subtle.generateKey(
3 {
4 name: 'RSA-OAEP',
5 modulusLength: 2048,
6 publicExponent: new Uint8Array([1, 0, 1]), // 65537
7 hash: 'SHA-256',
8 },
9 true, // extractable
10 ['encrypt', 'decrypt']
11);1from cryptography.hazmat.primitives.asymmetric import rsa
2from cryptography.hazmat.primitives import serialization
3
4# Generate key pair
5private_key = rsa.generate_private_key(
6 public_exponent=65537,
7 key_size=2048
8)
9public_key = private_key.public_key()
10
11# Export in PEM format
12private_pem = private_key.private_bytes(
13 encoding=serialization.Encoding.PEM,
14 format=serialization.PrivateFormat.PKCS8,
15 encryption_algorithm=serialization.NoEncryption()
16)
17public_pem = public_key.public_bytes(
18 encoding=serialization.Encoding.PEM,
19 format=serialization.PublicFormat.SubjectPublicKeyInfo
20)1# Generate 2048-bit RSA private key
2openssl genrsa -out private_key.pem 2048
3
4# Extract public key
5openssl rsa -in private_key.pem -pubout -out public_key.pem1# PEM → OpenSSH public key conversion
2ssh-keygen -f public_key.pem -i -m PKCS8
3
4# Fingerprint / integrity check
5openssl rsa -in private_key.pem -check
6
7# Create CSR from private key
8openssl req -new -key private_key.pem -out csr.pem1$config = [
2 'private_key_bits' => 2048,
3 'private_key_type' => OPENSSL_KEYTYPE_RSA,
4];
5$key = openssl_pkey_new($config);
6openssl_pkey_export($key, $privatePem);
7$details = openssl_pkey_get_details($key);
8$publicPem = $details['key'];
9
10// openssl_pkey_export may emit PKCS#1 (BEGIN RSA PRIVATE KEY)
11// depending on OpenSSL/PHP. This tool exports PKCS#8 (BEGIN PRIVATE KEY).1// .env — store file paths, never paste PEM contents
2// JWT_ALGO=RS256
3// JWT_PRIVATE_KEY=file:///var/www/certs/private_key.pem
4// JWT_PUBLIC_KEY=file:///var/www/certs/public_key.pem
5
6// Laravel Passport
7// php artisan passport:keys
8// Or copy this tool's PEM to storage/oauth-private.key
9// and storage/oauth-public.keyHow it works
RSA key pair generation prioritizes the Web Crypto API. If Web Crypto API is unavailable or PEM conversion fails, it falls back to the node-forge library. Keys are PEM: private keys in PKCS#8 (-----BEGIN PRIVATE KEY-----), public keys as X.509 SubjectPublicKeyInfo (-----BEGIN PUBLIC KEY-----). Larger key lengths take longer to generate, but a 2048-bit key pair typically completes within 5 seconds. All processing is done in the browser; keys are never sent to any server.
Privacy and data
All key generation is done in the browser; generated public and private keys are never sent to any server. Keys exist only in browser memory and are not automatically saved. Private keys are sensitive — manage them carefully and clear them from memory (e.g., close the browser) when done. Do not paste private keys into FAQ answers, chat, or source code. For production, prefer generating keys in a secure, isolated environment when possible.
FAQ
- Q: What is an RSA key pair?
- A: An RSA key pair is a public key and a matching private key used for encryption, signing, SSH, TLS, and JWT. The public key can be shared; the private key must stay secret.
- Q: Which key size should I use?
- A: Use 2048-bit for general development and testing. Prefer 4096-bit when you need stronger security. Avoid very small sizes (e.g. 512) outside of legacy experiments.
- Q: Are my keys uploaded to a server?
- A: No. Generation runs in your browser. Keys are not sent to Handy Dev Tools servers.
- Q: What formats can I export?
- A: PEM output suitable for OpenSSL-style workflows (PKCS#8 private key / X.509 public key). Copy or download for local use.
- Q: Is this free?
- A: Yes. No registration required.
- Q: How do I generate the same key pair in PHP?
- A: Use openssl_pkey_new() with OPENSSL_KEYTYPE_RSA and a modulus length such as 2048, then openssl_pkey_export() for the private key and openssl_pkey_get_details() for the public key. See the PHP code example on this page. Note that openssl_pkey_export() may emit PKCS#1 (BEGIN RSA PRIVATE KEY) depending on OpenSSL/PHP, while this tool exports PKCS#8 (BEGIN PRIVATE KEY). Both are widely accepted.
- Q: Can I use these keys with Laravel JWT or Passport?
- A: Yes for development. This tool exports PKCS#8 private keys and X.509 (SPKI) public keys, which Laravel Passport and RS256 JWT libraries (e.g. tymon/jwt-auth) accept. Point JWT_PRIVATE_KEY / JWT_PUBLIC_KEY at the PEM files, or copy them to storage/oauth-private.key and storage/oauth-public.key for Passport. Do not commit private keys; treat browser-generated keys as development credentials unless you follow your own key-management process.