Key Pair Generator (RSA, ECDSA, Ed25519)
Generates a public/private key pair as PEM (SPKI for the public key, PKCS#8 for the private key). It uses the browser built-in Web Crypto API and everything stays in your browser. The generated keys are never sent to a server. To protect text with a password, use the Text Encryptor & Decryptor.
🔒 Runs in your browser · Your data is never sent to a server
How to use
- Choose an algorithm that fits your use case.
- Click "Generate key pair" (RSA-4096 can take a few seconds).
- Copy the public and private keys, or save them as .pem files.
Notes
- Keep the private key secret and store it somewhere safe. The keys disappear when you close the page and the same pair cannot be regenerated.
- For production keys, consider the security of the device that generated them. For important uses, generate keys in a controlled environment (OpenSSL, ssh-keygen, an HSM, etc.).
- The private key is plain PEM with no passphrase protection.
- Ed25519 works only in recent browsers. An error is shown if it is not supported.
- Output is SPKI / PKCS#8 PEM. The OpenSSH format (e.g. id_ed25519) is not produced.
Glossary
RSA
A public-key cipher based on the difficulty of factoring large integers. Widely supported, but keys are long; 2048 bits or more is the usual baseline.
ECDSA
A signature scheme using elliptic curves. It gives comparable strength to RSA with much shorter keys. P-256 is the most common curve.
Ed25519
A signature scheme on the Curve25519 curve. Keys are short and operations are fast, and it is increasingly used for SSH and JWT.
PEM / SPKI / PKCS#8
PEM is a text format that wraps Base64 data in header lines. Public keys are stored as SPKI and private keys as PKCS#8.
FAQ
Which should I choose: RSA, ECDSA, or Ed25519?
For maximum compatibility use RSA-2048 or larger; for short keys and speed, ECDSA P-256 or Ed25519 are good choices. Check which algorithms the system you connect to supports.
Choosing Ed25519 shows an error.
Ed25519 support in the Web Crypto API is recent and missing from older browsers. Update your browser or pick ECDSA (P-256) instead.
Are the keys in the same format as OpenSSH ssh-keygen?
No. Public keys are SPKI and private keys are PKCS#8, both as PEM. The OpenSSH-specific formats (id_ed25519, or public keys starting with ssh-rsa) are not produced. OpenSSL and similar tools can read the PEM directly.
Are the generated keys sent to a server or stored?
No. Keys are generated by the Web Crypto API in your browser and are neither sent nor stored anywhere. They vanish when you close the page, so copy or save the keys you need first.
Share this page