RSA Key Pair Generator (2048 / 4096-bit)
Generate RSA key pairs and export them as PEM.
Free · no sign-up · runs locally·
About this tool
RSA remains the most widely deployed public-key algorithm. This generator uses the Web Crypto API to create an RSA-OAEP key pair locally — the private key is generated inside your browser's cryptographic engine and is never transmitted anywhere.
Keys export in standard PEM containers: PKCS#8 for the private key and SPKI (SubjectPublicKeyInfo) for the public key, ready for OpenSSL, ssh, or your application code. 2048 bits is the accepted minimum today; use 4096 for long-lived keys.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Do the same in a terminal
Reproduce or cross-check this tool with standard command-line utilities. For deterministic operations like hashing and encoding, the output matches exactly.
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out private.pem
openssl pkey -in private.pem -pubout -out public.pemFrequently asked questions about RSA Key Generator
What key size should I use?+
2048 bits is the accepted minimum today. Use 3072 or 4096 for keys that must stay secure for many years. Larger keys are slower to generate and use.
Are the keys generated on a server?+
No — they are generated in your browser with the Web Crypto API and never transmitted. Save the private key before closing the tab; it cannot be recovered afterward.
What formats are the keys in?+
Standard PEM: PKCS#8 for the private key and SPKI (SubjectPublicKeyInfo) for the public key, compatible with OpenSSL and most libraries.
Ed25519 vs RSA for SSH Keys: Which Should You Generate in 2026?
Ed25519 or RSA? Compare SSH key types on security, size, speed and compatibility, see the exact ssh-keygen commands, and learn what post-quantum SSH changes (and doesn't).
6 MIN READPOST-QUANTUM · STANDARDSPost-Quantum Cryptography in 2026: What ML-KEM and ML-DSA Mean for You
A practical guide to post-quantum cryptography: what quantum computers break (and don't), the NIST standards ML-KEM, ML-DSA and SLH-DSA, where PQC is already deployed, and what to do now.
6 MIN READRelated tools
RSA Encrypt / Decrypt
Encrypt with a public key, decrypt with a private key
ECDSA · P-256/384/521ECC Key Generator
Generate P-256, P-384, and P-521 key pairs as PEM
ED25519 · X25519Ed25519 / X25519 Keys
Modern Curve25519 signing and key-exchange keys
OPENPGP · RFC 9580PGP Encrypt / Decrypt
Encrypt with a public key, decrypt with a private key