UFOZoo

RSA/ECDSA Key Generator — PEM Keys for SSH, TLS & JWT

Generate RSA/ECDSA key pairs online for SSH, TLS, JWT, and OpenSSL. Export as PEM format. 100% browser-based — keys never leave your device.

Features

  • ✓Two algorithm modes — RSA (2048/4096 bit) and ECDSA (P-256/P-384/P-521) for flexible cryptographic needs
  • ✓Standard PEM output — exports public key in SPKI format and private key in PKCS#8 format, compatible with OpenSSL and most crypto libraries
  • ✓Secure key generation — uses the Web Crypto API (crypto.subtle.generateKey) for cryptographically secure random key material
  • ✓One-click copy — copy each key separately with a single click, with visual feedback
  • ✓Save as .pem file — save public and private keys as individual PEM files
  • ✓100% browser-based — all key generation happens client-side, your private key never leaves your device or touches any network
  • ✓Key details panel — displays algorithm name, curve/size, format metadata for each generated key
  • ✓Generation progress bar — shows real-time progress during RSA prime number search (especially helpful for 4096-bit keys)

How to Use

  1. 1Select the key algorithm: RSA for asymmetric encryption or ECDSA for digital signatures and modern applications.
  2. 2Choose the key size: for RSA select 2048 (default, recommended) or 4096 bits; for ECDSA select P-256, P-384, or P-521 curve.
  3. 3Click Generate — the tool creates a cryptographically secure key pair using the browser's Web Crypto API.
  4. 4Review the public and private keys displayed in PEM format. Click Copy to copy a key to your clipboard.
  5. 5Click Download to save a key as a .pem file for use in OpenSSL, SSH, or server configuration.
  6. 6Check the Key Details panel to see algorithm type, key size/curve, and format information for the generated pair.
  7. 7Watch the progress bar during RSA key generation — 2048-bit takes 2-5 seconds, 4096-bit may take 10-30 seconds on slower devices.
  8. 8Use the public key with TLS/SSL certificates: create a CSR with OpenSSL using your private key, then submit to a certificate authority.
  9. 9Use the key pair for JWT signing: configure your auth server to use the private key for signing tokens and distribute the public key for verification.

Frequently Asked Questions

What is the difference between RSA and ECDSA?

∨
RSA is the most widely used asymmetric encryption algorithm, ideal for encryption, digital signatures, and key exchange. It is supported everywhere but requires larger key sizes (2048–4096 bits). ECDSA (Elliptic Curve Digital Signature Algorithm) provides equivalent security with much smaller key sizes — P-256 is comparable to RSA 3072. ECDSA is faster for signing and is the preferred choice for modern applications including blockchain, JWTs, and TLS certificates.

What key sizes should I use?

∨
For RSA, 2048 bits is the current industry standard and recommended for most applications. 4096 bits provides a higher security margin but is significantly slower for key generation and cryptographic operations. For ECDSA, P-256 (secp256r1) is the most widely supported and recommended for general use. P-384 is required by some government standards (NSA Suite B). P-521 offers the highest security but has limited compatibility.

What is PEM format and how do I use these keys?

∨
PEM (Privacy Enhanced Mail) is a standard Base64-encoded format with header/footer lines. Public keys use BEGIN PUBLIC KEY / END PUBLIC KEY (SPKI format per RFC 5280). Private keys use BEGIN PRIVATE KEY / END PRIVATE KEY (PKCS#8 format per RFC 5208). These PEM files are compatible with OpenSSL, OpenSSH, Node.js crypto, Python cryptography, TLS servers, JWT libraries, and most cryptographic tools.

Are the generated keys secure?

∨
Yes. The tool uses the Web Crypto API (crypto.subtle.generateKey), which is a cryptographically secure pseudo-random number generator (CSPRNG) built into every modern browser. The same API is used by browsers for HTTPS/TLS. The generated keys are indistinguishable from those created by OpenSSL or other cryptographic libraries. All generation happens locally — your keys never leave your browser.

Can I use these keys for SSH?

∨
RSA keys generated in PEM format can be used with SSH after conversion. You may need to extract the public key in SSH format: ssh-keygen -f public-key.pem -i -m PKCS8. For direct SSH use, consider using the ssh-keygen command-line tool which generates keys in the native SSH format. ECDSA keys (especially P-256) are also supported by OpenSSH 6.5+.

Can I import these keys into other systems?

∨
Yes. The PEM format is universally supported. For Node.js, use crypto.createPublicKey() and crypto.createPrivateKey(). For Python, use cryptography library's load_pem_private_key() and load_pem_public_key(). For OpenSSL, use openssl pkey -in key.pem. For JWTs, the public key can be used to verify signatures and the private key to sign. For TLS, configure the private key and certificate (generated from the public key) in your web server.

Why is key generation sometimes slow?

∨
RSA key generation, especially 4096-bit, requires finding large prime numbers and can take several seconds depending on your browser and device. This is normal and indicates that true random number generation is happening. ECDSA key generation is typically much faster (under a second) because it does not require prime generation. The progress bar shows the generation status.

Do you store my private key?

∨
No. The private key is generated entirely in your browser's memory. It is never transmitted to any server, never stored in any database, and never logged. Once you close the page or refresh, the key is gone forever. You are responsible for saving your private key — if you lose it, it cannot be recovered by anyone, including us.

Can I generate keys for SSH authentication?

∨
RSA PEM keys can be used with SSH after format conversion. To extract the SSH public key format, run: ssh-keygen -f public-key.pem -i -m PKCS8. For SSH private keys, the PEM format may need conversion to OpenSSH format using: ssh-keygen -p -m PEM -f private-key.pem. ECDSA P-256 keys work with OpenSSH 6.5+ natively.

What is the difference between PKCS#8 and SPKI PEM formats?

∨
PKCS#8 (Private-Key Information Syntax Standard, RFC 5208) is the standard format for private keys, wrapping the key data with algorithm identification. SPKI (Subject Public Key Info, RFC 5280) is the standard format for public keys, containing the algorithm and key data. Both are universally supported — OpenSSL, Node.js, Python, Java, and Go all use these formats natively.

Related Tools

Password Generator — Free Create Strong Random Passwords

Create strong, secure passwords with customizable length and character sets. Uses Web Crypto API for cryptographically secure generation. Browser-based.

UUID Generator — Validate & Decode UUIDs, All Versions

Generate, validate & decode UUID v1-v7, plus bulk NanoIDs and ULIDs. Paste a UUID to inspect its version, variant and timestamp. All client-side.

JWT Decoder — Decode, Verify & Debug JSON Web Tokens

Decode JSON Web Tokens instantly — view header, payload, and signature. Inspect claims with human-readable timestamps. Detects expired and weak tokens.

JSON Formatter — Beautify, Validate & Minify JSON Online

Format, minify, pretty-print, and syntax-highlight JSON data. Features key sorting, custom indentation, tree view, error highlighting, and file upload.

Hash Calculator — MD5, SHA-256 & 25+ Algorithms Online

Calculate hashes using 25 algorithms including MD5, SHA-256, SHA3, BLAKE3, and more. Supports HMAC, hash verification, and uppercase/lowercase output.