RSA Key Generator

Use the RSA Key Generator above. Select your desired key size (2048, 3072, or 4096-bit), choose a hash algorithm (SHA-256 recommended), pick your export format (PEM, JWK, DER, or All), and click 'Generate RSA Keys'. The tool uses the Web Cryptography API (crypto.subtle.generateKey) to create cryptographically secure key pairs locally in your browser. The keys are then exported, fingerprinted, and verified automatically.

Your keys are generated entirely in your browser using the Web Cryptography API. No data — including private keys, public keys, fingerprints, or key sizes — is ever transmitted to any server. The key generation, export, fingerprinting, and verification all happen in a Web Worker that runs locally on your device. FreeDeskTools follows a zero-knowledge architecture: we never see, store, or log your keys.

4096-bit RSA provides a 256-bit security level, matching the security of AES-256. It is resistant against future advances in factoring algorithms and computing power. Choose 4096 for long-term security, sensitive data protection, and compliance with security standards that require high key strength. However, 4096-bit key generation is significantly slower (5-15 seconds) than 2048-bit, and operations (encryption, decryption, signing) require more CPU. For most applications, 2048-bit is sufficient and recommended by NIST and other standards bodies.

Yes. The generated RSA keys use RSA-OAEP (Optimal Asymmetric Encryption Padding) which is compatible with JWT signing algorithms, particularly RS256, RS384, and RS512. Export your private key in PEM format and use it with standard JWT libraries in Node.js, Python, Go, Java, or any other language. The tool also provides a Node.js code sample that shows exactly how to implement JWT signing and verification with the generated keys. The SHA-256 hash algorithm maps to RS256, SHA-384 maps to RS384, and SHA-512 maps to RS512.

The private key is displayed on screen and available for download as a .pem file. For maximum security: (1) Download the private key directly rather than copying from the browser window to avoid clipboard exposure. (2) Store the private key in a secure location such as a hardware security module, encrypted vault, or password manager. (3) Never store private keys in source control, email, cloud storage, or shared drives. (4) Set appropriate file permissions (chmod 600 on Unix systems). (5) Consider encrypting the private key with a passphrase using OpenSSL.

PEM (Privacy Enhanced Mail) is a Base64-encoded format for cryptographic keys and certificates. PEM files use headers like '-----BEGIN PRIVATE KEY-----' and '-----BEGIN PUBLIC KEY-----' with footers and base64-encoded content between them. PEM is the most widely supported key format across programming languages, web servers, and cryptographic tools. The RSA Key Generator exports private keys in PKCS#8 PEM format and public keys in SPKI PEM format, both of which are compatible with OpenSSL, Node.js, Python, Java, Go, and most cloud platforms.

PKCS#8 (Public-Key Cryptography Standards #8) is a standard format for storing private key information, defined by RSA Laboratories in RFC 5208. It is the modern, recommended format for private keys and supports multiple algorithm types beyond RSA, including ECDSA and Ed25519. PKCS#8 files can store the raw private key (unencrypted) or include encryption with a passphrase. The RSA Key Generator exports private keys in unencrypted PKCS#8 PEM format, which is the most compatible format for OpenSSL, web servers, and programming language crypto libraries.

SPKI (Subject Public Key Info) is the standard format for storing public keys, defined in RFC 5280. It contains the algorithm identifier (RSA-OAEP with the selected hash) and the public key material (modulus and exponent). SPKI format is used in X.509 certificates and is the standard public key format for TLS, JWT verification, and SSH. The RSA Key Generator exports public keys in SPKI PEM format, which starts with '-----BEGIN PUBLIC KEY-----' and is directly compatible with OpenSSL, Node.js crypto, and all major programming languages.

JWK (JSON Web Key) is a JSON-based format for representing cryptographic keys, defined in RFC 7517. A JWK for RSA includes fields like kty (RSA), n (modulus as Base64URL), e (exponent as Base64URL), alg (algorithm), and kid (key ID). JWK is the standard key format for JWT libraries and is widely used in OAuth 2.0 and OpenID Connect implementations. JWK keys can also include the private exponent (d), prime factors (p, q), and CRT parameters (dp, dq, qi) when exporting the private key.

Yes. The RSA Key Generator provides a ready-to-use OpenSSL command section that shows you exactly how to work with your generated keys. The tool generates PEM-formatted private keys (PKCS#8) and public keys (SPKI) that are fully compatible with OpenSSL. You can use the generated keys for TLS certificate signing requests, JWT signing, file encryption, and SSH key conversion. Example OpenSSL commands are displayed in the developer utilities section of the tool.

Yes. Like all FreeDeskTools, the RSA Key Generator runs entirely in your browser. Once the page is loaded, you can disconnect from the internet and still generate RSA key pairs. The Web Cryptography API is built into modern browsers and requires no network access. The Web Worker for key generation, fingerprinting, and verification executes locally. No external resources, CDN scripts, or server calls are needed.

Absolutely. The RSA Key Generator exports keys in standard PEM and JWK formats that are directly compatible with Node.js crypto module. The tool displays a ready-to-use Node.js code sample that shows how to import your private key, import your public key, sign data, and verify signatures. The generated keys work with Node.js crypto, jsonwebtoken library, jose library, and all standard Node.js cryptographic operations.

Yes. Generate an RSA private key with the tool, then use it to create a Certificate Signing Request (CSR) with OpenSSL or your certificate authority's management console. The private key is in standard PKCS#8 PEM format that all major CAs support. Export your public key in SPKI PEM format, which is the format used in X.509 certificates.

Yes, browser-generated RSA using the Web Cryptography API (crypto.subtle.generateKey) is cryptographically secure. The Web Crypto API provides access to hardware-accelerated cryptographic operations and system-level entropy sources. Browser entropy sources include hardware random number generators, system interrupts, mouse movements, keystroke timings, and other platform-specific sources. The generated keys use RSA-OAEP with SHA-256/384/512 and a 65537 public exponent, which follows current cryptographic best practices. Modern browsers maintain rigorous security standards for their cryptographic implementations.

No. FreeDeskTools never sees, stores, logs, or transmits your keys. The RSA Key Generator operates entirely in your browser using the Web Cryptography API. Key generation, export, fingerprinting, and verification all execute in a local Web Worker. No data leaves your device. There are no background requests, telemetry, or analytics related to generated keys. This is a zero-knowledge tool: your private key is known only to you.