RSA, ECDSA & Ed25519 Key Generator
Generate a key pair in your browser with Web Crypto and export it as PEM or JWK, with a SHA-256 fingerprint of the public key.
Local workspace
Named projects in IndexedDB · Local only — never synced to our servers. Worksp…
Options
| Option | Description |
|---|---|
| Key type | RSA 4096 takes several seconds to generate. Ed25519 needs a recent browser. |
| Format | PEM suits OpenSSL and servers. JWK suits JOSE and JWT libraries. |
FAQ
Which key type should I pick?
Ed25519 is the fastest and shortest, and is the modern default for signing and SSH. ECDSA P-256 has the widest support and backs ES256 in JWTs. RSA 2048 is for systems that still expect RSA, such as RS256 tokens. RSA 4096 is slower to generate and use, and rarely needed.
What's the difference between PEM and JWK?
PEM is the Base64 DER block with BEGIN and END lines that OpenSSL, web servers, and SSH tooling read. JWK is the JSON form used by JOSE libraries, JWT signing, and OpenID Connect key sets.
Are these keys safe to use in production?
They come from the browser's cryptographic random source and never leave the page, but a browser tab is not key management. For production, generate on the machine that will use the key with ssh-keygen or openssl, or in an HSM or KMS, and control who can read the private key.
Can I use the private key as an SSH key?
Not as is. SSH expects its own OpenSSH format, so convert the PKCS#8 output with ssh-keygen before using it, or generate SSH keys with ssh-keygen directly.
What is the fingerprint for?
It's the SHA-256 hash of the public key in SPKI form, which is a short way to confirm that a public key matches the private key you hold. Note that SSH fingerprints hash a different encoding, so the values won't match those.