RSA Key Pair Generator

You need an RSA key pair to test JWT signing with RS256, experiment with asymmetric encryption, or simply see what a PEM looks like inside, and you would rather not memorize openssl flags. Pick 2048 or 4096 bits and a scheme (signing or encryption), click generate, and you get the public key as SPKI and the private key as PKCS#8, both in the PEM format that JWT libraries and openssl itself accept directly.

Generation uses the browser's Web Crypto API with public exponent 65537, the industry default. The algorithm choice matters because in Web Crypto a key is born tied to its usage: PKCS#1 v1.5 and RSA-PSS sign, RSA-OAEP encrypts. Another detail that trips people up: the 'BEGIN PRIVATE KEY' header means PKCS#8, which is not the same as 'BEGIN RSA PRIVATE KEY' (PKCS#1); a library expecting one format rejects the other, and openssl converts between them.

For lab work, RS256 experiments and learning key formats, this does the job, and the keys never leave your browser. For production, generate on the target machine with ssh-keygen or openssl: a private key that has ever been displayed in a browser tab should not guard anything valuable. If SSH is the goal, note the output here is PEM, not the 'ssh-rsa AAAA...' line authorized_keys expects, so you would have to convert it. Generating 4096 bits takes a few seconds and the time varies: that is the random prime search.