RSA Key Pair Generator (PEM, JWK, OpenSSH)
Generate an RSA key pair (2048–4096 bits) in your browser: PKCS#8 and PKCS#1 private keys, SPKI public key PEM, JWK and an OpenSSH public line, with a fingerprint.
An RSA key pair is still the most widely accepted public-key format for TLS, JWT signing (RS256), SSH and encrypted data exchange. This generator creates one with your browser’s Web Crypto API and exports it in every common format: PKCS#8 and PKCS#1 PEM private keys, the SPKI public key, JSON Web Keys and an OpenSSH public line. Each pair is checked by a sign-and-verify (or encrypt-and-decrypt) round trip through the exported files.
How to use this tool
- Pick the key size — 3072 bits for new keys, 2048 for maximum compatibility.
- Choose whether the key will sign (RS256 / PS256) or encrypt (RSA-OAEP); this sets the JWK fields.
- Press the button; large keys can take a few seconds.
- Copy the format your software expects and keep the private key secret.
Formula
n = p × q for two random primes of bits/2 each; e = 65537; d = e⁻¹ mod lcm(p − 1, q − 1). The public key is (n, e); the private key also holds d, p, q and the CRT values.
PKCS#1 ("RSA PRIVATE KEY") stores only the RSA numbers; PKCS#8 ("PRIVATE KEY") wraps them with an algorithm identifier and is what most modern libraries want. SPKI ("PUBLIC KEY") does the same for the public half.
Example
A 2048-bit request produces a modulus of exactly 2048 bits with exponent 65537. Its PKCS#8 PEM starts with -----BEGIN PRIVATE KEY-----, and the same key in PKCS#1 starts with -----BEGIN RSA PRIVATE KEY-----.
Frequently asked questions
Which size should I use?
NIST SP 800-57 treats 2048-bit RSA as acceptable through 2030 and recommends 3072 bits beyond that. 4096 bits is slower to generate and use, with little practical gain for most purposes.
Is the private key sent anywhere?
No. Generation and export happen in your browser and nothing is uploaded. For long-lived production keys many teams still prefer openssl genpkey on a trusted machine or a hardware security module.
How do I convert between the formats later?
With OpenSSL: openssl pkey -in key.pem -traditional gives PKCS#1, openssl pkey -in key.pem gives PKCS#8, and openssl pkey -in key.pem -pubout writes the SPKI public key.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/rsa-key-generator/
Cite or embed this tool
kakaoCalc. (2026, November 8). RSA Key Pair Generator (PEM, JWK, OpenSSH). https://kakao.mobile/tools/rsa-key-generator/
“RSA Key Pair Generator (PEM, JWK, OpenSSH).” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/rsa-key-generator/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms