RSA & EC Key Pair Generator
Generate an RSA (2048/4096-bit) or ECDSA (P-256/P-384) key pair in your browser and export it as PEM, an OpenSSH authorized_keys public key, or JWK — 100% client-side.
Keep this private — store it encrypted, never in git.
How to generate a key pair
Choose, generate, and save your keys in four steps.
- 1
Choose an algorithm
Select RSA (2048 or 4096-bit) or ECDSA (P-256 or P-384) depending on whether you need broad compatibility or smaller, faster keys.
- 2
Generate the key pair
The generator calls the Web Crypto API to create the pair locally and exports both keys to PEM in your browser — nothing is transmitted.
- 3
Copy or download the keys
Copy the SPKI public key and PKCS#8 private key, or download them as .pem files ready to use in your application or service.
- 4
Store the private key in Envless
Keep the generated private key end-to-end encrypted in Envless so your team can share and rotate it safely — never in a plaintext file or committed to git.
Why use the Envless key pair generator?
Real Web Crypto key generation from a team that builds encrypted secret management for a living.
RSA and ECDSA support
Generate RSA keys at 2048 or 4096-bit, or ECDSA keys on the P-256 or P-384 curves. Pick the algorithm and strength that fit your use case.
Standard PEM output
Keys are exported in the widely supported PEM encoding — SPKI for the public key and PKCS#8 for the private key — so they drop into most languages and tools.
Real Web Crypto generation
Pairs are created with the browser’s native Web Crypto API using crypto.subtle.generateKey and exportKey — no weak polyfills or homegrown randomness.
Private key never leaves your browser
Everything runs locally on your device. The private key is generated in memory and never uploaded, logged, or sent over the network.
OpenSSH SSH key and JWK export
Beyond PEM, export the public key in OpenSSH authorized_keys format or as a JWK, and the private key as a JWK — ready for SSH access, JWT libraries, and JSON-based key stores.
Key pair generator FAQ
Everything you need to know about generating RSA and EC key pairs locally.
No, it never leaves your browser. The pair is generated locally with the Web Crypto API and exported on your device. There are no uploads, no logging, and no network requests, so the private key stays with you.
You can generate RSA keys at 2048 or 4096-bit, or ECDSA keys on the NIST P-256 and P-384 curves. These cover the most common needs for signing and key exchange.
ECDSA gives you much smaller, faster keys at equivalent security and is a great default for new systems. RSA is slower and larger but has the widest compatibility, so choose it when a tool or service requires RSA specifically.
Both keys are exported as PEM — the Base64 text wrapped in BEGIN/END headers. The public key uses the SPKI structure and the private key uses PKCS#8, which together work with most modern libraries and runtimes.
Yes. The keys work directly for JWT signing (RS256, ES256, and similar) and as a basis for TLS keys. For SSH, you can export the public key straight to OpenSSH authorized_keys format; an SSH private key uses its own format, so convert the PKCS#8 key (for example with ssh-keygen) when you need it.
Never leave it in a plaintext file or commit it to git. Store it end-to-end encrypted in Envless, where your team can share, rotate, and audit access to the key without exposing it in chat or config files.
Yes. Alongside PEM, you can export the public key as an OpenSSH SSH key in authorized_keys format — ready to paste into a server’s authorized_keys file — or as a JWK, and export the private key as a JWK for JSON-based key stores and JWT libraries.
More free tools
Other free, 100% client-side tools from the Envless team.
Ship secrets, not chaos.
Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.