CanDoYa
All tools
Saved toolsYour favorites

Add to favorites

Saved in this browser only.
Private browser utility / Developer

Free RSA Key Pair Generator

Runs entirely in your browser - no upload, no sign-up.

Live workspaceLocal processing

Key settings

Create a new RSA key pair

Larger keys take longer to create and produce larger files.

Generates an RSA-OAEP key pair with SHA-256.

Generated locally with WebCrypto

Ready for a new key ceremony

Choose the key size and purpose, then generate a fresh public and private key pair on this device.

Share this tool
rsa key pair generator / browser utility
01 / Overview

What is an RSA key pair generator?

An RSA key pair generator creates a mathematically linked public key and private key for encryption or digital signatures. This tool uses your browser's Web Crypto API to generate 2048, 3072, or 4096-bit keys, then exports the public key as SPKI and the private key as unencrypted PKCS#8.

02

How to use

  1. 01
    Choose a key size

    Use 2048 bits for the widest compatibility, or choose 3072 or 4096 bits when your system requires a larger modulus.

  2. 02
    Choose the key purpose

    Select RSA-OAEP for encryption and decryption or RSA-PSS for signing and verification.

  3. 03
    Generate the pair

    Click Generate RSA key pair and wait while WebCrypto creates strong random prime factors locally.

  4. 04
    Export and store

    Copy or download the public and private keys in PEM or JWK format. Put the private key in secure storage immediately.

03

Who it's for

  • Local API development that needs a disposable RSA-OAEP pair for encryption tests.
  • Signature prototypes that use RSA-PSS to sign data and verify it with a public key.
  • Key-format testing for applications that import SPKI, PKCS#8, or JSON Web Keys.
  • Fingerprint comparisons when confirming that a public key matches the expected artifact.

Choose RSA-OAEP for encryption and decryption or RSA-PSS for signing and verification. The key material is created and exported on your device. You can switch between PEM and JWK views, copy either key, download separate files, and compare the SHA-256 fingerprint of the public SPKI key.

Private keys need careful handling. The PKCS#8 PEM and private JWK produced here are not protected by a password. Move the private key directly into an appropriate secret store, restrict file permissions, and replace the pair if the private key is ever exposed.

FAQ

Is my RSA private key uploaded?

No. Key generation and export happen in your browser through WebCrypto. CanDoYa does not receive the public key or private key. The page still uses normal site assets and analytics, so you should always treat the downloaded private key as a sensitive secret and store it promptly.

Is this RSA key generator free?

Yes. You can generate, copy, and download RSA key pairs without signing up or paying. There is no server-side quota because the computational work runs on your device. Browser speed is the practical limit, especially when creating 4096-bit keys.

Should I choose a 2048, 3072, or 4096-bit RSA key?

Choose the size required by the system that will import the key. RSA 2048 is the compatible default for many current applications. RSA 3072 and 4096 provide a larger modulus but take longer to generate and operate. A larger key does not fix an insecure protocol or poor private-key storage.

What is the difference between RSA-OAEP and RSA-PSS?

RSA-OAEP is an encryption scheme: the public key encrypts and the private key decrypts. RSA-PSS is a signature scheme: the private key signs and the public key verifies. The exported RSA key material looks similar, but WebCrypto assigns different permitted operations to each generated pair.

What formats does this generator export?

PEM output uses an SPKI public key and an unencrypted PKCS#8 private key. JWK output uses the JSON Web Key structure, including the private RSA parameters in the private JWK. The SHA-256 fingerprint is calculated over the exported SPKI DER bytes.

Can I use these keys for SSH?

Not directly. OpenSSH public keys use a different text format, and modern SSH workflows often prefer Ed25519. This generator targets standards-based WebCrypto, application encryption, signatures, and SPKI or PKCS#8 imports. Use ssh-keygen when you need an SSH login key pair.

Is the private key password-protected?

No. WebCrypto exports this private key as unencrypted PKCS#8 or as a private JWK. Anyone who obtains that file can use its private parameters. Store it in a secret manager or encrypted container, restrict access, and generate a replacement pair if it is disclosed.