Online Tool Store
· 5 min read
How to Generate an RSA Key Pair in Your Browser
Heshan Fernando
Co-founder & COO
You need an RSA key pair — maybe to sign JWTs for a side project, encrypt a config secret, or test a library that expects PEM-formatted keys — and the usual path is opening a terminal and running openssl genrsa. That’s fine if you have OpenSSL installed and remember the exact flags for key size and format. It’s a lot less fine on a locked-down work laptop, a Chromebook, or when you just need a throwaway pair for a five-minute test and don’t want to leave artifacts on disk.
The annoying part isn’t the RSA math — it’s the environment friction. Installing a crypto toolchain just to generate one key pair, remembering whether you need PKCS#1 or PKCS#8 formatting, or worse, generating a “test” key pair using a random online generator that might log what it creates. None of that should require more than a browser tab.
What generating an RSA key pair actually involves
RSA key generation picks two large random prime numbers, combines them into a modulus, and derives a public exponent and a private exponent from that. The public key (modulus plus public exponent) is safe to share; the private key must never leave your control, because anyone with it can decrypt anything encrypted to the public key or forge signatures claiming to be you. Key size — typically 2048, 3072, or 4096 bits — is a trade-off between security margin and performance; 2048-bit is still broadly accepted for most purposes, while 4096-bit adds margin at the cost of slower operations.
Modern browsers expose this generation directly through the Web Crypto API, which means the actual prime generation and key math can run locally without any server involvement, using the same cryptographic primitives as OpenSSL or any other standard library.
Why people get stuck here
- Format confusion. PEM, DER, PKCS#1, and PKCS#8 all describe RSA keys differently, and a key generated in the wrong format will fail to load in a library expecting another — usually with an unhelpful parsing error.
- Choosing the wrong key usage. RSA keys generated for signing (RSASSA) and RSA keys generated for encryption (RSA-OAEP) aren’t interchangeable — picking the wrong mode up front means regenerating later.
- No OpenSSL, no problem — except there is one. Not every environment has OpenSSL installed, and installing it just for one key pair is disproportionate for a quick test.
- Trusting an online generator that keeps a copy. An RSA private key generated on a server you don’t control is a private key you should assume is compromised the moment it’s created there.
What a good browser-based key generator looks like
Generates keys locally, never transmitted
This is the one non-negotiable for a private key. If the generation happens through the Web Crypto API in your browser, the key material never needs to leave your device — verify this is actually how the tool works before trusting it with anything beyond a throwaway test key.
Supports the key size and usage mode you actually need
A generator that only offers 2048-bit RSA-OAEP isn’t useful if you need a 4096-bit signing key. Look for explicit control over both bit length and whether the pair is meant for signing/verifying or encrypting/decrypting.
Outputs standard PEM you can paste directly
The output should be immediately usable — a PEM block you can paste into a config file, an environment variable, or another tool without reformatting.
| Method | Best For | Strength | Watch Out |
|---|---|---|---|
| OpenSSL CLI | Repeated or scripted key generation | Scriptable, industry standard | Requires install, easy to mistype flags |
| Language crypto library (e.g. Node, Python) | Generating keys inside an app | Fits directly into your codebase | Overkill for a one-off manual key |
| Browser-based generator | Quick, occasional test or throwaway keys | No install, runs locally, instant PEM output | Not meant for scripted/batch generation |
Common mistakes to avoid
- Generating a key pair on an untrusted website and using it for anything beyond a disposable test.
- Mixing up which PEM block is the private key and which is the public key when pasting into a config — they look similar at a glance but are not interchangeable.
- Using a small key size (below 2048-bit) out of habit from old tutorials; it’s no longer considered adequate.
- Reusing the same key pair across unrelated projects instead of generating a fresh pair per purpose.
- Forgetting that generating a new key pair doesn’t retroactively revoke the old one anywhere it was already registered — you still need to update it at the consuming service.
How to generate a key pair with RSA Key Generator
Online Tool Store’s RSA Key Generator uses the Web Crypto API to generate keys entirely in your browser.
- Open the tool and choose your key size (2048, 3072, or 4096-bit).
- Select the usage mode — sign/verify or encrypt/decrypt.
- Generate the pair and copy the PEM-formatted public and private keys.
- Paste them directly into your project, config, or test environment.
Frequently asked questions
Is a browser-generated RSA key as secure as one from OpenSSL?
Yes, assuming the browser’s Web Crypto implementation is used correctly — it relies on the same well-audited cryptographic primitives, and the randomness source is the browser’s cryptographically secure RNG, not a weaker JavaScript Math.random().
What key size should I use?
2048-bit is still widely accepted for most general use. 3072 or 4096-bit adds a longer-term security margin at some performance cost, and is worth it for keys you expect to stay in use for years.
Can I use the same key pair for both signing and encryption?
Technically the underlying RSA math allows it, but best practice is to generate separate key pairs for each purpose, since mixing usage modes on one key can weaken the security guarantees of both.
Final thought
For a one-off or occasional key pair, there’s no reason to install a toolchain or trust a server-side generator with your private key — generate it locally, copy the PEM, and move on.