Keypair Generator
Generate RSA, EC, or Ed25519 signing keypairs in your browser — PEM private/public keys, a JWKS bundle, and env-var-ready output. Nothing ever leaves your tab.
Key options
Pick an algorithm and a key id, then generate. Everything runs locally.
Key type
Modulus size
Signature hash
Algorithm: RS256
Used only to build a suggested key id.
Stable label that goes in the JWT header and JWKS.
Equivalent openssl command
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out signing-key.pemKeys are generated locally with the Web Crypto API and never leave your browser.
Keypair Generator FAQ
- Should I use RSA, ECDSA or Ed25519?
- Ed25519 (EdDSA) gives small, fast keys and is a good default where supported. ECDSA P-256 (ES256) is widely supported by JWT libraries and cloud KMS. RSA 2048+ (RS256) is the most compatible choice for older systems, at the cost of larger keys and slower generation.
- Are the generated keys sent anywhere?
- No. Keys are generated with the browser's Web Crypto API inside this tab. Nothing is uploaded, logged or stored — close the tab and the keys are gone unless you copied or downloaded them.
- Why does RSA 4096 take longer to generate?
- RSA has to find two large random primes, and the search time grows quickly with key size. EC and Ed25519 keys are generated almost instantly.
- What is the kid and the JWKS output for?
- The kid (key ID) labels the key in JWT headers so verifiers can pick the right public key. The JWKS is the public key set a service publishes, usually at /.well-known/jwks.json, for verifying its tokens.