Skip to content

RSA / EC key generator

Create key pairs for JWT, TLS tests or signing, or convert a key between PEM and JWK.

RSA/EC keys

What does it do?

It has two modes:

  • Generate an RSA (2048, 3072 or 4096 bits), elliptic curve (P-256, P-384, P-521) or Ed25519 key pair and export it as PEM (PKCS#8 private key, SPKI public key) and JWK.
  • Convert an existing key from PEM to JWK or from JWK to PEM. Public and private keys are both supported.

Generating the same keys with OpenSSL

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem

PEM headers

HeaderContents
BEGIN PUBLIC KEYpublic key, SPKI
BEGIN PRIVATE KEYprivate key, PKCS#8
BEGIN RSA PRIVATE KEYlegacy PKCS#1 RSA key: convert it with openssl pkcs8 -topk8 -nocrypt

Frequently asked questions

›RSA, EC or Ed25519?

For new systems prefer EC P-256 (ES256) or Ed25519: smaller keys, faster signatures and equivalent security to RSA 3072. Choose RSA 2048+ when you need compatibility with older software.

›What is the difference between PEM and JWK?

They hold the same key in different envelopes. PEM is Base64 DER between BEGIN/END lines, used by OpenSSL, nginx or Node. JWK is JSON, used by JWKS endpoints, OAuth and the jose libraries.

›Can I use these keys in production?

They are generated with the browser's secure Web Crypto API, so they are real keys. For production, many teams still prefer generating them on the server or in a KMS so the private key never exists on a laptop.