Key pair generator
Generate RSA, ECDSA (P-256, P-384, P-521), Ed25519 or SM2 key pairs as PEM in PKCS #8 or traditional form, for JWT, TLS or encryption tests.
Loading…
Keys are generated in this browser and never leave it.
About this tool
Generate a new RSA, ECDSA, Ed25519 or SM2 key pair as PEM text. Use it when you need keys to sign and verify JWTs in development, to test RSA or SM2 encryption, or to hand a partner system your public key while the private key stays with you.
RSA keys can be 2048, 3072 or 4096 bits, ECDSA keys use the P-256, P-384 or P-521 curve, and the private key comes as PKCS #8 or in the traditional RSA/EC form. The page also shows the public key as a JWK, or both SM2 keys as hex. Keys are generated in your browser and are not uploaded or stored.
How to use it
- Choose the “Algorithm”: RSA 2048 (the default), RSA 3072, RSA 4096, ECDSA P-256, P-384 or P-521, Ed25519 or SM2.
- Choose the “Private key format”: “PKCS #8 (BEGIN PRIVATE KEY)” or “Traditional (BEGIN RSA/EC PRIVATE KEY)”.
- Select “Generate key pair”.
- Use “Copy” or “Download” under the private key, the public key and the JWK or SM2 hex block. Keep the private key to yourself.
Common questions
Which key should I choose for a JWT?
Follow the algorithm in the option name: ECDSA P-256 is for ES256, P-384 for ES384, P-521 for ES512 and Ed25519 for EdDSA, while RSA keys serve RS256, PS256 and the related algorithms. Paste the private key into “JWT sign” to sign a token, and the public key or JWK into “JWT verify” to check it.
What is the difference between PKCS #8 and the traditional format?
PKCS #8 (BEGIN PRIVATE KEY) names the algorithm inside the key and works for every type here. The traditional form is PKCS #1 (BEGIN RSA PRIVATE KEY) for RSA and SEC 1 (BEGIN EC PRIVATE KEY) for ECDSA and SM2, which some older software expects; Ed25519 has no traditional form. Switching the format after generating shows the same key written the other way.
Which SM2 key form should I use?
The PEM keys are written as an EC key on the SM2 curve. “SM2 keys as hex” gives the 64-digit private key and the 130-digit public key starting with 04, the form many SM2 libraries take. Both forms work in the “RSA and SM2 encryption and signatures” tool.
Why do I see “This browser cannot generate this kind of key.”?
RSA, ECDSA and Ed25519 keys are made with the browser’s built-in Web Crypto, and the message means your browser does not offer the type you chose. Try an up-to-date browser or another algorithm.
Are the keys stored or sent anywhere?
No. The keys exist only on this page in your browser: nothing is uploaded or saved, and they are gone when you leave the page or generate a new pair, so copy or download what you need first.
Related tools
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Self-signed certificate
Create a self-signed TLS certificate and private key for development and testing from host names and IP addresses, one per line. The key is generated in the browser.
Certificate decoder
Read PEM certificates and certificate requests: subject, issuer, validity, alternative names, public key, key usages, other extensions and fingerprints.
PFX/P12 to PEM
Export the private key, certificates and public key from a PFX or P12 file as PEM, including files from OpenSSL 3 (AES) and older RC2 or 3DES ones.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.