Why it matters
Development needs keys all the time: signing JWTs, testing webhooks, encrypting a field, setting up SSH for a deploy. Command-line tools work but the flags are hard to remember, and each format (PEM, JWK, OpenSSH) needs a different command.
This generator uses the browser's WebCrypto, which draws on the operating system's secure random source, and exports each key in every format you're likely to need, with a kid from the RFC 7638 thumbprint. Paste any PEM to find out what kind of key it is and whether it's strong enough.
How it works
- InputKey type and size
- In your browserGenerated with WebCrypto, never sent anywhere
- OutputPEM, JWK, SSH and a thumbprint
Where it fits in a designer's workflow
- Plan
- Design
- Build
- Test
- Launch
By the numbers
Show the numbers as a table
| Key | Public (bytes) | Private PKCS#8 (bytes) |
|---|---|---|
| RSA 2048 | 294 | 1217 |
| RSA 3072 | 422 | 1792 |
| RSA 4096 | 550 | 2374 |
| ECDSA P-256 | 91 | 138 |
| ECDSA P-384 | 120 | 185 |
| Ed25519 | 44 | 48 |
| X25519 | 44 | 48 |
How to use it
- Choose the key type and size.
- Set a key ID and use, or leave the defaults.
- Generate, then download the public and private keys.
- Paste a PEM below to identify an existing key.
FAQ
Is a browser-generated key secure?
Yes. WebCrypto uses the operating system's cryptographic random generator, the same as OpenSSL. The keys exist only in this tab until you save them.
Which key type should I pick?
Ed25519 for SSH and signing where supported; ECDSA P-256 for JWTs (ES256) and wide support; RSA 3072 where older systems need RSA.
Can I use the OpenSSH line in authorized_keys?
Yes. It's the standard one-line format, with the comment you set.
Why doesn't my old key work with WebCrypto?
WebCrypto reads PKCS#8 private keys (BEGIN PRIVATE KEY). Older BEGIN RSA PRIVATE KEY files need converting with openssl pkcs8 -topk8 -nocrypt.
