JWK / RSA / EC Key Pair Generator
Generate RSA or EC public/private key pairs and export as JWK or PEM. Keys are generated locally with the Web Crypto API and never transmitted anywhere.
What is a JWK?
A JSON Web Key (JWK, RFC 7517) is a JSON representation of a cryptographic key, used across JOSE/JWT ecosystems — for example as the format returned by a /.well-known/jwks.json endpoint for verifying JWT signatures. PEM is the older, Base64 + ASCII-armored format most commonly used by OpenSSL, TLS certificates and server configs.
How to use this tool
- Choose a key type: RSA for wide compatibility (JWT signing, TLS), or EC for smaller, faster keys with equivalent security.
- Click Generate key pair. Both keys are created locally using
crypto.subtle.generateKey. - Copy or download either format — JWK for JOSE/JWT libraries, PEM for OpenSSL, Node.js
crypto, or server configs.
Frequently Asked Questions
Is it safe to generate private keys in a browser?
The generation happens entirely locally using the Web Crypto API — the same engine browsers use for TLS — and nothing is sent over the network. That said, for production secrets we recommend generating keys in a controlled server environment or HSM; use this tool for development, testing, and learning.
RSA or EC — which should I choose?
EC (P-256) keys are much smaller and faster while offering security roughly equivalent to RSA-3072. RSA remains more universally supported by older systems. For new projects with modern tooling, EC is usually the better default.
Why are there separate signing and encryption RSA options?
Web Crypto requires a key's algorithm to be fixed at generation time. RSASSA-PKCS1-v1_5 keys can only be used to sign/verify (e.g. JWT), while RSA-OAEP keys can only be used to encrypt/decrypt.