RSA Key Pair Generator
Generate RSA public & private key pairs — 1024, 2048, or 4096-bit
How to Use the RSA Key Pair Generator
- Select the key size (2048 or 4096 bits).
- Choose the hash algorithm (SHA-256, SHA-384, or SHA-512).
- Click Generate Key Pair to create the RSA public and private keys.
- Copy or download the keys as .pem files.
RSA key generation uses the Web Crypto API for secure, browser-native key pair creation. Private keys never leave your browser. Use 4096-bit keys for maximum security.
What is RSA Key Pair Generator?
RSA is an asymmetric cryptographic algorithm that generates a public/private key pair. Public keys encrypt data; private keys decrypt it. RSA keys are used in SSH authentication, SSL certificates, JWT signing, and API security.
Common Uses
- Generating SSH key pairs for server access
- Creating keys for JWT RS256 signing
- Testing asymmetric encryption implementations
- Generating self-signed certificate keys
Frequently Asked Questions
What is RSA Key Generation?
RSA is an asymmetric cryptographic algorithm that generates a public/private key pair. Public keys encrypt data; private keys decrypt it. RSA keys are used in SSH authentication, SSL certificates, JWT signing, and API security.
Why use Aya Corporation?
Private key generation must never happen on a remote server — the server could log or store your key. Aya Corporation generates RSA key pairs entirely in your browser using the Web Crypto API. Your private key never leaves your device.
When to use
Generating SSH key pairs for server access, creating keys for JWT RS256 signing, testing asymmetric encryption implementations, or generating self-signed certificate keys.
Notes from this implementation
What gets generated in the browser
The page asks the Web Crypto API, or the bundled RSA routine, for a key pair and prints PEM. The modulus size you pick is the security parameter. 2048-bit is the smallest size you should export for a new key. 1024-bit pairs still appear in old tutorials; they are factorable by well-funded attackers and should be treated as a demo, not a certificate.
Generation uses your browser’s randomness. If you are on a machine you do not trust, the private key is already compromised the moment it is displayed, because anything that can read the page can read the PEM. Download it and clear the page. Do not send the private PEM through chat “just to test.”
What this page does not do
It does not wrap the key in a passphrase-encrypted PKCS#8 unless the form says so, and it does not submit a CSR to a certificate authority. The public key is the part you put in a server or a JWT kid document. The private key stays with the signer. The encrypt/decrypt page can exercise the pair; it is not a replacement for openssl in a release pipeline.