Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
Generates a public/private key pair in the browser and exports it as OpenSSH, PEM (SPKI and PKCS#8) or JWK. Ed25519, ECDSA P-256/P-384 and RSA 2048/3072/4096, all produced by the browser’s own WebCrypto.
Small, fast, modern. The default for SSH since 2014.
Appears at the end of the OpenSSH public key line.
crypto.subtle.generateKey) in this tab, and never leave it — nothing is transmitted, logged or stored. The formats are verified against OpenSSH itself in this project’s test suite. Generate on the machine that will hold the private key when you can; a key that has existed in a browser tab has existed in that tab’s memory.How to use it
Pick the algorithm
Ed25519 for anything new — small, fast, and the SSH default since 2014. ECDSA or RSA when something on the other end demands it.
Generate and choose the format
OpenSSH gives you an `authorized_keys` line and an `openssh-key-v1` private key; PEM gives SPKI and PKCS#8; JWK is for a JOSE library. The same key, three spellings.
Add a passphrase after you save it
The private key is exported unencrypted. Locally: `ssh-keygen -p -f id_key` to add a passphrase, and `chmod 600` so ssh will use the file at all.
Common questions
Is it safe to generate a private key in a browser?
The key never leaves the tab — WebCrypto generates it, nothing is transmitted, logged or stored. But a key that has existed in a browser tab has existed in that tab’s memory, which is a larger surface than a shell. For a key that guards production, generate it on the machine that will hold it.
Why is Ed25519 sometimes missing?
Because that browser’s WebCrypto does not implement it. Support arrived late and unevenly; the page checks at load and hides the option rather than offering something that will fail. ECDSA P-256 is the nearest widely-supported equivalent.
RSA 2048 or 4096?
2048 is still fine and considerably faster to generate and to use. 4096 buys headroom against a future nobody can size, at a real cost in handshake time. If you are choosing RSA for compatibility, 2048 is usually what the other end wanted anyway.
Where does the fingerprint come from?
It is the SHA-256 fingerprint of the public key in the OpenSSH format — the same string `ssh-keygen -lf` prints, so you can compare the two directly.
Feed it from
JWT Decoder
Decodes header and payload, shows claim expiry in local time, and checks the signature against a supplied key.
JWKS Verifier
Fetches a JWKS endpoint, picks the key by kid and verifies a token’s signature and standard claims.
SSH Key Generator
Generates an OpenSSH key pair with a comment and shows the fingerprint. The private key comes out unencrypted — add a passphrase locally with ssh-keygen -p.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
Next
These accept what this tool produces, so the result can go straight in.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
CSR Generator
Generates a certificate signing request and its private key from subject fields and SAN entries.
JWKS Verifier
Fetches a JWKS endpoint, picks the key by kid and verifies a token’s signature and standard claims.
SSH Key Generator
Generates an OpenSSH key pair with a comment and shows the fingerprint. The private key comes out unencrypted — add a passphrase locally with ssh-keygen -p.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.