RSA & ECDSA Key Pair Generator

Key pairs in every format .NET needs: PEM, JWK with kid, XML, OpenSSH. Generated locally.

Runs locally · nothing uploaded
Keys made here are fine for development and testing. Production signing keys belong in a key vault or HSM (Azure Key Vault, AWS KMS, ...), generated there and ideally never exported. Nothing on this page is stored or sent: close the tab and the keys are gone.
Key type

Private key 
Public key



Fingerprints
Use it in .NET






What it does
Pick a key type and get a fresh key pair, generated by your browser’s WebCrypto API:
  • RSA 2048, 3072 or 4096 bits for RS256/384/512 (PKCS#1 v1.5), PS256/384/512 (PSS) or RSA-OAEP encryption.
  • ECDSA P-256, P-384 and P-521 (ES256, ES384, ES512).
  • Ed25519 when your browser supports it (detected automatically).
Every key is shown as PEM (PKCS#8 private, SPKI public), JWK with kid set to the RFC 7638 thumbprint, a ready JWKS, and OpenSSH public key. RSA keys are also available as PKCS#1 (RSA PRIVATE KEY / RSA PUBLIC KEY) and as .NET Framework <RSAKeyValue> XML, padded the way RSAParameters requires. A sign/verify (or encrypt/decrypt) round trip checks every new pair, and the SHA-256 SPKI, JWK and OpenSSH fingerprints are listed.
Use it in .NET
The Use it in .NET panel gives C# for the key you have: validating JWTs with AddJwtBearer and RsaSecurityKey / ECDsaSecurityKey (with the right kid and algorithm), issuing tokens with JsonWebTokenHandler, loading and converting keys with ImportFromPem, RSA-OAEP encryption with its size limit, and the .NET Framework XML route.
Convert existing keys
Switch to Convert a key and paste or drop a PEM (PKCS#8, SPKI, PKCS#1, SEC1 EC PRIVATE KEY), an X.509 certificate, a JWK / JWKS or <RSAKeyValue> XML to get all the other formats.
Privacy
Keys are generated and converted in your browser and never sent anywhere. Private keys are not saved, not even in local storage; only your option choices are remembered. Browser-generated keys suit development and testing; keep production keys in a vault or HSM.