There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to generate a key pair
- Pick an algorithm. Choose RSA, ECDSA, or Ed25519, and the size or curve.
- Choose a use. Select signing or encryption so the correct key usages are set.
- Generate. A fresh key pair is created locally with Web Crypto.
- Export. Download or copy the public and private keys as PEM or JWK.
A key pair underpins signing, TLS, SSH, and token verification: the private key stays secret, the public key is shared, and math ties them together. Generating one locally means the private half is born on your device and never transits a network you don't control.
Algorithm choice is mostly about compatibility and size — Ed25519 for lean modern signatures, ECDSA P-256 for broad support, RSA where mandated. Setting the intended use (sign vs. encrypt) tags the key with correct usages so libraries accept it.
After generating, verify tokens signed by the key in the JWT decoder, reshape it with the Key converter, or inspect a certificate that wraps a public key in the X.509 decoder.
Frequently asked questions
Which algorithm should I choose?
Ed25519 is a great modern default for signing — fast and compact. ECDSA (P-256) is widely supported, and RSA is the choice when a system specifically requires it or you need encryption.
What's the difference between PEM and JWK?
PEM is the Base64 block format most servers and OpenSSL expect; JWK is the JSON representation used in web/JOSE stacks. This tool exports either from the same key.
Is the private key generated safely?
The pair is generated by the browser's Web Crypto on your machine and shown only to you — no server generates or sees the private key, so its secrecy stays under your control.