OneFreePlace
TOOL #375 · RSA KEY CEREMONY & EXPORT LAB

RSA Key Pair Generator

Generate RSA keys entirely in your browser, choose the intended cryptographic purpose, self-test the pair, inspect fingerprints and RFC 7638 thumbprints, and export interoperable SPKI, PKCS#8, PKCS#1, JWK and OpenSSH public-key formats. Private material never leaves the page.

RSA 2048 / 3072 / 4096OAEP / PSS / PKCS#1 v1.5SHA-256 / 384 / 512Automatic pair self-testSPKI + PKCS#8 PEMPKCS#1 conversionJWK + RFC 7638 thumbprintOpenSSH public keyEncrypted private-key backup100% local
Private-key handling: generated keys are exportable because this tool is designed for interoperability. For long-lived production secrets, follow your organization’s key-management policy and consider a hardware-backed/non-exportable key store.
Purpose—
Modulus—
Public exponent—
Generation time—
Self-test—
SPKI SHA-256—
RFC 7638 kid—
OAEP max payload—

Public key · SPKI PEM

Shareable

Private key · PKCS#8 PEM

Secret

Pair self-test

Waiting for generationThe tool will prove that the generated pair can perform its selected operation.

Purpose-aware guidance

RSA-OAEP keys are generated for encrypt/decrypt. Use hybrid encryption for large data: RSA should normally encrypt a random symmetric key, not whole files.
Private formats are masked until you explicitly reveal them.

Public JWK

Private JWK

Secret

PKCS#1 public key

PKCS#1 private key

Secret

OpenSSH public key

Public-key conversion only. This tool does not create an OpenSSH private-key container.

Public key inspector

Status
Generate a key pair to inspect it.

Create encrypted private-key backup

Wrap the generated private JWK in a OneFreePlace JSON backup using PBKDF2-SHA-256 + AES-256-GCM. This is a portable OneFreePlace backup format, not encrypted PKCS#8.

Encrypted backup JSON

Waiting

Verify / restore a backup

Restored-key inspection

Status
Nothing restored yet.

OpenSSL · RSA-OAEP-style key material

Node.js · generateKeyPairSync
Web Crypto · current selection
Format map
SPKI is the standard public-key wrapper. PKCS#8 is the standard private-key wrapper. PKCS#1 stores raw RSA key structures. JWK is JSON-native. The OpenSSH output here is public only.


Choose purpose first
RSA-OAEP is for encryption/decryption. RSA-PSS is the modern RSA signature scheme. PKCS#1 v1.5 signatures remain common for compatibility. A key can be mathematically convertible, but APIs and protocols intentionally bind keys to usages.
Use hybrid encryption
RSA-OAEP has a small message limit. Encrypt a random AES key with RSA, then encrypt the real data with an authenticated symmetric cipher such as AES-GCM.
Key sizes
This tool offers 2048, 3072 and 4096-bit RSA. Larger keys cost more CPU and create larger signatures/ciphertexts. Follow the requirements of your target protocol and security policy.
Fingerprints and kid values
The SPKI SHA-256 fingerprint identifies the encoded public key. The RFC 7638 JWK thumbprint hashes a canonical representation of the RSA public parameters and is useful for stable key IDs.
Private keys are secrets
Copying or downloading an unencrypted PEM/private JWK exposes the private key to any process that can read that file. Protect it like a password.
Privacy
Generation and exports use the browser Web Crypto API. The package has no remote libraries, analytics or network dependencies.