# Signing Key Generator

> Generate RSA, ECDSA and Ed25519 signing key pairs locally in your browser, exported as JWK and PEM. For JWT and application signing — not SSH keys or certificates.

Canonical: https://host-tools.com/tools/signing-key-generator/

---

## What does this tool do?

Signing Key Generator creates public/private key pairs in your browser using Web Crypto.
It supports RSA (2048, 3072 and 4096 bits), ECDSA (P-256 and P-384) and Ed25519, and
exports each pair in two formats: **JWK** (JSON) and **PEM** (`PUBLIC KEY` / `PRIVATE KEY`).

## This tool does not generate SSH keys or certificates

The keys produced here are **cryptographic signing keys**, intended for signing JWTs,
application messages and Web Crypto use. They are **not** OpenSSH keys, TLS certificates
or certificate signing requests (CSRs).

## Supported algorithms

- **RSA** — 2048, 3072 or 4096 bits. Broad compatibility; used for RS256 JWTs.
- **ECDSA** — P-256 or P-384. Smaller keys, used for ES256 / ES384 JWTs.
- **Ed25519** — modern, fast and compact; used for EdDSA JWTs. Not available in some
  older browsers; choose ECDSA if you need maximum compatibility.

## JWK vs PEM

- **JWK** is the JSON format used directly by Web Crypto and JWT libraries. It carries
  every parameter of the key in a single object.
- **PEM** is the base64 text format used by OpenSSL, nginx, and most server tooling.
  The private key is exported as PKCS#8 (`PRIVATE KEY`), the public key as SPKI
  (`PUBLIC KEY`) — standard formats, not a custom encoding.

## When to use signing keys

- Signing **JWTs** (RS256, ES256, ES384 or EdDSA).
- Signing webhook responses or API payloads with your own public/private pair.
- Setting up asymmetric verification in services that accept JWK or PEM.

## How it works

Keys are generated locally with your browser's cryptographically secure random number
generator (CSPRNG). The private key never leaves your device.

## Privacy

Everything runs locally in your browser. Nothing is uploaded.