Signing Key Generator
Generate RSA, ECDSA and Ed25519 signing key pairs locally in your browser, exported as JWK and PEM. For JWT and application signing — not SSH keys or certificates.
This tool does not generate SSH keys or certificates.
🔒 Keys are generated locally in your browser. The private key is never uploaded.
What does this tool do?
Signing Key Generator creates public/private key pairs in your browser using Web Crypto.
It supports RSA (2048, 3072 and 4096 bits), ECDSA (P-256 and P-384) and Ed25519, and
exports each pair in two formats: JWK (JSON) and PEM (PUBLIC KEY / PRIVATE KEY).
This tool does not generate SSH keys or certificates
The keys produced here are cryptographic signing keys, intended for signing JWTs, application messages and Web Crypto use. They are not OpenSSH keys, TLS certificates or certificate signing requests (CSRs).
Supported algorithms
- RSA — 2048, 3072 or 4096 bits. Broad compatibility; used for RS256 JWTs.
- ECDSA — P-256 or P-384. Smaller keys, used for ES256 / ES384 JWTs.
- Ed25519 — modern, fast and compact; used for EdDSA JWTs. Not available in some older browsers; choose ECDSA if you need maximum compatibility.
JWK vs PEM
- JWK is the JSON format used directly by Web Crypto and JWT libraries. It carries every parameter of the key in a single object.
- PEM is the base64 text format used by OpenSSL, nginx, and most server tooling.
The private key is exported as PKCS#8 (
PRIVATE KEY), the public key as SPKI (PUBLIC KEY) — standard formats, not a custom encoding.
When to use signing keys
- Signing JWTs (RS256, ES256, ES384 or EdDSA).
- Signing webhook responses or API payloads with your own public/private pair.
- Setting up asymmetric verification in services that accept JWK or PEM.
How it works
Keys are generated locally with your browser’s cryptographically secure random number generator (CSPRNG). The private key never leaves your device.
Privacy
Everything runs locally in your browser. Nothing is uploaded.