About the .pem File Generator
This generator creates a fresh 2048-bit RSA key pair and gives you both halves as PEM files - the base64-wrapped, `-----BEGIN-----`-delimited text format that OpenSSL, nginx, Apache, OpenSSH, and virtually every TLS and JWT library expects.
Key generation happens in your browser using the Web Crypto-backed node-forge library. The private key is created on your machine and stays there. That is the only acceptable arrangement for a private key: a key that has travelled across someone else's server is not private any more.
How to use this tool
- Click Generate. Producing a 2048-bit key takes a moment of real computation, so a short pause is expected.
- Copy or download the private key. This is the half you must protect.
- Copy or download the public key. This is the half you distribute - to a server, an identity provider, a CI system, or a colleague.
- Store the private key with restrictive permissions. On Unix, `chmod 600` is the conventional minimum.
What PEM actually is
PEM stands for Privacy-Enhanced Mail, a mostly-forgotten 1990s email standard whose container format outlived it entirely. A PEM file is just DER-encoded binary data rendered as Base64 and wrapped in header and footer lines that say what the payload is meant to be.
That wrapper is the whole reason PEM won. Because the file is printable text, you can paste a key into a config file, an environment variable, a Kubernetes manifest, or a support ticket without anything mangling it. The header line is also how tools know what they are looking at, which is why `BEGIN RSA PRIVATE KEY`, `BEGIN PRIVATE KEY`, and `BEGIN CERTIFICATE` are not interchangeable even though all three are PEM.
Why 2048 bits
2048-bit RSA is the current floor for general use and is what public certificate authorities issue by default. 1024-bit RSA is considered broken and has been rejected by browsers for years. 4096-bit keys are meaningfully slower for every signature and handshake while buying security margin that matters mainly for very long-lived keys.
For most work - TLS certificates, JWT signing, SSH authentication, service-to-service auth - 2048 bits is the correct trade-off. If you are protecting something that must stay confidential for decades, that is the case for going higher.
Handling the private key
Never commit a private key to version control, even in a private repository. Once it is in git history it is effectively public, and removing it means rewriting history and rotating the key anyway.
Do not paste a private key into a chat, an issue tracker, or a log. Distribute only the public half. If you suspect a private key has been exposed, treat it as compromised, generate a new pair, and revoke or replace whatever trusted the old one - keys are cheap and rotating one is far less expensive than the alternative.
Frequently asked questions
- Is a key generated in a browser safe to use in production?
- The cryptography is sound - node-forge draws from the browser's cryptographically secure random number generator, and the key never leaves your machine. The remaining question is your own environment: generate keys on a machine you trust, not on a shared or public computer, and be aware that a compromised browser extension can read page contents. For high-value, long-lived production keys, generating with OpenSSL on a controlled host remains the more conservative choice.
- How do I get a certificate from this key?
- You need a Certificate Signing Request, not just a key. Our CSR generator produces a CSR and its matching private key together, which is what a certificate authority asks for.
- Can I use this key for SSH?
- The private key works directly. OpenSSH wants the public half in its own single-line `ssh-rsa AAAA...` format rather than PEM, so convert it with `ssh-keygen -y -f your-key.pem` before appending it to `authorized_keys`.
- Why is there no passphrase option on the private key?
- The tool emits an unencrypted PKCS#1 key, which is what most servers and libraries load directly. To add a passphrase, run `openssl rsa -aes256 -in key.pem -out key-encrypted.pem` locally afterwards.