Generating RSA Key Pairs in Browser Memory (Web Crypto API & PEM Security)

Asymmetric cryptography is the foundation of digital identity, TLS/SSL certificates, SSH authentication, and JWT signing. RSA (Rivest–Shamir–Adleman) remains one of the most widely implemented asymmetric cryptosystems. However, developers generating RSA key pairs using unverified online key generators face severe cryptographic risks.

Cryptographic Axiom: Never generate a private key on a third-party server. If a remote server creates your private key, the key is compromised before it is ever used.

The Risk of Server-Side RSA Key Generation

When an online utility generates RSA key pairs on its server, the server generates both the Public Key and Private Key. Even if the website claims "keys are deleted immediately", you have zero architectural proof that the private key was not recorded in server memory, written to log files, or retained for decryption. An compromised private key allows attackers to decrypt private payloads, forge digital signatures, and impersonate your identity.

Generating High-Entropy RSA Keys Locally with Web Crypto

Modern web browsers feature a built-in cryptographic engine: the Web Crypto API (window.crypto.subtle). It leverages operating system hardware entropy sources to generate cryptographically secure keys directly in local RAM.

// Pure client-side RSA-OAEP key pair generation using Web Crypto API
async function generateRSAKeyPairLocally(keySizeBits = 2048) {
  const keyPair = await window.crypto.subtle.generateKey(
    {
      name: "RSA-OAEP",
      modulusLength: keySizeBits,
      publicExponent: new Uint8Array([1, 0, 1]), // 65537
      hash: "SHA-256",
    },
    true, // Extractable
    ["encrypt", "decrypt"]
  );

  return keyPair; // Contains local publicKey and privateKey objects
}

PEM Encoding: PKCS#8 vs SPKI

Once generated in memory, keys are formatted into standard PEM (Privacy-Enhanced Mail) text format:

• Private Key Format (PKCS#8): Enclosed between -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----.
• Public Key Format (SPKI): Enclosed between -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----.

Generate RSA Keys Privately in Your Browser

Generate 2048-bit or 4096-bit RSA keys safely with our client-side RSA Key Pair Generator. It operates 100% in local memory using the Web Crypto API, guaranteeing your private keys never touch a remote server.

Frequently Asked Questions

What key size should I choose: 2048-bit or 4096-bit RSA?

2048-bit RSA is the current industry standard, offering strong security with fast computation. 4096-bit RSA provides maximum long-term cryptographic protection, recommended for high-security master keys and certificate authorities.

Can SecureDevUtils see my generated RSA private key?

No. All RSA key generation takes place inside your browser's local RAM via the Web Crypto API (window.crypto.subtle). SecureDevUtils has no backend server or database, making key access impossible.

What is the difference between asymmetric and symmetric encryption?

Symmetric encryption (e.g. AES) uses a single secret key for both encryption and decryption. Asymmetric encryption (e.g. RSA) uses a public key to encrypt data and a corresponding private key to decrypt it.