Key Generation

How it works

Everything comes from crypto.subtle.generateKey() in the Web Crypto API: symmetric keys (AES-GCM and HMAC) are exported raw and shown as hex and base64, while RSA and ECDSA pairs are exported as PEM, the armored text format OpenSSL and SSH use. Generation happens in your browser and nothing is transmitted anywhere.

Where real keys should be made

Browser generation is right for learning, one-off tokens, and throwaway pairs. For production, generate a key on the machine that will use it, or inside a secrets manager, so the private half never travels through a clipboard or a browser tab. The same logic says never paste a production private key into any web tool, including this one.

Sizes, briefly

AES-128 is already strong; AES-256 is the default because the cost is negligible. RSA keys here are 2048 bits with OAEP and SHA-256, the practical minimum, with 3072 bits the next step if the data must stay confidential into the 2030s. ECDSA P-256 delivers comparable security with far smaller keys and faster operations, which is why modern protocols prefer it.

Handling keys

Symmetric keys and private keys are secrets. Move one straight into your password manager, environment config, or vault, and never commit it to a repository. If a key may have leaked, rotate it: generating a replacement takes seconds, and that is the point of the button above.