Generate RSA key pairs for encryption, JWT signing (RS256), and SSL/TLS testing — all in your browser. Private keys never leave this page.
RSA key pairs are used for asymmetric encryption, digital signatures (JWT RS256/RS512), TLS certificate signing, and SSH authentication. The public key encrypts or verifies; the private key decrypts or signs.
RSA-2048 is the current minimum recommendation for production use. RSA-4096 provides a larger security margin but is significantly slower for operations. Use 2048 for most applications and 4096 where long-term security matters.
RSA Key Pair Generator exists to generate an RSA key pair in the browser and copy the PEMs without the private key touching a server. It is not a second copy of the tool homepage. The homepage introduces the whole product. This page stays on one job so a search for that job lands on instructions you can follow without hunting through other tabs. Read the result on this page against the input you actually used. A screenshot without the input is not evidence. If the result surprises you, change one thing and run it again before you change your VPN, browser, or server config.
Work through RSA Key Pair Generator in order. 1. Choose the size you actually deploy, 2048 or 4096. 2. Generate. 3. Copy the private key into the store that will use it. 4. Send only the public key. Write down the input and the output together. When you ask someone for help, send both. Repeat the same input once. A stable tool returns the same answer. If it does not, the input changed or the page is talking to a different network path than you think.
The private key in a chat log is a failed generation. This is not an SSH agent. RSA here is not a JWT signature until you use the key in RookJWT or your own code. Treat the output as a measurement, then decide. RookVPN does not log the contents of a client-side tool, and a measurement is not a promise that every other app on the device behaves the same way. Compare a second path when the decision matters: a terminal command, another browser, or the matching guide linked below.
Example: you generate a pair, paste the public PEM into the service that encrypts to you, and put the private PEM in a password manager or a file with strict permissions. You do not paste the private PEM into the same ticket as the public one to save time.
After you finish RSA Key Pair Generator, open RookJWT if the key is meant to verify a token rather than to exist as a PEM on disk if the next question is different from the one this page answers. Stay here if you are still on the same job. Extra pages help only when they answer a new question, such as a different algorithm, a different leak channel, or a different file type. The documentation link on this page is the long form of the same workflow, including the checks that do not fit in the tool UI.
Yes, when using Web Crypto API as RookTLS does. The key generation uses cryptographic hardware randomness and the private key never leaves your browser tab.
RSA-2048 is the recommended minimum. Use RSA-4096 for certificate authorities or long-lived keys. NIST recommends 2048+ through 2030.
Yes, but export and store the private key securely immediately. Generated keys are not persisted — refreshing the page loses the private key.
No.
2048 is common. 4096 is slower and larger. Match the system you are configuring.
Only if that software accepts the PEM you copied. This page does not install a key on a server.