Is it safe to paste my private key here?

Yes. Every operation runs 100% client-side using the browser Web Crypto API. Your key material never leaves your device — there are no API calls, no server-side processing, and no storage. You can verify this in your browser Network tab.

Which algorithm should I choose: RSA, EC, or Ed25519?

Ed25519 is recommended for new systems — it is the fastest, most secure, and has the smallest keys (32 bytes). EC P-256 offers wide compatibility with TLS and JWT. RSA 2048 is the minimum for legacy systems that require RSA support.

What are PEM, DER, JWK, and OpenSSH key formats?

PEM is the most common text-based format with -----BEGIN----- markers containing Base64-encoded DER. DER is the binary encoding. JWK (RFC 7517) represents keys as JSON objects, common in JWT and OAuth. OpenSSH uses a base64 wire-format with type prefixes like ssh-rsa or ssh-ed25519.

What is a key fingerprint and when is it used?

A fingerprint is a short hash that uniquely identifies a public key. Common uses include verifying SSH host keys, confirming PGP key identity, TLS certificate pinning, and auditing authorized keys. The toolkit computes SHA-256, SHA-1, MD5, SSH-style, and JWK thumbprint (RFC 7638) encodings.

Why does RSA key generation take a few seconds?

RSA key generation requires finding two large prime numbers, which is computationally intensive. The toolkit runs this in a Web Worker so the UI stays responsive. Ed25519 and EC keys generate near-instantly because they do not require prime search.

Security & Auth

Key Toolkit

Free online crypto key toolkit. Generate RSA, EC (P-256/P-384/P-521), and Ed25519 key pairs. Inspect, validate, extract public keys, and compute fingerprints (SHA-256, SSH-style, JWK thumbprint). Convert between PEM, DER, JWK, and OpenSSH. 100% client-side — your keys never leave your browser.

Open tool

Quick reference

Category: Security & Auth
Runs in: Browser
Data stored: Nothing
Price: Free
Sign-up: Not needed

Browse categories

All features

Generate RSA, EC (P-256/384/521), Ed25519, and X25519 key pairs
Inspect and validate PEM, DER, JWK, and OpenSSH keys
Extract public key from a private key
Compute SHA-256, SHA-1, MD5, SSH-style, and JWK thumbprint fingerprints
Compare two keys side-by-side with Randomart visualization
Saved keys vault with optional passphrase encryption (PBKDF2)

What you can do

Generate key pairs

Create RSA (2048/3072/4096), EC (P-256/P-384/P-521), or Ed25519 key pairs in PEM, DER, JWK, or OpenSSH format for SSH, TLS, JWT signing, or encryption.

Inspect any key

Paste a PEM, DER, JWK, or OpenSSH key to validate it and see its type, algorithm, key size, detected format, and JWK representation instantly.

Compute fingerprints

Get SHA-256, SHA-1, MD5, SSH-style, and JWK thumbprint (RFC 7638) fingerprints plus OpenSSH Randomart visualization for key identification and pinning.

Compare two keys

Paste two keys side-by-side to verify they share the same public key. Compare Randomart patterns and SHA-256 fingerprints to detect key substitutions.

Extract a public key

Derive the public key from a private key in PEM, JWK, or OpenSSH format — useful for SSH authorized_keys, sharing for verification, or configuring JWT verification.

Save and manage keys

Store generated keys in the built-in vault with labels and optional passphrase encryption (PBKDF2). Load, copy public keys, or delete saved keys at any time.