What this SSL key generator does
Every HTTPS website, signed JWT and TLS handshake rests on a single mathematical idea:
a pair of keys that belong together. This tool creates that pair on the spot using your
browser’s built-in window.crypto.subtle.generateKey() — the same
vetted cryptosystem that powers the rest of the web platform. You pick an algorithm and an
output format, click once, and get a matching public key (safe to share)
and private key (kept secret) ready to paste into a server config or a CSR.
The public key encrypts data and verifies signatures; the private key decrypts and signs. Because they are linked by a one-way mathematical relationship, you can hand out the public half freely without ever exposing the private half. That asymmetry is what lets a stranger’s browser trust your server without you sharing a secret in advance.
A worked example
Suppose you are setting up TLS on a modern Nginx box. Choose ECDSA with the
P-256 curve and PEM output, then generate. You’ll get a
short private key wrapped in -----BEGIN PRIVATE KEY-----. Save it as
private.pem, build a CSR with
openssl req -new -key private.pem -out request.csr, and submit that CSR to a
Certificate Authority such as Let’s Encrypt. The CA signs it and returns your certificate —
your private key never leaves your machine at any step.
Choosing an algorithm and size
| Choice | Best for | Trade-off |
|---|---|---|
| ECDSA P-256 | New servers, APIs, mobile | Tiny, fast; needs a modern client |
| ECDSA P-384 / P-521 | High-security or long-lived keys | Slightly slower handshakes |
| RSA 2048 | Broad compatibility, the default | Larger keys than ECDSA |
| RSA 4096 | Legacy systems needing extra margin | Noticeably slower to generate and sign |
A 256-bit elliptic-curve key offers security comparable to a 3072-bit RSA key while being a fraction of the size — which is why ECDSA is the modern default. Reach for RSA only when something in your stack still demands it.