Generate a new keypair and a PKCS#10 certificate signing request (CSR) locally in your browser - RSA or ECDSA. Nothing is uploaded.
Running locally on your device ...
Fill in the fields and generate the CSR
Running locally on your device ...
0%
Your files never left your device
No. Everything runs in your browser - your file never leaves your device. How this is verifiable
A Certificate Signing Request (CSR) is the first step to getting a real X.509 certificate from a Certificate Authority (CA): you generate a new keypair, package the public key together with your details (domain name, organization, country) into a PKCS#10 request, sign it with the matching private key, and send ONLY the request to the CA. This tool generates exactly those two files - the CSR and the private key - directly in your browser.
Choose between RSA (2048 or 4096 bits, broadly compatible) and ECDSA (P-256 or P-384, shorter keys, long supported by modern certificate authorities); plus Common Name (the domain, e.g. example.com), Organization, Organizational Unit, Country, State/Province, Locality and Email - every field except the Common Name is optional. The keypair is generated with your browser's native Web Crypto API (crypto.subtle.generateKey); the actual PKCS#10 structure is built by the @peculiar/x509 2.0.0 library through real ASN.1 encoding - no hand-rolled bytes.
You get two files: the CSR as a .pem to submit to your CA (also shown directly as text, ready to paste into a web form) and the freshly generated private key as a PKCS#8 .pem to keep safe. Both files are consistent with each other - the signature embedded in the CSR was produced with exactly this private key, which any standard library can verify.
Honestly framed: the private key is generated fresh in this tab from your browser cryptographic randomness and provably never leaves your device - this tool contacts no certificate authority and sends nothing to any server. That is exactly why keeping it safe is your own responsibility: there is no server-side backup, by design. Generate a key for real production infrastructure only on a device/browser you trust, and submit only the CSR to your CA - never the private key.
| Input formats | No file (generator) |
|---|---|
| Output format | PEM |
| Batch processing | No |
| Processing | Locally in your browser (JavaScript) |
| File upload | None |
Limitations: Generates only the request and the keypair - no finished certificate is produced here, that is issued exclusively by your certificate authority after their review. The private key is shown/downloaded to you exactly once and is not stored afterwards; if it is lost, a new CSR must be generated. There is no server-side backup - safekeeping is entirely your responsibility.
| Type | Key size | Speed | Compatibility | Recommendation |
|---|---|---|---|---|
| RSA (2048-bit) | long | slower | very broad, even older systems | minimum size, accepted almost everywhere |
| RSA (4096-bit) | longest | slowest | very broad, even older systems | extra security margin |
| ECDSA (P-256) | short | very fast | modern CAs/software | default choice when unsure |
| ECDSA (P-384) | short-medium | very fast | modern + many government/enterprise systems | when NIST P-384 is required |
No. It is generated and stays in this tab; the tool sends nothing to any server or certificate authority.
Submit it to your certificate authority - they verify your details and then issue you the finished certificate.
There is no recovery - the key is generated only once and never backed up anywhere. You then have to generate a new CSR with a new keypair.
ECDSA (P-256) is modern, fast, short and supported by practically every current certificate authority/software; RSA (2048-bit) remains the compatible standard for older systems.
No - only the request (CSR) and the keypair are generated; the actual certificate is issued by your certificate authority after their review. Read an existing certificate with the X.509 certificate viewer tool.
View X.509 Certificate · Generate PGP key pair · Decode JWT · UUID generator