Make a signing key pair for JWTs or APIs

You need an RSA or EC key pair to sign tokens in a dev environment — here is the browser-local way that does not touch openssl or a server.

Tools used in this guide

The job

Testing RS256 JWTs or provisioning a service account needs a public/private key pair. A browser WebCrypto call generates real keys — the private half never leaves the tab.

Generate and export

Pick RSA-2048/4096, ECDSA P-256, or Ed25519 (where the browser supports it), then generate. Both halves download as PEM — SPKI for public, PKCS#8 for private — ready for JWKS endpoints, env vars, or openssl.

Ed25519 is unavailable on some engines — the option greys out after the support check.
Save the private key immediately; it exists only in tab memory.

Worked example

Local JWKS dev: generate RSA-2048, put public-key.pem behind your mock /jwks.json route, sign test tokens with private-key.pem, and the whole flow runs without a cloud key service.

Limits

Dev keys, not production custody — there is no passphrase on the PKCS#8 and no audit trail. The PEM is the standard form; JWK and OpenSSH formats are not produced.