Before building our RSA key pair generator, we checked two existing tools directly.
A key size that's already been broken, offered with no warning
We checked devglan.com's RSA generator directly: it offers 512-bit keys alongside 1024, 2048, 3072, and 4096, with no indication that 512-bit RSA has actually been factored in the real world and offers essentially no protection. This tool doesn't offer 512-bit or 1024-bit at all — the smallest option is 2048-bit, matching NIST's recommended minimum since 2015.
Not for production, and it says so
cryptotools.net's key generator carries no warning against using its output for a real production service. Generating a live signing or encryption key in a browser tab isn't the same as generating one in a reviewed, offline environment — this tool states that difference clearly instead of leaving you to assume the key is production-ready.
Client-side, and provably correct
We checked devglan.com's page for any disclosure of client-side vs. server-side processing and found none — concerning, especially since the same domain's bcrypt tool explicitly processes hashing on its server. This tool generates keys with crypto.subtle.generateKey entirely in your browser, and we verified the output is genuinely usable: re-importing the exported PEM keys and running an actual sign/verify round-trip through the Web Crypto API confirms they work as real RSA keys, not just PEM-shaped text.
