What's the difference between Personal and Studio?

Personal ($39) is for one person — unlimited use on one active device at a time. Activate on a new device and the old one signs out. Studio ($199) is for teams and commercial client work — unlimited team members, early access to new tools, and a commercial license.

Do I need an account?

No. Use any tool free up to 5 times per day on compute-heavier tools, and unlimited on lightweight ones. No card, no account, no signup required.

Where are my files processed?

Right on your device. Files never upload to any server. Everything runs in your browser — you can verify in DevTools → Network.

What happens if I use my Personal license on a second device?

The new device activates and the old device signs out. Your license key stays the same — you just move it between devices as needed. No limit on how often you switch.

Does this work on my phone?

Yes. Every tool works on iPhone, Android, tablet, and desktop.

What if I want a refund?

30-day money-back guarantee on both tiers. No questions asked. Email sales@cipherforces.com.

Will you add more tools?

Yes. New tools ship regularly. Your license includes every tool we ever release — Studio members get early access.

SecurityFreeBy Daniel BeglaryanUpdated August 2026

CSR & Private Key Generator

Create a private key and certificate signing request (or self-signed cert) right in your browser — no OpenSSL required.

PrivateWorks OfflineNo Account

Your private key is created here and never leaves this device

The key pair is generated inside your browser — no server ever sees it. That also means we can never recover it for you. Download the private key (.key) and store it somewhere safe and secret before you close this tab. Anyone who has this file can impersonate your certificate.

What do you need?

A Certificate Signing Request is what you send to a Certificate Authority (Let’s Encrypt, DigiCert, Sectigo…) to get a trusted, publicly-valid certificate.

Common Name (CN) *

For a TLS certificate this is the exact hostname (or wildcard) the certificate secures.

Organization (O)

Organizational Unit (OU)

City / Locality (L)

State / Province (ST)

Country (C)

Subject Alternative Names (SANs)

One per line (or comma-separated). DNS names, IP addresses, and emails are detected automatically. Modern browsers ignore the CN and match on SANs — the CN above is added here for you if it looks like a hostname.

Key type & size

RSA 2048 is the standard for TLS and generates in a second or two. RSA 4096 is stronger but can take 10–30 seconds in a browser.

Enter a Common Name to begin.

Deep dive

About CSR & Private Key Generator.

Generate a Private Key and CSR — In Your Browser

Fill in your certificate details — common name, organization, organizational unit, locality, state, country, email, and any Subject Alternative Names — and this tool generates a fresh RSA key pair and assembles a Certificate Signing Request (or a self-signed certificate) right on your device. Copy or download the PEM private key and the CSR, then hand the CSR to your Certificate Authority.

Most "online CSR generators" create your private key on their server, which means the one secret that must never be shared has already left your control. This tool never makes a network request: the key is generated locally with the well-tested node-forge library and stays in your browser. We can't see it, log it, or recover it for you — which is exactly the point.

One honest caveat: for a production server, the most careful approach is still to generate the key directly on that machine with OpenSSL so it never travels at all, and RSA 4096 can take 10–30 seconds to generate in a browser. This tool is ideal for convenience, local development, internal services, testing, and learning — the cryptography is identical either way.

Request a public certificate: Generate a CSR to submit to Let's Encrypt, DigiCert, Sectigo, or any Certificate Authority.
Wildcard and multi-domain certs: Add *.example.com plus a list of SANs; DNS names, IP addresses, and emails are detected and de-duplicated automatically.
Local development HTTPS: Create a self-signed certificate for localhost or an internal service in one click, with a configurable validity window.
Internal services and devices: Issue a certificate for an appliance, VPN endpoint, or intranet host that never faces the public web.
Learning and testing: See exactly what a CSR, private key, and self-signed certificate look like without memorizing OpenSSL flags.
Air-gapped key generation: Because nothing is uploaded, you can run it on a disconnected machine and keep the private key fully offline.

Privacy: Everything runs entirely in your browser using node-forge. Your private key, subject details, and finished PEM files never leave your device, are never uploaded, and are never stored — so download and safely back up the private key before you close the tab, because it cannot be recovered.

Three steps