Web Push VAPID Key Generator
Generate VAPID key pairs for Web Push notifications in your browser. P-256 public and private keys in base64url, free and private.
Loading tool...
What is Web Push VAPID Key Generator?
A VAPID key generator creates the P-256 public/private key pair your server needs to authenticate Web Push notification requests. The public key is shared with push services and browsers, while the private key stays on your server and signs every push call.
Key Benefits
- No server or installation required — keys are generated instantly in the browser
- Cryptographically secure keys from the native Web Crypto API
- base64url output that works with web-push libraries out of the box
- Private by design: nothing is transmitted, logged, or stored
Common Use Cases
- •Setting up Web Push notifications for a website or PWA for the first time
- •Rotating compromised VAPID keys without regenerating them on a server
- •Local development and testing of service-worker push flows
- •Generating per-project keys to keep push credentials isolated
How to Use the VAPID Key Generator
- Generate the pair: Click the Generate Key Pair button to create a new P-256 public and private key pair locally in your browser.
- Copy the public key: Use the Copy button next to the public key and pass it to pushManager.subscribe as the applicationServerKey in your service worker.
- Secure the private key: Copy the private key and store it in a server-side environment variable. Never commit it to source control or expose it in client code.
- Send pushes: Configure your web-push library (such as web-push for Node.js) with both keys and start sending signed notifications to subscribers.
Key Features
- Generates a cryptographically secure P-256 (ECDSA) key pair using the native browser Web Crypto API
- Outputs keys in base64url format — ready to paste into web-push libraries and push services
- 100% client-side: keys never leave your browser and nothing is logged or transmitted
- One-click copy for each key plus JSON download for storing the full pair
- Works offline in any modern browser over HTTPS
Frequently Asked Questions
What are VAPID keys?
VAPID (Voluntary Application Server Identification) keys let your server identify itself to push services when sending Web Push notifications. The pair consists of a public key shared with the push service and a private key used to sign requests.
Are the generated keys sent anywhere?
No. The key pair is generated locally with the Web Crypto API and never leaves your browser. The page keeps working offline once loaded.
Which curve and format does this tool use?
It generates P-256 (secp256r1) ECDSA keys as required by the Web Push specification. The public key is exported in raw 65-byte format and the private key in PKCS#8, both encoded as unpadded base64url strings — exactly what web-push libraries expect.
Can I reuse one key pair for multiple sites?
Yes. A single VAPID pair can sign pushes for any number of domains, though many teams generate a separate pair per project so revoking access stays simple.