ECDSA Key Pair Generator — P-256 / P-384 / P-521, PEM & JWK

P-256 (also called secp256r1 or prime256v1) is the default — fast, widely supported, and provides 128-bit security. Use it unless you have a specific reason to go higher. P-384 gives 192-bit security and is required by some government profiles (Suite B TOP SECRET). P-521 is rarely necessary and has slightly awkward performance because 521 bits doesn't align to word boundaries.

Same key material, different math. ECDSA uses the key pair to produce and verify signatures. ECDH uses two key pairs (yours + the peer's) to derive a shared secret without ever transmitting it — that shared secret is then usually fed into a KDF (HKDF, PBKDF2) and used as a symmetric key. If you need signing, pick ECDSA; if you need key agreement / hybrid encryption, pick ECDH.

P-256 → ES256, P-384 → ES384, P-521 → ES512. Most JWT libraries detect this automatically from the JWK 'crv' field. Note that ES256K (secp256k1, Bitcoin's curve) is NOT included here — the Web Crypto API doesn't expose it. If you need secp256k1, use a dedicated library like noble-curves.

Because elliptic-curve cryptography reaches equivalent security with far smaller keys. A 256-bit EC key gives roughly the same security as a 3072-bit RSA key. Smaller keys mean smaller signatures, less bandwidth, faster handshakes — which is why TLS, SSH, and modern JWTs increasingly default to EC.

No. crypto.subtle.generateKey() runs entirely in your browser. You can verify with DevTools Network panel — Generate produces no network traffic. Once you close the tab, the private key is gone.