Free tool

VAPID Key Generator

Generate a VAPID key pair for web push notifications in one click. The keys are created in your browser and never leave your device.

How to use your VAPID keys

Store both keys as environment variables on your server. The public key is also used in your website when a visitor subscribes; the private key must never be shipped to the browser.

1. Subscribe the browser with the public key

// In the browser: subscribe with your PUBLIC key
function urlBase64ToUint8Array(base64) {
  const padding = "=".repeat((4 - (base64.length % 4)) % 4);
  const raw = atob((base64 + padding).replace(/-/g, "+").replace(/_/g, "/"));
  return Uint8Array.from([...raw].map((c) => c.charCodeAt(0)));
}

const registration = await navigator.serviceWorker.register("/sw.js");
const subscription = await registration.pushManager.subscribe({
  userVisibleOnly: true,
  applicationServerKey: urlBase64ToUint8Array("YOUR_VAPID_PUBLIC_KEY"),
});
// Send `subscription` to your server and store it

2. Send pushes from your server with both keys

// Node.js, using the web-push package
import webpush from "web-push";

webpush.setVapidDetails(
  "mailto:you@example.com",
  process.env.VAPID_PUBLIC_KEY,
  process.env.VAPID_PRIVATE_KEY,
);

await webpush.sendNotification(subscription, JSON.stringify({ title: "Hello!" }));

Skip the plumbing

Keys are the easy part. Storing subscriptions, cleaning up expired ones, scheduling, segmenting and tracking delivery is where web push gets hard. notifySphere sends web, Android and iOS push from one dashboard, free up to 1,000 users.

Try notifySphere free

Frequently asked questions

What are VAPID keys?

VAPID (Voluntary Application Server Identification) keys are a public and private key pair that identify your server to browser push services such as those run by Google, Mozilla and Apple. The public key goes in your website's subscribe call; the private key stays on your server and signs every push you send.

Is it safe to generate VAPID keys online?

With this tool, yes. The keys are created by your browser's built-in Web Crypto API and never leave your device: nothing is sent to our servers. Still, treat the private key like a password and keep it out of your code repository.

What format are these keys in?

Both keys use URL-safe base64, the format expected by web-push libraries for Node.js, Python, PHP, Go and Java. The public key is the uncompressed P-256 point (65 bytes) and the private key is the 32-byte P-256 private value.

What happens if I lose or change my VAPID keys?

Existing subscriptions are tied to the public key they were created with. If you change keys, browsers will reject pushes signed with the new key for old subscriptions, so users have to subscribe again. Generate your keys once and store them safely.

Do I need VAPID keys for Firebase Cloud Messaging?

For web push through Firebase Cloud Messaging, Firebase uses a web push certificate, which is a VAPID key pair. You can generate one in the Firebase console or import an existing pair.

More free tools: WhatsApp Link Generator · All tools