How to use RSA Key Generator
The RSA Key Generator creates a fresh RSA public/private key pair in standard PEM format using the browser's native Web Crypto API. Choose between 2048-bit (fast, widely compatible) and 4096-bit (maximum security) key sizes. The private key is generated and displayed only in your browser and is never transmitted to any server.
- Select the key size: 2048-bit for standard use or 4096-bit for maximum security.
- Click Generate Key Pair and wait a moment while your browser generates the keys.
- Copy the public key PEM and share it with services that need to encrypt data to you or verify your signatures.
- Copy the private key PEM and store it securely — never share it.
- Use the keys with tools such as openssl, Node.js crypto, or JWT libraries.
Your data never leaves your device — 100% private processing.
RSA key sizes and security levels
RSA security relies on the computational difficulty of factoring large integers. Key size is the primary security parameter: larger keys are harder to factor but slower to generate and use. NIST recommends a minimum of 2048-bit RSA through 2030, with 3072 or 4096-bit for longer-lived keys. A 4096-bit RSA key is not twice as secure as a 2048-bit key — it is roughly equivalent in security margin to an AES-128 key (vs AES-112 for 2048-bit). Generating a 4096-bit key takes several seconds in a browser; 2048-bit is near-instant. For JWT signing and verification in most web applications, 2048-bit RSA or switching to ECDSA (which provides equivalent security with much shorter keys) is the practical recommendation.
| Key size | Security level | Generation time | Recommended use |
|---|---|---|---|
| 1024-bit | ~80 bits | Instant | Deprecated — not secure |
| 2048-bit | ~112 bits | Milliseconds | Standard — TLS, JWT, SSH |
| 3072-bit | ~128 bits | Seconds | Long-term security requirements |
| 4096-bit | ~140 bits | Several seconds | Maximum security, archival keys |
PEM format and key encoding
PEM (Privacy Enhanced Mail) is the most widely used format for storing cryptographic objects. A PEM file is a Base64-encoded DER (Distinguished Encoding Rules) structure wrapped with header and footer lines like -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----. SPKI (SubjectPublicKeyInfo) is the standard DER structure for public keys as exported by the Web Crypto API; PKCS#8 is the standard for private keys. The same PEM files work with OpenSSL, Node.js crypto, Python cryptography, Java KeyStore, and most other crypto libraries. To use a public key for JWT verification in Node.js: crypto.createPublicKey({ key: pemString, format: 'pem', type: 'spki' }). For SSH, you would further convert SPKI to the ssh-rsa format using ssh-keygen.
Worked examples
Generate a key pair
Inputs: 2048-bit
Result: PEM public (SPKI) + private (PKCS#8) key pair
Key size vs time
Inputs: 2048 vs 4096 bit
Result: milliseconds vs several seconds to generate
PEM headers
Inputs: exported public key
Result: -----BEGIN PUBLIC KEY----- … -----END PUBLIC KEY-----
Glossary
- RSA
- Rivest–Shamir–Adleman — an asymmetric cryptographic algorithm based on the difficulty of factoring the product of two large prime numbers.
- PEM
- Privacy Enhanced Mail format — Base64-encoded DER data with -----BEGIN/END----- header and footer lines.
- SPKI
- SubjectPublicKeyInfo — the ASN.1 structure for public keys as defined in X.509; the format exported by Web Crypto for public keys.
- PKCS#8
- A standard syntax for storing private key information, including the algorithm identifier and the private key itself.
- Asymmetric cryptography
- A cryptographic system using mathematically linked key pairs: data encrypted with the public key can only be decrypted with the private key, and vice versa.
Related reading
Frequently Asked Questions
Why use RSA Key Generator?
- Generate 2048-bit or 4096-bit RSA key pairs in PEM format using the browser's Web Crypto API
- Produce SPKI public keys and PKCS#8 private keys compatible with OpenSSL, Node.js, and Java
- Choose the right key size with embedded NIST security level guidance for your use case
- The private key is generated entirely in your browser and never transmitted to any server
Common use cases
- Generate a 2048-bit RSA key pair for RS256 JWT signing in a new authentication service
- Create a 4096-bit RSA key pair for a long-lived code-signing certificate request
- Produce a test key pair to validate asymmetric JWT verification logic in integration tests
- Generate a public/private key pair to prototype RSA encryption in a proof-of-concept feature
- Create a fresh RSA key pair immediately after a private key exposure to rotate credentials
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
JSON ↔ XML Converter
Convert JSON to XML and XML to JSON with formatting. Validate and transform structured data both ways. Free, private, in-browser.
Basic Auth Header Generator
Generate an HTTP Basic Authentication header from a username and password. Get the Base64 Authorization value and a curl snippet, encoded in your browser.
TOTP / 2FA Code Generator
Generate time-based one-time passwords (TOTP) from a secret key online. Compatible with Google Authenticator and 2FA. Free, private TOTP generator.
HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 and a secret key. Uses the Web Crypto API. Free and private.
AES Encrypt / Decrypt
Encrypt and decrypt text with AES-256-GCM and a password. Strong, standards-based encryption in your browser. Free and private.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Explore all Developer Tools.