RSA key pair generator
Generate RSA public and private key pairs
TL;DR
What is RSA key pair generator?
RSA is an asymmetric cryptographic algorithm that uses a mathematically linked key pair: a public key for encrypting or verifying, and a private key for decrypting or signing. The public key can be shared openly; the private key must be kept secret. RSA is defined in RFC 8017 (PKCS#1).
How it works
RSA key generation picks two large prime numbers, multiplies them to form the modulus, and derives the public and private exponents from it. The security of RSA rests on the computational difficulty of factoring the modulus back into its primes. Common key sizes are 2048 and 4096 bits.
Common use cases
- ‣TLS/SSL certificates: RSA key pairs underpin HTTPS; the certificate contains the public key and the server holds the private key
- ‣JWT RS256 signing: sign tokens with a private key so any service holding only the public key can verify them
- ‣SSH authentication: add your public key to a server and authenticate without a password
- ‣Code signing: sign software releases with a private key so users can verify authenticity with the public key
Frequently asked questions
What key size should I use?
NIST recommends a minimum of 2048 bits for RSA through 2030. 4096 bits provides a wider security margin at the cost of slower operations. For new systems, consider elliptic-curve alternatives (ECDSA, Ed25519) which achieve equivalent security with much smaller keys.
Is it safe to generate keys in the browser?
This tool uses the browser's Web Crypto API, which generates keys using the operating system's cryptographically secure random number generator. The keys are never sent to a server. For production use, generate keys in a trusted environment and store the private key in a secrets manager or HSM.
See also
- ‣JWT decoder: RS256 and RS512 JWT signing use an RSA private key to sign tokens and the matching public key to verify them
- ‣Encrypt / decrypt text: use RSA public keys for encrypting small payloads such as symmetric keys in hybrid encryption schemes