RSA key pair generator

What is an Rsa Key Pair Generator?

RSA is the most widely used public-key algorithm. A key pair has a public key, which you can share, and a private key, which must stay secret. Data encrypted with the public key can only be decrypted with the private key, and signatures created with the private key can be verified by anyone with the public key. This generator creates RSA key pairs in standard PEM format.

How to use it

  1. Choose the key size: 2048 bits is the minimum recommended, 3072 or 4096 bits gives a larger security margin.
  2. Generate the key pair.
  3. Copy the public and private keys, and store the private key securely.

Output format

The public key begins with -----BEGIN PUBLIC KEY----- (SubjectPublicKeyInfo format) and the private key with -----BEGIN PRIVATE KEY----- (PKCS#8) or -----BEGIN RSA PRIVATE KEY----- (PKCS#1). Both are Base64-encoded DER data. Most libraries, such as Node.js crypto, OpenSSL, Java and Python cryptography, read these formats directly.

Common uses

  • Signing and verifying JWTs with RS256.
  • Testing encryption and signature code during development.
  • Configuring service-to-service authentication.

OpenSSL equivalent

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem
openssl pkey -in private.pem -pubout -out public.pem

Security notes

  • Keys are generated with the browser's Web Crypto API and never leave your device.
  • For production secrets, generating keys on the server or in a key management service (KMS, HSM) is best practice.
  • For SSH logins use the SSH key generator; SSH uses a different public key format.
  • For new systems, consider Ed25519 or ECDSA, which offer equal security with much smaller keys.

Frequently Asked Questions

Which RSA key size should I use?

At least 2048 bits. 3072 or 4096 bits provide a larger safety margin at the cost of slower operations.

What is the difference between PKCS#1 and PKCS#8?

PKCS#1 stores only an RSA key, labelled RSA PRIVATE KEY. PKCS#8 is a generic container for any algorithm, labelled PRIVATE KEY.

Can I use these keys for JWT RS256?

Yes. Sign with the private key and verify with the public key.

Is it safe to generate keys in the browser?

The keys are created locally with the Web Crypto API and are not uploaded. For high-value production keys, generate them in a secure server environment or key management service.

You May Also Need