RSA Key Generator
Generate a 2048-bit RSA public/private key pair in PEM or JWK format.
Reviewed by the ToolNestr Editorial Team — July 2026
How RSA works
RSA is an asymmetric encryption algorithm that uses two mathematically linked keys: a public key for encryption and a private key for decryption. Data encrypted with the public key can only be decrypted by the corresponding private key, making it safe to share the public key openly.
Named after its inventors Rivest, Shamir, and Adleman (1977), RSA relies on the practical difficulty of factoring the product of two large prime numbers. The key generation process selects two large primes, computes their product (the modulus, n), and derives the public and private exponents. A 2048-bit key, the current standard, uses a 2048-bit modulus which would take an impractical amount of time for classical computers to factor.
Common RSA use cases
SSH Authentication
RSA key pairs are the most common method for passwordless SSH login. The public key is added to ~/.ssh/authorized_keys on the server, while the private key stays on the client. SSH uses RSA for both authentication and optional session encryption.
SSL/TLS Certificates
RSA is the most widely used algorithm in X.509 certificates that secure HTTPS websites. Certificate Authorities sign the domain owner's public key, creating a chain of trust. During TLS handshake, the client encrypts a session secret with the server's public key.
PGP / GPG Encryption
Pretty Good Privacy (PGP) and its open-source GNU Privacy Guard (GPG) use RSA key pairs for encrypting emails, files, and messages. Users publish their public key to keyservers and keep their private key in a local keyring, often protected by a passphrase.
Digital Signatures
RSA signatures verify the authenticity and integrity of documents, software packages, and code commits. The signer hashes the content and encrypts the hash with their private key; anyone with the public key can verify the signature by decrypting and comparing the hash.
Tips for using RSA keys
Keep your private key secret
The private key is the cornerstone of your security. Never share it, never commit it to version control, and never paste it into online forms. If a private key is compromised, anyone can decrypt traffic intended for you or impersonate you.
Share only the public key
The public key is designed to be shared freely. Distribute it through public keyservers, include it in your email signature, or add it to servers you need to authenticate to. There is no risk in sharing your public key — it can only be used to encrypt data or verify your signatures.
PEM format for OpenSSL compatibility
PEM (Privacy-Enhanced Mail) is the de facto standard for storing and exchanging cryptographic keys. Files generated here can be used directly with OpenSSL, SSH, and most programming languages. JWK (JSON Web Key) is a newer format useful for web APIs and JavaScript environments.
Consider encrypting the private key
For production use, store your private key encrypted with a strong passphrase. Tools like OpenSSL and GPG can encrypt the key file so it is protected at rest. The key generated here is unencrypted — treat it with the same care as any other sensitive credential.
Understanding RSA key sizes
The size of an RSA key, measured in bits, refers to the length of the modulus (n = p × q). Larger key sizes provide more security because factoring the modulus becomes exponentially harder. However, larger keys also mean slower generation, slower encryption and decryption, and larger output.
| Key Size | Security Level | Generation Time | Recommendation |
|---|---|---|---|
| 2048 bits | 112-bit symmetric equivalent | Fast (<1 second) | Current minimum standard |
| 3072 bits | 128-bit symmetric equivalent | Moderate | Good for future-proofing |
| 4096 bits | ~150-bit symmetric equivalent | Slower (several seconds) | High security environments |
NIST (National Institute of Standards and Technology) recommends 2048-bit RSA as the minimum for secure applications through 2030. Organizations handling extremely sensitive data or planning for long-term security often choose 4096-bit keys. Note that post-quantum cryptography will eventually replace RSA, but for now RSA 2048 and 4096 remain widely trusted.
RSA vs other asymmetric algorithms
While RSA is the most widely recognized asymmetric algorithm, it is not the only option. Modern alternatives like ECDSA (Elliptic Curve Digital Signature Algorithm) and Ed25519 offer equivalent security with much smaller key sizes and faster generation. For example, a 256-bit ECDSA key provides security comparable to a 3072-bit RSA key.
Despite these advantages, RSA remains dominant due to its widespread adoption, extensive library support, and compatibility with legacy systems. SSH, TLS, and PGP all support RSA, and it is the algorithm most familiar to system administrators. The tool uses RSA-OAEP with SHA-256, a modern padding scheme that provides semantic security.
How to use the RSA Key Generator
Select key size and format
Choose 2048 or 4096 bits for the key size, then pick PEM or JWK as the output format. PEM is best for OpenSSL, SSH, and general use. JWK works well for web APIs and JavaScript applications.
Click generate
Press the Generate Key Pair button. Generation happens entirely in your browser using the Web Crypto API. 2048-bit keys generate in under a second; 4096-bit keys may take 5–30 seconds depending on your device.
Copy and save your keys
Copy both keys immediately. Save the public key to a .pub file and the private key to a secure, encrypted location. The keys exist only in your browser's memory and disappear on page refresh.
Related tools
Frequently asked questions
What key size is generated?
The default is 2048-bit, which is the current NIST-recommended minimum for RSA.
What formats are supported?
PEM (base64 with headers) and JWK (JSON Web Key) formats for both keys.
Are the keys stored anywhere?
No — they are generated in your browser and never sent anywhere. Copy them immediately.
Can I generate 4096-bit keys?
Yes — select 4096 for higher security at the cost of slower generation and larger keys.