Security

RSA Key Pair Generator

Generate RSA public/private key pairs in PEM format — 2048, 3072, or 4096-bit, all in-browser

Key Configuration

Key Size (bits)

Key Usage

100% in-browser — Keys are generated locally using the Web Crypto API. Nothing is transmitted or stored.

What is RSA?

RSA (Rivest–Shamir–Adleman) is the most widely-used asymmetric (public-key) cryptographic algorithm. It relies on the practical difficulty of factoring the product of two large prime numbers. RSA underpins TLS/HTTPS, SSH, S/MIME, code signing, and VPN certificates.

Every RSA key pair consists of a public key (safe to share) and a mathematically linked private key (must stay secret). Data encrypted with the public key can only be decrypted with the private key, and vice versa.

Key Size Guide

Key Size	Security Level	Use Case	Performance
1024-bit	Broken	Legacy only — do not use	Fast
2048-bit	Acceptable	General TLS, SSH keys (minimum recommended)	Fast
3072-bit	Strong	CA certificates, long-lived keys	Moderate
4096-bit	High Security	Root CAs, sensitive infrastructure, long-term keys	Slower

NIST recommends a minimum of 2048-bit RSA through 2030. For new deployments consider 4096-bit or migrating to elliptic-curve (ECDSA/Ed25519) for better performance at equivalent security.

RSA Use Cases

TLS / HTTPS

Server certificates use RSA public key; private key stays on the server for the TLS handshake.

SSH Authentication

Public key added to ~/.ssh/authorized_keys; private key authenticates the client.

Code Signing

Developer signs with private key; recipients verify authenticity with the public key.

VPN Certificates

IPsec and SSL VPNs use RSA certificates for peer authentication and key exchange.

S/MIME Email

Encrypt email to recipient's public key; recipient decrypts with their private key.

Cisco Crypto RSA

crypto key generate rsa modulus 2048 — generates an RSA pair for SSH on IOS.

PEM Format Explained

PEM (Privacy Enhanced Mail) is the standard Base64-encoded text format for cryptographic keys and certificates. Each file is bookended by ASCII header/footer lines.

Header / Footer	Contains
-----BEGIN PUBLIC KEY-----	SPKI-encoded RSA public key (SubjectPublicKeyInfo)
-----BEGIN PRIVATE KEY-----	PKCS#8-encoded RSA private key (unencrypted)
-----BEGIN RSA PRIVATE KEY-----	PKCS#1 legacy format (OpenSSL traditional)
-----BEGIN CERTIFICATE-----	X.509 certificate (contains the public key + identity)

This tool generates PKCS#8 private keys and SPKI public keys — the modern standard compatible with OpenSSL, Node.js, Java, Python, and most current libraries.

Common OpenSSL Commands

Command	Purpose
openssl genrsa -out private.pem 4096	Generate 4096-bit RSA private key (PKCS#1)
openssl rsa -in private.pem -pubout -out public.pem	Extract public key from private key
openssl rsa -in private.pem -text -noout	Inspect key details (modulus, exponent)
openssl rsa -check -in private.pem	Verify private key integrity
openssl pkcs8 -topk8 -nocrypt -in priv.pem -out pkcs8.pem	Convert PKCS#1 → PKCS#8 format
openssl rsautl -encrypt -inkey pub.pem -pubin -in f.txt -out f.enc	Encrypt a file with public key
openssl rsautl -decrypt -inkey priv.pem -in f.enc -out f.txt	Decrypt a file with private key