RSA Key Pair Generator

CRYPTO PEM RSA
Share:
By Published Updated Last reviewed

Generate 2048, 3072 or 4096-bit RSA key pairs in PEM and JWK, in your browser, with the NIST key-size guidance and the FIPS 186-5 exponent.

RT-CW3-003 · Crypto & Web3
Your browser is too old for this tool’s interactive features. Please update to Safari 13.1, Chrome or Edge 80, Firefox 74 or newer.

RSA Key Pair Generator

Privacy: Key generation runs entirely in your browser via the W3C SubtleCrypto API. The private key never leaves this page. We recommend you generate keys only for non-production use here; for production keys, use ssh-keygen, openssl, or a hardware security module.
Click "Generate keypair" — 4096-bit keys take 15-30 seconds in browser.
Advertisement
After results · AD-W1 Responsive · Post-tool — peak engagement

How to use the RSA key pair generator

Pick a key size

NIST SP 800-57 rates 2048-bit RSA at 112 bits of security, acceptable for protecting data through 2030, and 3072-bit at 128 bits, acceptable beyond. 3072 is the default here. 4096 gives more margin but is slower to generate and use.

Click Generate

The browser's Web Crypto API finds the two primes. How long it takes depends on your device and on luck in the prime search; 4096-bit keys can take noticeably longer, and the page tells you the time it took.

Copy or download the keys

You get the public key as SPKI and the private key as PKCS#8, each in PEM, plus both as JWK. Store the private key with restricted permissions, for example chmod 600 on Linux and macOS.

Use, then rotate

Use these keys for testing and learning. For production, generate keys on the machine or hardware that will use them, with openssl, ssh-keygen or a hardware security module, so the private key never passes through a web page.

Advertisement
After how-to · AD-W2 Responsive

RSA — the algorithm behind half the world's TLS

RSA is a public-key algorithm named after Ron Rivest, Adi Shamir and Leonard Adleman. A key pair rests on two large primes: the public key holds their product, the modulus, and an exponent; the private key holds the information needed to reverse the operation. Its security depends on how hard it is to factor the modulus. The current specification of RSA cryptography is RFC 8017 (PKCS #1 v2.2).

Choosing a key size

NIST SP 800-57 Part 1 Rev. 5 maps RSA key sizes to security strengths: 2048 bits gives 112 bits of security, 3072 gives 128, 7680 gives 192 and 15360 gives 256. Its Table 4 says 112-bit strength is acceptable for applying protection through 2030 and disallowed from 2031, while 128 bits and above remain acceptable. That is why this page defaults to 3072 and labels 2048 with its end date.

"The exponent e shall be an odd, positive integer such that 216 < e < 2256." FIPS 186-5

The public exponent

Every key this page generates uses e = 65537 (0x10001), which satisfies FIPS 186-5. Until 1 October 2026 the page also offered e = 3, which falls below the FIPS 186-5 lower bound; that option has been removed.

PEM, PKCS#8, SPKI and JWK

The keys are the same numbers in different wrappers. PEM is base64-encoded DER between BEGIN and END lines: this page exports the public key as SubjectPublicKeyInfo ("PUBLIC KEY") and the private key as PKCS#8 ("PRIVATE KEY"). A JSON Web Key (RFC 7517) holds the same values as named base64url fields, the form published at JWKS endpoints. OpenSSH uses its own file format; convert with ssh-keygen if you need it.

Alternatives and what comes next

Elliptic-curve keys are much smaller for similar strength: RFC 8032 describes Ed25519 as "intended to operate at around the 128-bit security level", the same as RSA-3072. For the longer term, NIST has published post-quantum standards, ML-KEM for key establishment (FIPS 203) and ML-DSA for signatures (FIPS 204), because a large enough quantum computer would break RSA.

Key sizes by NIST strength, the FIPS 186-5 exponent, and the formats

01

NIST SP 800-57 rates 2048-bit RSA at 112 bits of security and 3072-bit at 128 bits.

02

112-bit strength is acceptable for new protection through 2030 and disallowed from 2031 (SP 800-57 Table 4).

03

Matching 256-bit symmetric strength needs a 15,360-bit RSA modulus, according to SP 800-57.

04

FIPS 186-5 requires the public exponent to be odd and between 216 and 2256; 65537 qualifies, 3 does not.

05

This page exports the public key as SPKI and the private key as PKCS#8, in PEM and as JWK.

06

A JSON Web Key (RFC 7517) stores the same key material as named base64url fields.

07

RSA cryptography is specified in RFC 8017, PKCS #1 version 2.2.

08

RFC 8032 puts Ed25519 at around the 128-bit security level, comparable to RSA-3072.

09

NIST's post-quantum standards are ML-KEM (FIPS 203) and ML-DSA (FIPS 204).

10

Clear now removes the generated keys from the page, rather than only hiding them.

Frequently asked questions

]; @endphp
We do not recommend it. A private key generated in a web page passes through the browser's memory, where extensions and scripts on the page could reach it. For production, generate keys with openssl or ssh-keygen on the machine that will use them, or in a hardware security module.
NIST SP 800-57 rates 2048-bit RSA at 112 bits of security, acceptable for new protection through 2030, and 3072-bit at 128 bits, acceptable beyond that. For keys that must stay in use after 2030, choose 3072 or more. 4096 adds margin at the cost of slower generation and signing.
Generating a key means searching for two large random primes, testing candidates until two pass. Larger primes take longer to test and are rarer among candidates, so the time grows quickly with key size and varies from run to run.
PEM is base64-encoded DER between BEGIN and END lines; this page writes the public key as SPKI and the private key as PKCS#8. OpenSSH uses its own format for keys in ~/.ssh. ssh-keygen can convert between them.
A JSON Web Key, defined in RFC 7517, represents a key as a JSON object with named fields, encoded in base64url. Identity providers publish their public keys this way so that JWT signatures can be verified.
For a private key stored on disk, yes. This page produces keys without a passphrase; you can encrypt one afterwards, for example with openssl pkey -aes256 -in private.pem -out encrypted.pem.
When everything that must use the key supports it. RFC 8032 puts Ed25519 at around the 128-bit security level, like RSA-3072, with far smaller keys and signatures. RSA remains the choice where a system supports nothing else.
It is the e in the public key. FIPS 186-5 requires an odd e between 2^16 and 2^256, and 65537 (0x10001) is the smallest common value that qualifies. This page always uses it; the e = 3 option it offered until 1 October 2026 did not meet FIPS 186-5 and has been removed.
Yes. Once the page has loaded, keys are generated by the browser's Web Crypto API without any network request.
A sufficiently large quantum computer could. NIST has published replacement standards, ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for signatures, and organisations are planning their migration. For data that must stay secret for many years, take that into account now.

Method & sources

How it computes

RSASSA-PKCS1-v1_5 key pair from the Web Crypto API at 2048, 3072 or 4096 bits with e = 65537, exported as SPKI and PKCS#8 PEM and as JWK. Clear now wipes the key text from the page.

What this tool implements

  • The page offered e = 3; FIPS 186-5 requires an odd e with 2^16 < e < 2^256, so the option is removed. Clear only hid the private key; it now removes it. Key-size labels follow SP 800-57: 2048 = 112-bit (acceptable through 2030, disallowed from 2031), 3072 = 128-bit; 15360 for 256-bit.
  • Removed or corrected: 'RSA-260 (829 bits) factored in 2020' (829 bits is RSA-250; no source read), 'OpenSSH defaults to Ed25519 since 2014', Cocks/GCHQ history, signing-speed and quantum-timeline estimates, and 'Kyber/Dilithium' (now ML-KEM and ML-DSA, FIPS 203/204). Ed25519's ~128-bit level is from RFC 8032.

Sources

Advertisement
Pre-footer · AD-W3 728 × 90