RSA Key Pair Generator
Generate RSA key pairs in PEM format using the Web Crypto API. Use Signing keys for JWT RS256/RS384, SSH, and digital signatures. Use Encryption keys for RSA-OAEP data encryption.
2048-bit vs 4096-bit
2048-bit is the current minimum recommended by NIST through 2030 — fast enough for most applications. 4096-bit offers longer-term security but is ~4× slower to generate and ~2× slower to sign. For JWT RS256 in web APIs, 2048-bit is the standard choice. Never use this tool in production for keys protecting sensitive data — use a proper key management service (AWS KMS, HashiCorp Vault) for production key generation and storage.
RSA Key Generation & Encryption
Pick two primes, watch keys derive, then encrypt and decrypt a number.
Two large random prime numbers generated independently
n = p × q — the modulus used in both public and private keys
φ(n) = (p−1)(q−1) — used to derive the private exponent
Public exponent e = 65537. Private exponent d = e⁻¹ mod φ(n) via extended Euclidean algorithm
Public key as SPKI, private key as PKCS#8 — Base64 + armor headers
Spec: PKCS#1 (RFC 8017), PKCS#8 (RFC 5958), SPKI (RFC 5480)