RSA Key Generator
Generate RSA key pairs and export them in PEM format
100% free. Runs entirely in your browser - your files and data never leave your device and nothing is uploaded to any server.
About this tool
RSA is a widely-used public-key cryptography algorithm - you generate a linked key PAIR (public and private), where data encrypted with the public key can only be decrypted with the private key, and vice versa for signing. This tool generates RSA key pairs and exports them in standard PEM format, ready to use in code or configuration.
How to use this tool
- Choose key lengthSelect 2048/4096-bit according to security policy and performance target.
- Generate RSA key pairCreate linked public/private PEM outputs for signing or encryption.
- Export and store securelyCopy/download keys and protect private key using secure secret storage.
- Validate integrationTest encryption/decryption or sign/verify flow in target environment.
Which RSA key size to choose
2048 bits is the minimum for RSA today and is still widely used; 3072 bits is recommended for keys that must stay secure beyond 2030; 4096 bits gives more margin at the cost of slower signing.
Keep the private key secret - never commit it to a repository or send it by email - and share only the public key. For production systems, generating keys on the server or device that will use them is the safest practice.
Key features
- Quickly generates standards-compliant RSA PEM key pairs.
- Useful for API auth, certificates, and signature workflows.
- Saves setup time in development and testing environments.
- Helps teams understand public/private key separation clearly.
Common uses
- Preparing key pairs for JWT RS algorithms in staging.
- Testing signature verification between services.
- Creating temporary keys for CI or integration demos.
- Learning asymmetric cryptography operational workflow.
Tips for better results
- Protect private keys with strict access controls and rotation policy.
- Use passphrase-protected private keys where possible.
- Prefer generating long-term prod keys inside controlled infra/HSM.
- Track key IDs and issuance dates for lifecycle management.
Mistakes to avoid
- Committing private keys to repository history.
- Using weak or outdated key sizes in production systems.
- Confusing encryption use with signing use without protocol design.
- Sharing private key over insecure communication channels.
Frequently asked questions
The public key can be shared freely - others use it to encrypt data meant only for you, or verify signatures you created. The private key must be kept secret - you use it to decrypt data encrypted with your public key, or to create digital signatures.
Key generation runs in your browser using standard cryptographic APIs, but for genuinely sensitive production systems, many teams prefer generating keys directly on the target server/environment using established tooling (like OpenSSL) to minimize any exposure during transfer.
2048-bit is a common modern minimum for RSA keys; 4096-bit offers a larger security margin at the cost of slower performance - check what your specific use case or compliance requirement expects.
Keep it out of source control, restrict file permissions (chmod 600 on Unix), encrypt it with a passphrase where the software supports it, and store production keys in a secrets manager or HSM.
PKCS#1 files start with BEGIN RSA PRIVATE KEY and hold RSA keys only; PKCS#8 files start with BEGIN PRIVATE KEY and can hold any key type. Most modern libraries accept PKCS#8.
Both are secure. Elliptic-curve keys such as Ed25519 or P-256 are much smaller and faster for the same strength; RSA remains the most widely compatible choice for older systems.