RSA is the algorithm that lets two parties who have never met share secrets over an insecure channel. Invented in 1977, still the backbone of SSH authentication, TLS handshakes, code-signing certificates, JWT signatures, and PGP-encrypted emails. This tool generates key pairs (in your browser -- the private key never touches a disk you do not control) in the sizes and formats you actually need.
The RSA gotcha most people learn the hard way: you cannot encrypt more data than the key size.
With a 2048-bit key, the absolute maximum plaintext you can directly encrypt is about 190 bytes with OAEP padding (SHA-256) or 245 bytes with PKCS#1 v1.5 padding. Trying to encrypt a 1 KB API secret throws. The standard solution is hybrid encryption: generate a random AES key, encrypt the data with AES, then encrypt the AES key with RSA. This is what TLS does. This tool generates the RSA key pair -- encrypting the data itself is a follow-up step.
Key size reality check:
- 1024 bits -- deprecated. Vulnerable to nation-state and well-funded attackers. Do not use.
- 2048 bits -- current baseline. Confirmed safe through 2030 per NIST SP 800-57. Most production systems.
- 3072 bits -- recommended if you want a security margin beyond 2030.
- 4096 bits -- for long-lived keys signing things that must remain confidential for decades. Slow key generation (sometimes seconds), slower operations, larger certificates. Use when compliance or policy demands it.
Format decisions that trip people up:
-
PKCS#1 (
-----BEGIN RSA PRIVATE KEY-----): the original RSA-specific format. Recognized by OpenSSL and every tool written before 2005. If you are interacting with a legacy system, this is probably what it wants. -
PKCS#8 (
-----BEGIN PRIVATE KEY-----): a generic wrapper around any private key algorithm (RSA, EC, Ed25519). Most modern libraries (Node 11+, Python cryptography, Go, Rust) default to this. Prefer it for new projects. -
OpenSSH (
-----BEGIN OPENSSH PRIVATE KEY-----): the new OpenSSH key format. Works natively withssh-keygen, OpenSSH 7.8+, and key-management flows. Use this for SSH keys specifically.
PKCS#8 encrypted format (-----BEGIN ENCRYPTED PRIVATE KEY-----) is the right choice for private keys at rest -- protects the key itself behind a passphrase at rest, separate from whatever the key itself protects.
The public exponent (almost always 65537): Fermat prime, only two 1-bits, fast to compute. Do not use lower exponents like 3 without OAEP padding -- it invites cube-root attacks on unpadded ciphertexts. 65537 with OAEP (encryption) or PSS (signing) is the correct default.
RSA versus ECC: for equivalent security, ECC uses far smaller keys (P-256 ~= RSA-3072) and is faster at comparable security levels. NIST and the industry are gradually moving toward ECC. But RSA remains the most widely-supported algorithm and the easiest to implement correctly. For new signing systems, Ed25519 (not RSA) is the modern recommendation. Still, RSA is the default for "I need a key pair that everything understands."
Protect the private key. File permissions 400 (owner-read only) on the key file. Hardware-backed keys where feasible. Rotate long-lived keys every 1-2 years. Compute fingerprints (SHA-256 of the DER-encoded public key) so you can audit which key is actually deployed in production.