Why a pair, not a key
RSA is asymmetric — Encoding vs Encryption vs Hashing covers the distinction: a symmetric algorithm like AES uses one key for both directions, while RSA generates two mathematically linked keys at once, each capable of undoing what the other did. There's no such thing as generating just the public half or just the private half — they come from the same operation, over the same underlying prime numbers, together.
Signing vs encryption — pick one
The same RSA math supports two different jobs, and Web Crypto treats them as genuinely different algorithms requiring a choice up front:
- Signing (RSASSA-PKCS1-v1_5) — the private key signs, the public key verifies. This is exactly what a JWT's
RS256algorithm uses: sign with the private key, hand out the public key so anyone can confirm a token is genuine without ever being able to forge one themselves. The public key from this tool works directly with JWT Signature Verifier, which expects exactly this PEM/SPKI format. - Encryption (RSA-OAEP) — the public key encrypts, the private key decrypts. In practice, RSA encryption is almost always used to encrypt a short symmetric key rather than the actual data (RSA is slow and has real message-size limits) — the hybrid pattern behind TLS's handshake, mentioned in Encoding vs Encryption vs Hashing.
A key pair generated for one purpose isn't meant to be reused for the other — pick the one matching what you actually need before generating.
See AES vs RSA for why this tool and AES Encrypt/Decrypt aren't two options for the same job — RSA can't encrypt more than a couple hundred bytes at a time, which is exactly why real systems use RSA to hand off a small AES key rather than encrypting real data with it directly.
Choosing a key size
2048-bit is the floor most standards still accept, but it's a floor, not a target — several standards bodies already recommend 3072-bit or larger for any key expected to stay in service well past 2030. 4096-bit is the most conservative common choice, at the cost of noticeably slower key generation (and slightly slower signing/encryption) than 2048 or 3072. Unlike a symmetric AES key, a larger RSA key isn't free — the math scales worse than linearly, which is exactly why nobody defaults to the largest available size for everything.
The output format
Standard PEM, the same format every real tool expects: the public key as SPKI (SubjectPublicKeyInfo), the private key as PKCS8. Both are directly usable with openssl, Node's crypto module, or any language's standard crypto library — nothing proprietary or specific to this tool.
What this doesn't do
No certificate generation (a self-signed X.509 certificate wraps a key pair like this one, but is a distinct format with its own fields — issuer, validity period, subject — this tool stops at the raw key pair). No passphrase-protected private key export either; the PKCS8 output here is unencrypted, matching what most libraries expect to read directly.
FAQ
Is my private key sent anywhere?
No — generation, export, and everything shown on this page happen entirely in your browser via the native Web Crypto API. Nothing is transmitted, logged, or stored once you leave the page.
Can I recover a key pair after generating a new one?
No — nothing is saved anywhere, including by this tool itself. Copy both keys somewhere safe before generating a replacement, or before closing the tab.
Why does 4096-bit take noticeably longer to generate?
RSA key generation involves searching for large random prime numbers, and the cost of that search grows faster than the key size itself — 4096-bit isn't just "twice as slow" as 2048-bit, it's several times slower, entirely normal and not a sign anything is wrong.
Can I use the same key pair for both signing and encryption?
Technically the same key pair can serve either purpose, but best practice is separate pairs for separate jobs — Web Crypto enforces this directly by tying each generated pair to one algorithm at creation time, which is exactly what the Purpose selector controls.
Try it yourself
JWT Signature Verifier accepts a public key in exactly this format to verify an RS256-signed JWT, and AES Encrypt/Decrypt covers the symmetric side of encryption this tool's asymmetric keys are usually paired with in practice. Both run entirely in your browser.