CRYPTO.04 RSA KEY GENERATOR

RSA Key Generator

Choose the intended use first, then generate copyable and downloadable PEM and JWK keys with a fingerprint and encryption or signature self-test.

CONFIG

Key parameters

Purpose and algorithm

RSA-OAEP encrypts short data and is preferred for new systems

Modulus length

Hash algorithm

Public exponent65537 · secure default

Export modeExtractable · current-page memory only

Choose parameters and generate; 2048-bit keys usually take a moment

Waiting for self-test

Generated with Web Crypto · never uploaded, logged, or stored

Public-key SHA-256 fingerprint Shown after generation

§ 01

Generate a usable RSA key pair in three steps

Choose the purpose

Use RSA-OAEP for encryption, RSA-PSS for new signatures, and PKCS1 v1.5 signatures only for an existing integration.

Choose the strength

2048 bits suits common compatibility and testing, 3072 adds long-term margin, and 4096 costs more time for generation and operations.

Verify and export

Wait for the local encryption or signature self-test, distribute the public key, and save the private key in a trusted location.

§ 02

Purpose should come before format acronyms

RSA-OAEP, RSA-PSS, and RSASSA-PKCS1-v1_5 use RSA key material in different protocols. Asking whether you need encryption or signing prevents a guess among opaque format names.

After generation, the page performs a local round trip. OAEP encrypts with the public key and decrypts with the private key; signature modes sign privately and verify publicly.

§ 03

Choosing between PEM and JWK

Export

Actual format

Common use

Public PEM

SPKI

Servers, distribution, and general library imports

Private PEM

PKCS#8

Node.js, Java, Go, Python, and OpenSSL

Public JWK

JSON Web Key

Web Crypto, JWT, OAuth, and browser tests

Private JWK

JSON Web Key

Controlled browser or JOSE testing

§ 04

Convenient generation still requires careful key management

This page uses browser Web Crypto. The private key remains only in current-page memory and cannot be restored after refresh or close. Exportability enables PEM and JWK output; it is not a reason to use an untrusted device.

Production, financial, certificate, or long-lived identity keys should be created in a controlled server, offline environment, hardware security module, or key management system with access controls, rotation, and backups.

§ 05

Generate equivalent keys from a command line or code

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out private_key.pem
openssl pkey -in private_key.pem -pubout -out public_key.pem

§ 06

Frequently Asked Questions

Q1How do I choose RSA-OAEP, RSA-PSS, or PKCS1 v1.5?

Use RSA-OAEP to encrypt short data, RSA-PSS for signatures in new systems, and RSASSA-PKCS1-v1_5 mainly for an existing protocol.

Q2What changes between 2048, 3072, and 4096 bits?

2048 bits is fast and widely compatible, 3072 offers more long-term margin, and 4096 is slower without being necessary for every use case.

Q3Why is the private key PKCS#8 and the public key SPKI?

These are modern formats exported natively by Web Crypto. PKCS#8 carries private-key algorithm information and SPKI is a widely accepted public-key wrapper.

Q4Are keys uploaded or stored?

No. Generation, export, fingerprinting, and self-testing happen in the current browser page with no upload or browser-storage write.

Q5Can RSA encrypt a whole file directly?

That is not recommended. RSA handles very short data; real systems normally protect a random symmetric key with RSA and encrypt the payload with AES or a similar cipher.