RSA Key Pair Generator

What this tool is used for

• Producing a key pair for a service that only accepts RSA, where an elliptic curve is not an option.
• Generating a test key for a signing or verification path without touching a real one.
• Creating a key to sign JWTs with RS256 so verifiers only ever need the public half.
• Producing a PEM pair to load into a library while checking its parsing behaviour.
• Comparing the sizes and generation times of key lengths before choosing one.

Frequently Asked Questions

What key size should I use?

2048 bits is the current minimum and 4096 is the conservative choice. 1024 has been considered broken since 2013 and is rejected by modern CAs. Note that doubling the size does not double security — it grows far more slowly than that.

Should I use RSA or an elliptic curve?

Ed25519 or ECDSA P-256 for anything new. A 256-bit EC key gives comparable security to RSA-3072 with far smaller keys and much faster operations. RSA persists mainly for compatibility with older systems.

Which parts do I share?

The PUBLIC key only, always. The private key never leaves your machine — anyone holding it can impersonate you completely. If a private key is ever pasted, emailed or committed, treat it as compromised and regenerate.

What is the difference between PEM, DER and PKCS formats?

PEM is Base64 with BEGIN/END headers; DER is the raw binary. PKCS#1 is RSA-specific (BEGIN RSA PRIVATE KEY) while PKCS#8 is generic (BEGIN PRIVATE KEY) — mismatched expectations here cause most key-loading errors.

Is generating a key in the browser safe?

The Web Crypto API uses the OS's cryptographic RNG and nothing is transmitted, so it is sound for testing and learning. For production keys protecting real systems, generate on the target machine or in an HSM.

Why is RSA key generation so much slower than ECC?

Because it has to find two large random primes, and primality testing is probabilistic — a 4096-bit key can take seconds of searching. An elliptic-curve key is a random number in a range plus one multiplication, which is effectively instant.

What is the public exponent and why is it almost always 65537?

It is the value the public operation raises to, and 65537 is chosen because it is prime and has only two set bits, making verification fast. Very small exponents such as 3 have historically enabled attacks on badly padded messages.

Common errors and gotchas

• Sharing the wrong half. The private key is the whole secret, and it is easy to copy the wrong block out of a PEM file.
• Choosing 1024 bits because it generates quickly. It is below every current recommendation.
• Assuming the PEM headers are interchangeable. PKCS#1 and PKCS#8 wrap different structures and libraries are picky.
• Expecting generation to be quick at 4096 bits. Finding large primes is slow, and that is inherent rather than a bug.
• Reaching for RSA for new work when an elliptic curve gives equivalent security with far smaller, faster keys.