RSA Keypair Generator
Generate production-grade RSA public and private keypairs using browser Web Crypto. Export standard SPKI and PKCS#8 PEM formats ready for JWT RS256, SSH, or TLS.
Standard web / TLS baseline
For JWT, RS256, API signing
Cryptographic hash binding
RSA Cryptography: Standards, Key Sizes & PEM Formats
Choosing the Right RSA Key Size: 2048 vs 3072 vs 4096 Bits
RSA security relies on the computational difficulty of factoring the product of two massive prime numbers (the RSA problem).
- 2048-bit: The current minimum acceptable baseline recommended by NIST. Provides ~112 bits of symmetric security. Adequate for short-term tokens and certificates.
- 3072-bit: Provides ~128 bits of symmetric security equivalent to AES-128. Recommended by NIST for data protection beyond the year 2030.
- 4096-bit: Provides ~140+ bits of security. Ideal for long-lived Certificate Authorities (CAs) and root signing keys, though handshakes require slightly more CPU time.
SPKI vs PKCS#8: PEM Formats Explained
When exporting keys to text, binary ASN.1 DER structures are wrapped in Base64 lines with boundary headers (RFC 7468):
SPKI (Subject Public Key Info): The standard format for public keys (BEGIN PUBLIC KEY). Encapsulates the algorithm identifier and the public modulus/exponent.
PKCS#8: The universal format for private keys (BEGIN PRIVATE KEY), supported natively by Node.js crypto, Python cryptography, OpenSSL, and Java KeyStore.