Home
RSA Keypair Generator

RSA Keypair Generator & Key Converter

Generate cryptographically secure 2048-bit and 4096-bit RSA keypairs in PKCS#8, PKCS#1, OpenSSH, and JWK formats directly in your browser. Derived securely via CSPRNG hardware entropy with zero cloud uploads.

Browser CSPRNGZero Cloud Uploads
Cryptographic ParametersFIPS / NIST SP 800-57 Standards
SSH Comment:

RSA Cryptographic Standards & Technical Reference

RFC 8017 / RFC 5208 / RFC 4251
Key Format Standards

PKCS#8 (BEGIN PRIVATE KEY) is the universal modern standard, wrapping key material with algorithm identifiers. PKCS#1 (BEGIN RSA PRIVATE KEY) is the legacy raw OpenSSL format.

2048 vs 4096 Bits

2048 bits provides 112 bits of security and remains fast for TLS and SSH. 4096 bits increases resilience against future factoring attacks, recommended for root certificates and long-lived signing keys.

100% In-Browser Isolation

All RSA key generation, public key extraction, and cryptographic operations occur locally inside your browser's Web Cryptography subsystem (window.crypto.subtle). Keys never touch network wires or persistent storage.

OpenSSL & SSH Command Line Equivalents
Generate 2048-bit PKCS#8 private key:openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem
Extract public key in SPKI format:openssl rsa -in private.pem -pubout -out public.pem
Convert PKCS#8 to PKCS#1 (RSA format):openssl rsa -in private.pem -traditional -out private_pkcs1.pem
Generate OpenSSH public key from private key:ssh-keygen -y -f private.pem > id_rsa.pub

Frequently Asked Questions (FAQ)

Are my generated RSA keys recorded on any server?

No. This tool runs entirely within your browser via the W3C Web Cryptography API. There are zero HTTP API requests or background telemetry beacons, guaranteeing complete privacy and zero data retention.

How do I use the exported key with SSH or GitHub?

Switch the Public Key format tab to OpenSSH, copy the line starting with ssh-rsa ..., and paste it into GitHub Settings > SSH and GPG keys, or into your remote server's ~/.ssh/authorized_keys file.

Why does 4096-bit generation take longer?

Generating a 4096-bit RSA key requires generating two random 2048-bit prime numbers and validating their primality with Miller-Rabin tests. This CPU-bound computation takes 300ms to 2000ms depending on your device processor.

Can a public key be extracted if I only have the private key?

Yes! An RSA private key mathematically encloses both the modulus n and the public exponent e. Our Public Key Exporter tab automatically extracts these parameters to generate any public key format.