Toolbox101 All tools

Cryptography

RSA key pair generator

The RSA key pair generator makes a 2048-bit key pair by default (3072 and 4096 bits are selectable) and prints both halves as PEM text: a PKCS#8 PRIVATE KEY block and an SPKI PUBLIC KEY block, the layouts OpenSSL writes. RSA is asymmetric: the private key signs and stays secret, and the public key verifies signatures and can be shared. The pair is generated with WebCrypto in the page, so the key material never leaves your device. A fresh pair appears when the tool opens, and "Generate New" draws another.

Open RSA Key Pair Gen in the app Browse all tools

How to use RSA Key Pair Gen

  1. Open RSA Key Pair Gen in the Toolbox101 app; a 2048-bit pair is generated as it opens.
  2. For a stronger key, set Modulus (bits) to 3072 or 4096. The pair regenerates when you change it, and larger sizes take longer.
  3. Read the Output box: the -----BEGIN PRIVATE KEY----- block (PKCS#8) comes first, then -----BEGIN PUBLIC KEY----- (SPKI).
  4. Click Copy, keep the private key somewhere offline and encrypted, and share only the public block.

Worked example

RSA Key Pair Gen gives a different result every time, so yours will differ. This is one run:

Output (shortened)

-----BEGIN PRIVATE KEY-----
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCwCkI86dCx/B74
… about 1.6 KB of Base64 in all …
-----END PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsApCPOnQsfwe+I/wNQaw
… about 400 characters in all …
-----END PUBLIC KEY-----

Frequently asked questions

Can an online RSA generator leak the private key?

Not through this page: key generation runs with WebCrypto in your browser and nothing is transmitted, so the private key exists only on your device. The remaining risk is around the page: screen capture, browser extensions and clipboard history. Generate, save the private key to encrypted storage, then clear the page.

What RSA key size should I choose?

2048 bits is the accepted minimum for new keys and interoperates everywhere, so it is the default here. 3072 or 4096 adds margin for keys meant to last decades, at the cost of slower generation and use. Anything below 2048 is legacy. Pick the largest size your counterparties accept.

Why is the private key block longer than the public one?

Both blocks carry the same 2048-bit modulus and exponent, but the private key (PKCS#8) also stores the prime factors and the values used for signing, so its Base64 body runs to roughly 1.6 KB against about 400 bytes for the public key (SPKI). That extra material is what makes the private half sensitive.

What can I do with a generated pair?

The keys are RSASSA-PKCS1-v1_5 with SHA-256, so code that loads PKCS#8 and SPKI PEM (OpenSSL, Node's crypto module, jose, most JWT libraries) can sign RS256 tokens or verify signatures with them. Treat any pair from a generator as a test key, not one for production trust.

Why does generating keys take a moment?

RSA key generation searches for random prime numbers of the right size, which is deliberately unpredictable work. A 2048-bit pair typically takes about half a second here; 4096 bits can take several seconds. The tool only regenerates when you change the size or click Generate New.

Use RSA Key Pair Gen now

Open RSA Key Pair Gen in the app

Runs in your browser. Nothing you type is uploaded.