What an RSA key pair is
RSA is a pair of numbers that undo each other. What one of them locks, only the other opens — so one can be published and the other kept, and that asymmetry is what lets a stranger check your signature, or send you something only you can read.
2048 bits → a PUBLIC KEY block of 392 base64 characters and a PRIVATE KEY block of about 1,620 — the same modulus, plus everything needed to reverse it
The modulus width is the whole of the security parameter: breaking RSA means factoring that number back into its two primes. 1024 stopped being defensible over a decade ago, 2048 is today's floor, 3072 is the tier NIST puts alongside a 128-bit symmetric key, and 4096 buys margin that is paid for on every signature for the life of the key. The pair is minted here by your browser's own Web Crypto — nothing is uploaded, no request carries any part of the key, and closing the tab destroys the private half.
PKCS#1, PKCS#8, DER and JWK
A key is a set of numbers. A container is the agreed way of writing those numbers down so that something else can read them, and RSA has accumulated two of them.
The public key is a modulus and a small exponent, and nothing else. The private key is that modulus again alongside the number that reverses it, plus the two primes it was built from and three values derived from them that make the arithmetic several times faster. That is why a private block runs to roughly four times the size of the public one, and why the public half can always be recovered from the private half but never the other way round.
| Format | Public header | Private header | Reach for it when |
|---|---|---|---|
| PKCS#8 | PUBLIC KEY | PRIVATE KEY | Anything written this decade — OpenSSL 1.0 and later, Node, Go, Python's cryptography, Java's KeyFactory, and every JOSE library. |
| PKCS#1 | RSA PUBLIC KEY | RSA PRIVATE KEY | Older tooling that predates PKCS#8, and anything whose documentation shows a BEGIN RSA PRIVATE KEY line. |
The naming is asymmetric and it catches people out. PKCS#8's private half says PRIVATE KEY, but its public half says PUBLIC KEY and is strictly a SubjectPublicKeyInfo — a different specification that happens to be what everyone pairs with PKCS#8. Only PKCS#1's two headers read as a matching pair.
Choosing DER gives the same bytes without the header, the footer or the line breaks: one base64 string. It is what a configuration file wants when it has nowhere to put a multi-line value, and what a request body wants when the key is going into JSON.
A JWK is neither container. It writes the same numbers as base64url JSON fields and names the algorithm in alg — RS256, PS384, RSA-OAEP-256 and so on — which is why the container picker switches off under it. There is no DER for it to choose.
The four blocks here are the four OpenSSL writes. openssl genrsa produces PKCS#1; openssl genpkey -algorithm RSA produces PKCS#8; openssl rsa -traditional converts one into the other. When a key from this page is rejected somewhere, the container is the first thing to check.
Every control on the page
Six settings and four buttons, and one of the settings switches another off.
| Control | What it does | Reach for it when |
|---|---|---|
| Key size | How many bits wide the modulus is, which is the whole of the key's strength. | 2048 unless something tells you otherwise; 3072 or 4096 for a key expected to still be in use in ten years. |
| Key format | Which DER container the halves are written into — PKCS#8 with SubjectPublicKeyInfo opposite it, or PKCS#1 on both sides. | PKCS#1 when whatever reads the key expects a BEGIN RSA PRIVATE KEY line. PKCS#8 otherwise. |
| Output format | How that container is rendered: a headered PEM block, one unwrapped base64 line, or JSON. | PEM for a file, DER for a single-line environment variable, JWK for a JOSE library. |
| Usage | Which algorithm the key is minted for, deciding what operations it will accept and what a JWK calls it. | Signing for tokens and certificates; encryption when you are wrapping a session key. |
| Hash | The digest paired with the key. It is written into a JWK's alg and chosen again at import time everywhere else. | SHA-256 unless a specification you are matching asks for more. |
| Public exponent | The small number in the public half. Odd, at least 3, and 65537 almost everywhere. | Leave it alone unless you are reproducing a key that used something else. |
| Generate | Mints the pair. A 4096-bit key takes several seconds; the smaller sizes are close to instant. | Every time — nothing is generated until this is pressed. |
| Download | Saves one half, named for its kind and stamped with the instant. | When only one side of the pair is going anywhere. |
| Download both keys | One ZIP holding both halves under the same stamp. | The usual case — the two are only useful together. |
| Fingerprint | Base64 SHA-256 over the public key's DER, which is what OpenSSL prints for the same key. | To confirm the key you deployed is the key you generated. |
| Reset all | Discards both keys and puts every setting back to how the page opened. | Before generating a key for something else, or to clear a private key off the screen. |
One control switches another off. JWK has no DER container, so under it the key-format picker is disabled and says why, rather than sitting there taking a value that changes no character of the output.
Four settings are minted into the key itself: its size, its exponent, its algorithm and its hash. Change any of them and the keys already on screen dim, with a line saying they no longer match — they are still real keys, so they are not thrown away, but generating again is what makes them answer the settings. The container and the rendering are not on that list: switching PEM to JWK re-writes what is already in hand, and costs nothing.
The hash is the one setting that mostly does not reach the file. It pairs with the key at the moment the key is used rather than when it is stored, so a JWK records it in alg and a PEM block generally does not — whoever imports the key picks it again.
RSASSA-PKCS1-v1_5 is what RS256 means, and what almost every certificate and token issuer uses. RSA-PSS is the newer signature scheme, randomised rather than deterministic. RSA-OAEP does not sign at all; it encrypts a payload smaller than the modulus, which in practice means a symmetric key rather than a message.
Only 3 and 65537 will actually mint a key in a browser. Chrome and Firefox implement those two and reject everything else, even though the specification allows any odd number of at least 3 — so the field takes what you type and the refusal names the values that work, rather than hiding the others and pretending the limit is arithmetic.
The defaults are a 2048-bit signing key with SHA-256, written as PKCS#8 PEM with an exponent of 65537. That is what openssl genpkey -algorithm RSA gives you, and what most systems expect to be handed.
Looking after the private half
The private key is the whole of the secret. Anyone holding it can sign as you or read what was sent to you, and a bare key pair has no revocation you control — only the systems that trust it can stop trusting it.
The key on screen has never been anywhere. Web Crypto minted it in this tab; no request carried it, nothing was written to storage, and reloading the page destroys it. That also means there is no way to get it back, so save it before you navigate away.
Where it goes next matters more than where it came from. A private key belongs in a secret store, or in a file the process can read and nobody else can — not in a repository, a chat message, or an environment variable that a crash handler will print.
Downloads land in your downloads folder, which is usually the least protected directory on the machine and is often synced somewhere. Move the private half somewhere deliberate, and delete what was left behind.
Checking the key against something that is not this page
Four checks, in the order they tend to fail:
- Read it back.
openssl pkey -in rsa-private.pem -noout -textprints the modulus and the primes for aPKCS#8key, andopenssl rsadoes the same forPKCS#1. If either refuses the file, it is the container that is wrong rather than the key. - Check that the two halves are a pair.
openssl pkey -in rsa-private.pem -puboutshould print exactly the public block this page gave you, byte for byte. - Check the fingerprint.
openssl pkey -pubin -in rsa-public.pem -outform DERpiped intoopenssl dgst -sha256 -binaryand then intobase64prints the same string the workbench shows, because both are aSHA-256over the sameSubjectPublicKeyInfobytes. - Sign something with it. For a token, import the private half as
RS256and verify the result with the public half in a different library. A key that round-trips through two independent implementations is a key that works.
The fingerprint is taken over the public key's DER, never over the PEM text and never over the PKCS#1 form — so it is the same string whichever container was selected when the key was generated. That is what makes it usable as an identity for the pair.
What people use this for
Signing JSON Web Tokens. An RS256 issuer signs with the private half and publishes the public half, often as a JWK in a jwks.json, so anyone can verify a token without being able to mint one. Generate the pair here, then take it to the JWT tool and sign a real token with it.
Development and test fixtures. A service that expects a key pair in its configuration will not start without one, and a throwaway 2048-bit pair minted in a tab is faster than remembering the OpenSSL invocation.
Learning what the containers actually are. Switching the two format pickers rewrites the same key four ways without minting a new one, which makes the difference between PKCS#1, PKCS#8, DER and JWK something you can see rather than something you read about.
Frequently asked questions
Web Crypto, in the tab, and no request on this page carries any part of it. There is no server-side step to opt out of — the page could not send the key even if it wanted to, because the key exists nowhere but in this tab's memory.PKCS#1 is the bare RSA structure and says BEGIN RSA PRIVATE KEY. PKCS#8 wraps that same structure alongside an identifier saying which algorithm it belongs to, and says BEGIN PRIVATE KEY. The numbers inside are identical — this tool writes both from one generation — and which one you need is decided entirely by what is going to read the file.ssh-rsa public key and an OPENSSH PRIVATE KEY block are a different encoding of the same numbers, and this tool writes the PKCS#1, PKCS#8, DER and JWK forms only. ssh-keygen -i -m PKCS8 -f rsa-public.pem converts the public half if you need it.alg field is built from the usage and the hash together — signing with SHA-256 becomes RS256, and SHA-512 becomes RS512.