RSA Key Generator

2048-bit is sufficient for most applications and is the current industry standard recommended by NIST and other security organizations. It provides strong security with optimal performance for encryption and signature operations.

Use 4096-bit if you need long-term security (10+ years), work in high-security environments, or have compliance requirements that mandate larger key sizes. Keep in mind that larger keys have trade-offs:

• Longer generation time (may take several seconds)
• Slower encryption/decryption operations
• Larger key file sizes
• Increased computational overhead

3072-bit offers a middle ground with enhanced security while maintaining reasonable performance.

These are two different RSA schemes designed for different purposes:

Choose based on your use case: If you need to protect data confidentiality, use RSA-OAEP. If you need to prove authenticity and integrity, use RSASSA-PKCS1-v1_5.

Yes, absolutely. The keys are generated using your browser's built-in Web Crypto API, which implements industry-standard cryptographic algorithms and uses a cryptographically secure random number generator (CSRNG).

• Cryptographically secure randomness - Uses hardware entropy sources when available
• No network transmission - Keys are generated entirely on your device
• No server-side storage - Keys exist only in your browser session
• Browser-native implementation - Audited by browser vendors and security researchers
• Industry-standard algorithms - Follows NIST and IETF specifications

The Web Crypto API is the same technology used by major websites for secure communications. Your keys are as secure as those generated by professional command-line tools like OpenSSL.

Yes, fully compatible. The PEM format with SPKI (public key) and PKCS8 (private key) encoding is the standard format used by OpenSSL and virtually all cryptographic tools and libraries.

You can directly use the generated keys with:

• OpenSSL - Command-line cryptographic toolkit
• SSH - Secure shell authentication (with conversion)
• Node.js crypto module - JavaScript cryptography
• Python cryptography libraries - PyCrypto, cryptography.io
• Java security APIs - JCE, Bouncy Castle
• PHP OpenSSL functions - openssl_* functions
• .NET cryptography - RSACryptoServiceProvider
• SSL/TLS certificates - Web server configuration

# Verify public key
openssl rsa -pubin -in public_key.pem -text -noout

# Verify private key
openssl rsa -in private_key.pem -text -noout

# Extract public key from private key
openssl rsa -in private_key.pem -pubout -out public_key.pem

Larger key sizes require finding larger prime numbers, which is computationally intensive. RSA key generation involves:

For 4096-bit keys, the prime numbers are twice as large as 2048-bit keys, making primality testing significantly more complex. Generation time depends on your device's processing power:

Note: Modern devices with hardware crypto acceleration may generate keys faster. Mobile devices typically take longer than desktop computers.

The fingerprint is a SHA-256 hash of the public key, displayed in colon-separated hexadecimal format (similar to SSH key fingerprints). It serves as a short, unique identifier for your key.

Why fingerprints are useful:

• Key verification - Confirm you're using the correct public key
• Tamper detection - Verify the key hasn't been modified during transmission
• Easy comparison - Compare keys without examining the full PEM content
• Key management - Track and identify multiple keys in your system
• Security auditing - Log and monitor which keys are in use

SHA256:a3:4f:2c:8e:1d:9b:7f:3a:6c:5e:2d:8f:4b:1a:9c:7e:3d:6f:2a:8b:5c:1e:9d:4f:7a:3c:6e:2b:8d:5f:1a:9c

The fingerprint is cryptographically derived from the public key, so any change to the key (even a single bit) will produce a completely different fingerprint.