Free Online RSA Key Pair Generator & Encryption Tool
Generate a 2048-bit RSA public/private key pair, then encrypt short text with the public key and decrypt it with the private key — key generation and every cryptographic operation run locally via your browser's Web Crypto API. It helps developers experiment with public-key encryption, key pairs, and PEM output before integrating a real certificate or key-management workflow.
How RSA public-key encryption works
Unlike AES, RSA is asymmetric: it uses two mathematically related keys instead of one shared secret. Anything encrypted with the public key can only be decrypted with the matching private key — which means the public key can be shared freely (even published), while only the private key needs to stay secret. This tool generates a 2048-bit RSA key pair using RSA-OAEP padding with SHA-256, exports the public key as SPKI and the private key as PKCS#8 (both standard PEM formats), and lets you try an encrypt/decrypt round trip directly in the browser.
Why there's a text length limit
RSA-OAEP isn't a general-purpose bulk cipher — with a 2048-bit key and SHA-256, the maximum plaintext per operation is 190 bytes, dictated by the key size minus the OAEP padding overhead. Real-world systems handle this by combining RSA with AES in a hybrid cryptosystem: generate a random AES key, encrypt the actual (arbitrarily large) data with AES, then use RSA only to encrypt that short AES key so it can be safely shared with the key pair's owner. TLS and most secure messaging protocols work this way.
Why Base64 encoding is not encryption
Worth repeating here too: the ciphertext this tool outputs is displayed as Base64 purely so it's easy to copy and paste, not because Base64 itself provides any security. Base64 has no key and is trivially reversible by anyone — the actual confidentiality comes entirely from the RSA encryption step performed before that encoding. If you only Base64-encode text and skip the RSA (or AES) step, you have not encrypted anything.
How to use this tool
Click Generate Key Pair to create a fresh public and private key (or paste your own PEM-formatted keys into the fields). Switch to Encrypt, enter text under the length limit above, and encrypt it with the public key. Switch to Decrypt, paste the Base64 ciphertext, and decrypt it with the matching private key.
How to use RSA Key Pair Generator & Encryption for related tasks
Generate or use a key pair, keep the private key confidential, and test small messages because asymmetric encryption is not intended for large payloads directly.
Related tools: Certificate Decoder, AES-256 Encrypt & Decrypt.
Frequently asked questions
Is my private key ever sent anywhere?
No. Key generation, encryption, and decryption all run locally using your browser's native window.crypto.subtle (Web Crypto API). Nothing — not the private key, not the plaintext — ever leaves your browser.
Why is there a maximum text length for RSA encryption?
RSA-OAEP with a 2048-bit key and SHA-256 can only encrypt up to 190 bytes in a single operation — the padding scheme itself consumes part of the available space, and RSA isn't designed to scale to arbitrary-length data the way a block cipher is. In practice, real systems use RSA only to encrypt a short symmetric key (this is called "key wrapping" or a "hybrid cryptosystem"), then use that symmetric key with AES to encrypt the actual bulk data.
What format are the generated keys in?
The public key is exported as SPKI (SubjectPublicKeyInfo) and the private key as PKCS#8 — both standard, widely-supported DER formats, PEM-encoded (the same base64-with-header/footer format OpenSSL and most TLS tooling produce and accept).
Should I use this to protect real secrets?
This tool is genuinely using your browser's real cryptographic implementation, but treat it as a learning/prototyping tool rather than a production key-management system — a generated private key that's only ever held in a browser tab's memory has no secure, durable storage, backup, or access-control model behind it the way a real key management service would.
What is the difference between an RSA public and private key?
The public key can be shared for encryption or signature verification; the private key must remain secret for decryption or signing.