RSA Encryption: Generate Keys & Encrypt Online | Free Tool

A To share a secret message, generate an RSA key pair first. Provide the recipient with your *public key*. They will use this key to encrypt their message using the tool. Once encrypted, they send you the ciphertext. You can then use your *private key* (which you never shared) within the tool to decrypt the message privately and securely in your browser. Remember RSA is best for small messages.

A Yes, this RSA Encryption & Key Generator can be used to create RSA-2048 key pairs suitable for API authentication. Generate your key pair in the browser and copy the public key to configure with your API service provider. Keep your private key extremely secure, as it's essential for signing requests or decrypting sensitive API responses. Since keys are generated locally in your browser, it adds a layer of privacy for your authentication credentials.

A This RSA key generator outputs keys in the widely accepted PEM (Privacy-Enhanced Mail) format. Public keys are typically displayed as `-----BEGIN PUBLIC KEY-----` and private keys as `-----BEGIN RSA PRIVATE KEY-----` or `-----BEGIN PRIVATE KEY-----` (PKCS#8). This format ensures compatibility, allowing you to easily use the generated RSA keys with other tools, applications, or systems that support standard PEM encoding, such as OpenSSL, for various cryptographic operations.

A This tool doesn't include fingerprint verification. You'd need to share the public key fingerprint through a separate channel like a phone call or encrypted messaging app. For RSA-2048, the fingerprint is typically an SHA-256 hash of the key. Without this check, someone could intercept and swap the public key. A practical tip: generate a QR code from the key's hash and share it in person.

A You can, but you'll need to convert the private key format first. This tool outputs PEM keys, while SSH expects OpenSSH's proprietary format. Drop your private key into a text file, then run 'ssh-keygen -p -m PEM -f keyfile' to convert it. The public key also needs converting — use 'ssh-keygen -i -f pubkey.pub'. Without these steps, SSH simply won't accept the keys. A quick test: generate a key pair here, convert it, and try connecting to a test server before using it anywhere critical.

A Yes, but only if your browser's crypto API works correctly. This tool relies on the Web Crypto API, which pulls entropy from your OS — things like mouse movements and keystroke timing. The real concern isn't randomness, it's the environment. If you're on a compromised machine with keyloggers or malware, the keys are compromised too. A safer approach: generate keys on an air-gapped device, then transfer the public key via USB.

A Technically yes, and many developers do exactly that. Each session generates fresh ciphertext due to OAEP's random padding, so reuse won't leak patterns. But there's a risk: if an attacker ever gets your private key, all past sessions are compromised. Rotate keys every 90 days for sensitive work. The tool doesn't enforce this — that's your job. A practical habit: generate a new pair monthly for API authentication, archive the old one.

A That's OAEP padding at work. It adds random bytes before encryption, so the same plaintext produces unique ciphertext each time. This prevents attackers from spotting patterns in your encrypted data - a vulnerability that plagued older schemes like PKCS#1v1.5. Try it yourself: encrypt 'hello', then encrypt 'hello' again. Two completely different outputs, but both decrypt back to the same message. Just remember you can't search or compare encrypted values using this tool.

A That's not a bug — it's the math working as intended. The public key contains just the modulus and exponent (n and e), roughly 270 characters in PEM form. The private key packs in both primes, the modulus, the private exponent, and several pre-computed values for faster decryption. All of that adds up to about 1,700 characters for RSA-2048. If you ever see a private key that's suspiciously short, it's probably not a real RSA key. A quick sanity check: paste both into a text editor and count the character lengths — the private key should be roughly six times longer.

A Only plain text up to about 190 bytes per encryption round with RSA-2048. That's roughly 190 characters. For longer content, you'd need a hybrid approach: encrypt the file with a symmetric cipher like AES, then encrypt that AES key with this tool's RSA public key. You won't paste a PDF directly into the message box. A practical workaround: base64-encode smaller files, but that shrinks your already-tight limit even further.