2048 vs 4096-bit RSA?

2048-bit is the industry standard for new keys. Use 4096-bit for high-security or compliance requirements mandating larger keys.

Can I use these keys for TLS?

These are RSA-OAEP keys for general cryptographic use. TLS certificates require a CA-signed X.509 certificate, not a raw PEM pair.

Where should I store the private key?

In a secrets manager (AWS Secrets Manager, Vault) or secure environment variable. Never commit private keys to git.

How do I generate an RSA key pair for JWT?

Select 2048 or 4096 bits, click Generate, and download the PEM private and public keys. Use the private key server-side to sign RS256 tokens; publish the public key via JWKS for verifiers.

What RSA key size should I use for RS256?

Use 2048-bit RSA keys for new deployments. Choose 4096 bits for long-lived roots or high-assurance compliance requirements. Avoid 1024-bit keys entirely.

Tool

RSA Key Generator

Generate RSA public/private key pairs in PEM format for RS256 JWT signing.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Key size

Click "Generate RSA key pair" to create PEM public and private keys in your browser.

Keys are generated in your browser. Use RS256 for JWT signing in production APIs.

Select key size: 2048-bit for standard production use, 4096-bit for high-security or long-lived keys.

Click Generate to create an RSA key pair using the Web Crypto API in your browser.

Copy the public key PEM for verifiers and JWKS endpoints. Store the private key in a secrets manager — never commit it.

Use the private key with your JWT library to sign RS256 tokens.

const jwt = require('jsonwebtoken');
const fs = require('fs');
const privateKey = fs.readFileSync('private.pem');
const publicKey = fs.readFileSync('public.pem');
const token = jwt.sign({ sub: 'user-1' }, privateKey, { algorithm: 'RS256' });
jwt.verify(token, publicKey, { algorithms: ['RS256'] });

const jwt = require('jsonwebtoken');
const fs = require('fs');
const privateKey = fs.readFileSync('private.pem');
const publicKey = fs.readFileSync('public.pem');
const token = jwt.sign({ sub: 'user-1' }, privateKey, { algorithm: 'RS256' });
jwt.verify(token, publicKey, { algorithms: ['RS256'] });

import jwt
with open('private.pem') as f:
    private_key = f.read()
with open('public.pem') as f:
    public_key = f.read()
token = jwt.encode({'sub': 'user-1'}, private_key, algorithm='RS256')
jwt.decode(token, public_key, algorithms=['RS256'])

import "github.com/golang-jwt/jwt/v4"
privateKey, _ := jwt.ParseRSAPrivateKeyFromPEM(privatePEM)
publicKey, _ := jwt.ParseRSAPublicKeyFromPEM(publicPEM)
token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{"sub": "user-1"})
tokenString, _ := token.SignedString(privateKey)

Continue learning

ToolsJWT EncoderJWT ValidatorJWKS Viewer

GuidesChoose HS256 or RS256 for Your APISign Your First RS256 JWTNode.jsPythonGoJavaRuby

ArticlesRSA Key Pairs for JWT Signing (RS256)JWKS in ProductionHS256 vs RS256 Comparison

GlossaryRSA CryptographyRS256 (RSA-SHA256)PS256 (RSA-PSS-SHA256)JWK (JSON Web Key)PEM EncodingPKCS #8 Private Key FormatSPKI Public Key FormatJWKS URIKey Rotation with kid

CompareHS256 vs RS256Symmetric vs Asymmetric JWT SigningRS256 vs ES256HS256 vs ES256

AlgorithmsRS256 (RSA-SHA256)PS256 (RSA-PSS SHA-256)

How to Use This Tool

Continue learning