RSA Encryption and Signing Key Pair Generator
Generates separate RSA-OAEP-SHA-256 encryption and RSASSA-PKCS1-v1_5-SHA-256 signing key pairs at 2048, 3072, or 4096 bits. Exports encryption PEM and JWK plus signing JWK; no SSH key is generated.
About this rsa encryption and signing key pair generator
Generates separate RSA-OAEP-SHA-256 encryption and RSASSA-PKCS1-v1_5-SHA-256 signing key pairs at 2048, 3072, or 4096 bits. Exports encryption PEM and JWK plus signing JWK; no SSH key is generated Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Performs symmetric encryption and asymmetric public-key operations adhering to NIST FIPS 197 (AES), RFC 7539 (ChaCha20-Poly1305), RFC 8032 (Ed25519 Digital Signatures), and PKCS#1 / RFC 3447 (RSA). AES-GCM provides authenticated symmetric encryption using 128-bit or 256-bit keys and 96-bit initialization vectors (IVs) to ensure confidentiality and cryptographic authentication. Key derivation employs PBKDF2 (RFC 2898) with HMAC-SHA256 and configurable salt iterations to thwart brute-force dictionary attacks.
Worked verification example
Scenario: Generate separate RSA-OAEP encryption and RSASSA-PKCS1-v1_5 signing key pairs for local tests.
Sample input:
Processing: Uses Web Crypto RSA-OAEP-SHA-256 and RSASSA-PKCS1-v1_5-SHA-256 to generate separate 2048-bit key pairs and exports SPKI/PKCS#8 PEM plus JWK.
Illustrative output:
Security parameters & input constraints
Other key lengths, including 0 and 1024, are rejected. Each run makes new random, exportable keys and can take time; private material is displayed. No OpenSSH key, certificate, credential storage or automatic rotation is provided.
Cryptographic digests, encoded strings, and signatures generated by RSA Encryption and Signing Key Pair Generator should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in RSA Encryption and Signing Key Pair Generator execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
RSA Encryption and Signing Key Pair Generator verification · Audit standards
How to use it
- Enter JSON with modulusLength 2048, 3072 or 4096, or omit it for 2048.
- Run locally to generate separate Web Crypto RSA-OAEP-SHA-256 encryption and RSASSA-PKCS1-v1_5-SHA-256 signing key pairs.
- Read encryption public/private PEM and JWK plus separate signing public/private JWK in the JSON result.
Frequently asked questions
What does RSA Key Generator create?+
A missing modulusLength defaults to 2048; only 2048, 3072, or 4096 is accepted. It creates separate RSA-OAEP-SHA-256 encryption and RSASSA-PKCS1-v1_5-SHA-256 signing key pairs and returns PEM and JWK material.
Which result fields belong to each purpose?+
`publicKey`, `privateKey`, `publicJwk`, and `privateJwk` belong to RSA-OAEP encryption. `signingPublicJwk` and `signingPrivateJwk` are the separate signing pair.
How do the two RSA tools use those keys?+
RSA Encrypt/Decrypt uses the RSA-OAEP `publicJwk` and `privateJwk`. RSA Sign/Verify instead requires `signingPrivateJwk` to sign and `signingPublicJwk` to verify.
Are generated private keys managed or stored for me?+
No. Private PEM and JWK values are returned in the tool output. Treat them as sensitive and use appropriate key management for real systems.