RSA key pairs underpin a significant portion of internet security. When you connect to a server over SSH, when your browser establishes a TLS connection, when a software package is signed to prove it came from a trusted publisher: RSA (or its modern equivalent, elliptic curve cryptography) is often involved. Understanding how RSA key pairs work and how to generate them correctly is a practical skill for any developer or system administrator.
Public key vs private key: the core concept
An RSA key pair consists of two mathematically related keys. The public key can be shared freely: you can publish it on a website, embed it in a certificate, or send it to anyone who wants to encrypt messages for you or verify your signatures. The private key must be kept secret: anyone who obtains it can decrypt messages intended for you and forge your signatures.
The mathematical relationship between the two keys has a crucial asymmetry: encrypting with the public key can only be decrypted with the private key. Signing with the private key can only be verified with the public key. This asymmetry means you can share your public key openly without compromising your private key, enabling secure communication between parties who have never met before.
RSA key sizes
RSA security is based on the difficulty of factoring large numbers. The key size (measured in bits) determines how large those numbers are and how hard they are to factor. 1024-bit RSA keys are considered broken by modern standards and should not be used. 2048-bit keys provide adequate security for most applications through approximately 2030. 4096-bit keys provide stronger security with a performance cost: operations take roughly 8 times longer than 2048-bit. For most purposes, 2048-bit RSA or switching to elliptic curve cryptography (Ed25519 or P-256) is the right choice.
Common uses for RSA key pairs
- •SSH authentication: generate an RSA key pair and add the public key to ~/.ssh/authorized_keys on the server. You authenticate by proving possession of the private key without sending it over the network.
- •TLS/SSL certificates: a certificate authority (CA) signs your public key to produce a certificate. Your server uses the private key to prove it owns that certificate during TLS handshakes.
- •Code signing: developers sign software releases with their private key. Users verify the signature with the developer's public key to confirm the software has not been modified.
- •Email encryption (PGP/GPG): encrypt email so only the recipient (who holds the private key) can read it.
- •JWT signing (RS256): API tokens signed with a private key can be verified by any service that has the corresponding public key, without sharing secrets.
PEM format: how RSA keys are stored
RSA keys are most commonly stored in PEM format: Base64-encoded DER data wrapped in a header and footer line. A private key starts with -----BEGIN RSA PRIVATE KEY----- (PKCS#1 format) or -----BEGIN PRIVATE KEY----- (PKCS#8 format). A public key starts with -----BEGIN PUBLIC KEY-----. The content between the header and footer is Base64-encoded binary data representing the key's mathematical components.
Protecting the private key
A private key file without a passphrase is as sensitive as a password stored in plaintext: anyone who reads the file can use the key. Protect private key files by setting file permissions to 600 (readable only by the owner) on Unix systems. For keys that are used interactively (not in automated systems), add a strong passphrase when generating the key: this encrypts the key file so that the passphrase must be entered before the key can be used. Never commit private key files to version control, and never share them over unencrypted channels.
AlteredIdea's RSA Key Generator creates 2048 or 4096-bit RSA key pairs in your browser using the Web Crypto API. The private key never touches a server: generated entirely on your device and never transmitted.