Pick the destination before the number
RSA key size and private-key format solve different problems. The size controls the RSA key strength and operation cost. OpenSSH, PKCS#8, PKCS#1, and PuTTY PPK are containers that determine which application can load that same identity.
| Size | Use it for | Tool guidance |
|---|---|---|
| 2048 | Older or constrained destinations | Compatibility |
| 3072 | A new RSA key without a stricter policy | Recommended RSA size |
| 4096 | A destination policy that asks for it | Policy-specific |
Choose the private-key container
Modern OpenSSH is the normal choice for command-line SSH clients. PKCS#8 is common in Java and general crypto tooling. PuTTY PPK v3 is the current PuTTY format. PKCS#1 RSA PEM and PPK v2 remain available for documented compatibility needs.
Generate and verify locally
- Confirm the destination accepts RSA and identify its required container.
- Select 3072 unless the destination policy requires 2048 or 4096.
- Protect the private key with a passphrase when the destination supports it.
- Download the private key to a trusted location and restrict its file permissions.
- Record the displayed public fingerprint before installing the public key.
The generator and converter run in the browser. Key actions do not initiate an application network request or upload key material.
RSA SSH key questions
Which RSA SSH key size should I choose?
Follow the destination policy. RSA 2048 is the compatibility choice, RSA 3072 is the recommended RSA size in this tool, and RSA 4096 is available for a policy that explicitly asks for it.
Does converting an RSA key change its fingerprint?
No. A container conversion keeps the RSA key material and SSH public fingerprint. Stop if the fingerprint changes.
Which RSA private-key format should I use?
Use OpenSSH for modern SSH clients, PKCS#8 for Java and general cryptographic tooling, PuTTY PPK v3 for current PuTTY, and PKCS#1 or PPK v2 only when an older destination requires it.