What RSA key size is recommended today?

For new NIST-conforming RSA signature generation, a modulus of at least 2048 bits provides at least 112 bits of classical security. RSA-3072 maps to 128-bit classical strength. The correct choice still depends on the protocol, software policy, data lifetime and post-quantum migration plan.

Why is 1024-bit RSA no longer approved for new signatures?

NIST maps RSA-1024 to no more than 80 bits of classical security, below its 112-bit minimum. SP 800-131A Rev. 2 disallows it for signature generation and permits 1024-to-2047-bit RSA only for legacy signature verification.

Is 4096-bit RSA always better than 2048-bit?

No. A larger modulus raises classical factoring cost but also increases key, signature and computation size. It does not make RSA quantum-resistant. Choose a size supported by the relevant protocol and policy, and plan migration to standardized post-quantum cryptography where long-term risk matters.

What does "equivalent symmetric strength" mean?

Asymmetric algorithms like RSA are inherently weaker per-bit than symmetric algorithms like AES. The equivalent symmetric strength is the number of AES key bits that would take the same effort to brute-force. For example, RSA-2048 has roughly 112 bits of symmetric equivalent strength.

Should I use RSA or elliptic-curve cryptography (ECC)?

The answer depends on protocol support and policy. NIST strength tables map RSA-3072 and common 256-bit elliptic-curve parameters to about 128 bits of classical strength, but neither classical family is resistant to a sufficiently capable quantum computer.

No. Increasing RSA from 2048 to 4096 bits does not make it post-quantum secure. NIST encourages organizations to inventory quantum-vulnerable public-key cryptography and begin transitioning to standardized post-quantum algorithms.

RSA Key Size Explainer

An RSA key is part of a public-key pair used for signatures or encryption. Compare 1024–8192-bit modulus sizes, classical security strength and NIST context.

What an RSA key size means

An RSA key pair has a public key that can be shared and a private key that must remain secret. “2048-bit RSA” describes the modulus size—not 2,048 bits of effective security. NIST maps RSA-2048 to 112-bit and RSA-3072 to 128-bit classical security strength. The hash, padding, key generation, storage and protocol also matter.

Do not paste a private key into comparison websites. This page accepts no key material and performs no key generation.

Select RSA Key Size

Choose a key size to explore its security properties.

51210242048307240968192

RSA Key Size 2048

Symmetric Equivalent 112 bits

Security Level

NIST Status

Planning Context

Relative Sign Speed

Strength values are NIST comparison tiers, not a probability, score or predicted cracking time.

Recommendation

Suitable For

Full Comparison Table

Key Size	Sym. Equiv.	Security Rating	NIST Status	Planning context	Best For

Use-Case Finder

Pick the decision you are making. These are standards checkpoints, not universal protocol settings.

Standards note: strength values are classical-security comparisons, not expiry predictions. See NIST SP 800-57 Part 1 Rev. 5, NIST SP 800-131A Rev. 2, and NIST post-quantum guidance. Always follow the profile for your TLS, SSH, signing, PKI or regulated environment; modulus size alone does not make a deployment secure.

Summary

An RSA key is part of a public-key pair used for signatures or encryption. Compare 1024–8192-bit modulus sizes, classical security strength and NIST context.

How it works

Select an RSA key size using the slider or preset buttons at the top.
The tool displays the equivalent symmetric strength in bits (e.g., AES-112 for RSA-2048).
A security rating shows whether the key size meets current NIST guidance.
A qualitative key-size cost and standards-planning context are shown without inventing an expiry year.
Scroll down to the full comparison table to see all key sizes ranked side by side.
The use-case panel highlights which key size is appropriate for your specific scenario.

Use cases

Choose the right RSA key size when generating TLS/SSL certificates.
Understand why 1024-bit RSA keys are no longer considered secure.
Decide between 2048-bit and 4096-bit keys for email signing (PGP/GPG).
Learn the performance trade-offs between different RSA key lengths.
Verify that your SSH key configuration meets current security standards.
Educate teams on public-key cryptography fundamentals.
Audit existing infrastructure key sizes against NIST recommendations.
Plan migration timelines as computing power grows over time.

Frequently Asked Questions

Last updated: 2026-09-22 · Reviewed by Nham Vu