An RSA key is one half of a mathematically linked key pair. The public key (a modulus n and a public exponent e) can be published so others can encrypt data to you or verify your signatures; the private key stays secret and is used to decrypt or sign. Its security rests on how hard it is to factor n back into its two large primes.

What is RSA key length?

RSA key length, or key size, is the number of bits in the modulus n, the product of the two secret primes. A 2048-bit key has a modulus of 2048 bits, about 617 decimal digits. Key length is not the same as security strength: RSA-2048 maps to about 112 bits of classical strength.

RSA 2048 is RSA with a 2048-bit modulus. NIST maps it to 112 bits of classical security strength, the minimum it accepts for new RSA signatures, which is why 2048 bits is a widely used size for TLS certificates. Check whether your protocol or policy requires 3072 bits or more.

What RSA key size is recommended today?

For new NIST-conforming RSA signature generation, a modulus of at least 2048 bits provides at least 112 bits of classical security. RSA-3072 maps to 128-bit classical strength. The correct choice still depends on the protocol, software policy, data lifetime and post-quantum migration plan.

Why is 1024-bit RSA no longer approved for new signatures?

NIST maps RSA-1024 to no more than 80 bits of classical security, below its 112-bit minimum. SP 800-131A Rev. 2 disallows it for signature generation and permits 1024-to-2047-bit RSA only for legacy signature verification.

RSA 2048 vs 4096: is 4096-bit always better?

No. RSA-4096 sits between NIST's 128-bit and 192-bit anchors, while RSA-2048 maps to 112 bits. A larger modulus raises classical factoring cost but also increases key, signature and computation size. It does not make RSA quantum-resistant. Choose a size supported by the relevant protocol and policy, and plan migration to standardized post-quantum cryptography where long-term risk matters.

What does "equivalent symmetric strength" mean?

Asymmetric algorithms like RSA are inherently weaker per-bit than symmetric algorithms like AES. The equivalent symmetric strength is the number of AES key bits that would take the same effort to brute-force. For example, RSA-2048 has roughly 112 bits of symmetric equivalent strength.

Should I use RSA or elliptic-curve cryptography (ECC)?

The answer depends on protocol support and policy. NIST strength tables map RSA-3072 and common 256-bit elliptic-curve parameters to about 128 bits of classical strength, but neither classical family is resistant to a sufficiently capable quantum computer.

How do I check the size of an RSA key?

For an SSH key run ssh-keygen -l -f ~/.ssh/id_rsa.pub; the first number is the bit length. For a PEM public key run openssl pkey -pubin -in key.pub -text -noout, and for a certificate openssl x509 -in cert.pem -noout -text and read "Public-Key: (2048 bit)". You can also paste the public key or certificate into the checker on this page. Never paste a private key into a website.

Has RSA-2048 been cracked?

No. The largest RSA challenge number publicly factored is RSA-250, an 829-bit modulus, factored in 2020 with about 2,700 core-years of computation. RSA-768 fell in 2009 and 512-bit RSA in 1999. A 2048-bit modulus is far beyond classical factoring today; the long-term threat is a large quantum computer.

When will RSA-2048 be deprecated?

NIST's draft IR 8547 (November 2024) proposes deprecating 112-bit-strength quantum-vulnerable algorithms such as RSA-2048 after 2030 and disallowing all RSA, including 3072 and 4096 bits, after 2035 in favour of post-quantum algorithms. It is a draft transition plan, so check the final text and your sector's rules.

How big is an RSA-2048 signature or ciphertext?

The same size as the modulus: 256 bytes for RSA-2048, 384 bytes for RSA-3072 and 512 bytes for RSA-4096. The modulus itself is 617, 925 and 1,234 decimal digits long respectively.

No. Increasing RSA from 2048 to 4096 bits does not make it post-quantum secure. NIST encourages organizations to inventory quantum-vulnerable public-key cryptography and begin transitioning to standardized post-quantum algorithms.

RSA Key Size Explainer

An RSA key is part of a public-key pair used for signatures or encryption. Check a public key's bit length, then compare 1024–8192-bit sizes by NIST strength, signature size and ECC equivalent.

An RSA key is one half of an RSA key pair: the public key can be shared to encrypt data or verify signatures, while the private key stays secret to decrypt or sign.

What an RSA key size means

An RSA key pair has a public key that can be shared and a private key that must remain secret. “2048-bit RSA” describes the modulus size—not 2,048 bits of effective security. NIST maps RSA-2048 to 112-bit and RSA-3072 to 128-bit classical security strength. The hash, padding, key generation, storage and protocol also matter.

Never paste a private key into a website. The checker below accepts public keys and certificates only, decodes them in your browser and refuses anything labelled PRIVATE KEY.

Select RSA Key Size

Choose a key size to explore its security properties.

51210242048307240968192

Check an RSA Public Key's Size

Paste an ssh-rsa line, a PEM PUBLIC KEY / RSA PUBLIC KEY block or a PEM certificate. Nothing is uploaded.

RSA Key Size 2048

Symmetric Equivalent 112 bits

Security Level

NIST Status

NIST PQC Timeline

Relative Sign Speed

Modulus Length

Signature / Ciphertext

Comparable ECC Key

Generate this size

Strength values are NIST comparison tiers, not a probability, score or predicted cracking time.

Recommendation

Suitable For

Full Comparison Table

Key Size	Sym. Equiv.	Security Rating	NIST Status	ECC equiv.	PQC timeline (draft)	Best For

Use-Case Finder

Pick the decision you are making. These are standards checkpoints, not universal protocol settings.

Standards note: strength values are classical-security comparisons, not expiry predictions. See NIST SP 800-57 Part 1 Rev. 5, NIST SP 800-131A Rev. 2, NIST IR 8547 (initial public draft), and NIST post-quantum guidance. Always follow the profile for your TLS, SSH, signing, PKI or regulated environment; modulus size alone does not make a deployment secure.

Quick answer

An RSA key is one half of an RSA key pair: the public key can be shared to encrypt data or verify signatures, while the private key stays secret to decrypt or sign. Its size, such as 2048 or 4096 bits, is the length of the modulus, not its security level.

Examples

RSA key size	NIST security strength
1024-bit	≤ 80 bits (legacy only)
2048-bit	112 bits (current minimum)
3072-bit	128 bits
4096-bit	128–192 bits (slower)

Tap 2048, 3072 or 4096 to see its NIST strength, speed and best uses.

Summary

RSA uses a public key and a mathematically related private key. The modulus length—commonly 2048, 3072 or 4096 bits—is not the same as symmetric-key strength: NIST maps RSA-2048 to 112-bit and RSA-3072 to 128-bit classical security strength. Larger RSA keys cost more bandwidth and computation, and no RSA size is post-quantum secure; NIST's IR 8547 draft proposes deprecating RSA-2048 after 2030 and all RSA after 2035. Paste a public key or certificate to read its exact size, then follow the requirements of your TLS, SSH, signing or PKI implementation.

How it works

Select an RSA key size using the slider or preset buttons at the top.
The tool displays the equivalent symmetric strength in bits (e.g., AES-112 for RSA-2048).
A security rating shows whether the key size meets current NIST guidance.
Each size also shows its modulus length in decimal digits and bytes, its signature size, the comparable elliptic-curve size, the dates proposed in the NIST IR 8547 draft and the OpenSSL and ssh-keygen commands to generate it.
The key size checker decodes public keys locally: it reads the modulus from the ssh-rsa wire format or the DER SubjectPublicKeyInfo and counts its bits. Anything labelled PRIVATE KEY is refused and cleared without being parsed.
Scroll down to the full comparison table to see all key sizes ranked side by side.
The use-case panel highlights which key size is appropriate for your specific scenario.

Use cases

Choose the right RSA key size when generating TLS/SSL certificates.
Understand why 1024-bit RSA keys are no longer considered secure.
Decide between 2048-bit and 4096-bit keys for email signing (PGP/GPG).
Learn the performance trade-offs between different RSA key lengths.
Verify that your SSH key configuration meets current security standards.
Educate teams on public-key cryptography fundamentals.
Audit existing infrastructure key sizes against NIST recommendations.
Plan migration timelines as computing power grows over time.

Frequently Asked Questions

Last updated: 2026-10-09 · Reviewed by Nham Vu