When you generate an RSA key, you choose a key size. The two common options are 2048 and 4096 bits. RSA 2048 is the industry standard, recommended by NIST and used by most websites. RSA 4096 is "more secure" but comes with a performance cost.
The question is: do you actually need 4096, or is 2048 enough? Let's break down the real differences.
What Key Size Means
An RSA key size refers to the length of the modulus n, which is the product of two prime numbers. A 2048-bit key has a 2048-bit modulus (about 617 decimal digits). A 4096-bit key has a 4096-bit modulus (about 1234 decimal digits).
The key size determines the security level, which is the approximate number of bits of security the key provides. This is not the same as the key size because RSA's security grows sublinearly with key size (due to the existence of sub-exponential factoring algorithms).
Here is the mapping:
| RSA Key Size | Security Level | Equivalent Symmetric Key | |-------------|---------------|-------------------------| | 1024 bits | 80 bits | 80-bit (inadequate) | | 2048 bits | 112 bits | 112-bit (AES-128 is 128) | | 3072 bits | 128 bits | AES-128 | | 4096 bits | 152 bits | AES-256 is 256 | | 7680 bits | 192 bits | AES-192 | | 15360 bits | 256 bits | AES-256 |
Notice that RSA 2048 provides 112 bits of security, which is slightly less than AES-128's 128 bits. RSA 3072 is needed to match AES-128. RSA 4096 provides 152 bits, which exceeds AES-128 but falls short of AES-256.
NIST Recommendations
NIST SP 800-57 recommends the following key lifetimes:
- **RSA 2048**: Acceptable through 2030. This is the standard for most applications. - **RSA 3072**: Acceptable beyond 2030. Recommended if you want to match AES-128 security. - **RSA 4096**: Not specifically recommended by NIST (they jump from 3072 to 7680), but commonly used in practice for extra security margin.
The practical takeaway: RSA 2048 is sufficient for the vast majority of applications through at least 2030. If you are protecting data that must remain confidential for decades, consider 3072 or 4096.
Performance Benchmarks
The main argument against RSA 4096 is performance. RSA operations scale roughly with the cube of the key size (for decryption and signing, which use the private key). Here are approximate timings on a modern CPU:
| Operation | RSA 2048 | RSA 4096 | Ratio | |-----------|----------|----------|-------| | Key generation | 100ms | 1000ms | 10x | | Signing | 1ms | 5ms | 5x | | Decryption | 1ms | 5ms | 5x | | Verification | 0.1ms | 0.3ms | 3x | | Encryption | 0.1ms | 0.3ms | 3x |
For most web applications, these differences are negligible. RSA is only used during the TLS handshake (a few operations per connection), not for bulk data transfer. The extra 4 milliseconds for signing with 4096 is invisible to users.
For high-throughput systems (API gateways, certificate authorities, identity providers), the performance difference adds up. A system issuing thousands of tokens per second will feel the impact of 4096-bit keys.
Certificate Size Impact
RSA key size also affects the size of certificates and tokens. A 2048-bit RSA signature is 256 bytes. A 4096-bit signature is 512 bytes. This affects:
- **TLS certificates**: Larger certificates mean larger handshakes, which adds latency to every new connection. - **JWTs signed with RS256**: A 4096-bit signature adds 256 extra bytes to every token, which adds up if tokens are sent in HTTP headers. - **Signed software updates**: Larger signatures mean larger update files.
For most use cases, the size difference is not a problem. But for bandwidth-constrained environments (mobile, IoT), it can matter.
When 4096 Makes Sense
RSA 4096 is worth considering when:
- **Long-term confidentiality**: You are encrypting data that must remain confidential for 20+ years. If someone records your encrypted traffic today and factors your key in 2045, the data is exposed. A 4096-bit key gives more headroom. - **Compliance requirements**: Some organizations or frameworks require key sizes above 2048. Check your specific requirements. - **Low-throughput, high-value systems**: If you have a small number of operations but each one is extremely sensitive (root CA keys, code signing keys for critical software), the performance cost of 4096 is justified. - **Future-proofing**: If you want to avoid migrating to larger keys in the future, starting with 4096 gives you a longer window before you need to rotate.
When 2048 Is the Right Choice
RSA 2048 is the right choice for:
- **Web TLS certificates**: The vast majority of websites use 2048-bit certificates. The performance and size are optimal for HTTPS. - **JWT signing (RS256)**: Tokens are sent in HTTP headers, so smaller signatures are better. 2048 is more than sufficient. - **High-throughput systems**: When you are signing or decrypting thousands of operations per second, the performance difference matters. - **Most general-purpose applications**: If you do not have a specific reason to use 4096, 2048 is the right default.
The Quantum Question
The elephant in the room is quantum computing. Shor's algorithm, running on a sufficiently large quantum computer, can factor RSA keys efficiently, breaking both 2048 and 4096. Against a quantum computer, 4096 is only marginally better than 2048 (it buys you a few years, not decades).
NIST is already standardizing post-quantum cryptography algorithms (like ML-KEM and ML-DSA) to replace RSA in the long term. If you are worried about quantum threats, the answer is not a larger RSA key, it is migrating to post-quantum algorithms.
For now, quantum computers large enough to break RSA do not exist. RSA 2048 remains secure against all practical attacks.
The Bottom Line
For 95% of applications, RSA 2048 is the right choice. It provides 112 bits of security, which is sufficient through at least 2030. It is fast, produces reasonably sized signatures, and is universally supported.
Use RSA 4096 when you have a specific reason: long-term confidentiality, compliance requirements, or high-value low-throughput systems. The performance cost is real but manageable for most use cases.
Do not use RSA 1024 or smaller. These are no longer secure and should be replaced immediately.
Try both key sizes with our RSA Encrypt/Decrypt tool to see the difference in operation time and output size. And for the full explanation of how RSA works, read our RSA encryption explained guide.
