iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A public key is the shareable half of an asymmetric key pair; its matching private key must remain secret. Their jobs depend on the cryptographic algorithm: a private key can create a signature that the public key verifies, while some schemes use the public key to encrypt data or keys that the private key decrypts. Other schemes use the pair for key agreement rather than direct encryption.
What is the difference between a public key and a private key?
The keys are mathematically related, but they are not interchangeable. The public key can be distributed; the private key is uniquely associated with its owner and is not made public. NIST says deriving the private key from its corresponding public key is computationally infeasible.
NIST’s glossary defines a public key as a key used with an asymmetric cryptographic algorithm, associated with a private key and an owner, and one that may be made public. Its private-key definition describes the matching key as uniquely associated with the owner and not made public. See the NIST public-key glossary and NIST private-key glossary.
How do the keys work for digital signatures?
For a digital signature, the signer uses the private key to generate the signature. Someone checking that signature uses the corresponding public key to verify it. This lets others check that the signature matches the key pair, but a public key by itself does not prove who owns it. In a real system, the public key must be reliably associated with the person or organization it claims to represent.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These roles are specific to signature algorithms. For example, NIST’s FIPS 186-5 specifies ECDSA keys for ECDSA signature generation and verification; it does not make those keys general-purpose encryption keys. The standard also notes that a public key can remain useful for verifying signatures after the associated private key’s cryptoperiod. See NIST FIPS 186-5.
Does the public key encrypt or decrypt?
In public-key encryption schemes, the public key encrypts data or a key, and the matching private key decrypts it. This is an algorithm-dependent role, not a rule that applies to every asymmetric key pair. Some public-key mechanisms establish or protect a key used for encryption rather than encrypting bulk data directly.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep the direction straight for this use: share the public key with someone who needs to encrypt something for you; the private key is needed to decrypt the result.
What is key agreement?
Some asymmetric algorithms use a public key together with a private key in a key-agreement process to compute a shared secret. That shared secret can then support other cryptographic operations. In this case, it is misleading to describe the public key simply as an encryption key: the keys contribute to deriving shared material rather than directly encrypting a message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Which key can you share?
- Public key: May be distributed. A recipient can use it for the operation supported by that algorithm, such as verifying your signature or encrypting something for you.
- Private key: Keep it secret. Anyone with access to it may be able to perform operations reserved for its holder, such as signing or decrypting, depending on the algorithm.
Before relying on a public key, check that it is genuinely associated with the intended owner. The fact that a key is labeled “public” means it may be shared; it does not establish a universal method for validating its owner.
Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
