Introduction
Want to see RSA key generation and encryption happen live in your browser? This tool generates 1024, 2048, or 4096-bit RSA key pairs using the Web Crypto API, displays the public and private keys in PEM format, and encrypts or decrypts text with RSA-OAEP (SHA-256) padding. No server round-trips, no third-party libraries. Generate a key pair, paste your plaintext, and the ciphertext appears instantly. The math behind it, integer factorization of the product of two large primes, is the same problem that has kept RSA secure since 1977.
What this tool does
- Generate RSA key pairs at 1024, 2048, or 4096 bits using the browser's native Web Crypto API, with public exponent e = 65537 as specified in PKCS#1
- Display the public key in SPKI/PEM format and the private key in PKCS#8/PEM format, both copyable to clipboard
- Encrypt plaintext with the public key using RSA-OAEP with SHA-256 (PKCS#1 v2.2, RFC 8017), outputting ciphertext as hex or Base64
- Decrypt ciphertext with the private key, accepting hex or Base64 input and validating that the ciphertext length matches the key size
- Enforce the OAEP byte limit automatically: with SHA-256 and a 2048-bit key, you can encrypt at most 190 bytes per operation; the tool tells you if you exceed it
- Run entirely client-side: private keys are generated in your browser session and never transmitted over the network
How this tool works
The tool calls `crypto.subtle.generateKey` with the algorithm name `RSA-OAEP`, the selected modulus length (1024, 2048, or 4096), the public exponent `65537` (encoded as the byte sequence [1, 0, 1]), and the hash `SHA-256`. The browser's native cryptographic implementation handles prime generation, primality testing, and key construction. The resulting `CryptoKey` objects are exported to SPKI (public) and PKCS#8 (private) formats, then base64-encoded and wrapped in PEM headers.
For encryption, the tool encodes the input as UTF-8 and calls `crypto.subtle.encrypt` with the `RSA-OAEP` algorithm and the public key. OAEP (Optimal Asymmetric Encryption Padding) adds randomness and an OAEP label hash, so encrypting the same plaintext twice produces different ciphertexts. This is why OAEP is used instead of the older PKCS#1 v1.5 padding, which is deterministic and vulnerable to Bleichenbacher's 1998 padding oracle attack.
The tool checks the maximum plaintext size before encrypting. With SHA-256 OAEP, the limit is `keySize/8 - 2 * hashSize - 2` bytes. For a 2048-bit key that is 256 - 64 - 2 = 190 bytes. For 4096-bit it is 446 bytes. If your input exceeds this, the tool shows an error and suggests hybrid encryption (RSA to wrap an AES key, then AES-GCM for the data).
For decryption, the tool parses the hex or Base64 input into bytes, verifies the length matches `keySize/8`, and calls `crypto.subtle.decrypt` with the private key. If the padding is invalid or the ciphertext was not produced by the matching public key, the browser throws a decryption error.
How RSA works (PKCS#1, RFC 8017)
RSA was introduced by Ron Rivest, Adi Shamir, and Leonard Adleman in 1977 (Rivest, Shamir, Adleman 1978). The algorithm relies on the difficulty of factoring the product of two large primes. Key generation picks two distinct primes p and q, computes the modulus n = p * q, and calculates Euler's totient phi(n) = (p-1)(q-1). The public exponent e is chosen (65537 by convention), and the private exponent d is computed as the modular inverse of e modulo phi(n), meaning e * d = 1 mod phi(n). This inverse is found with the extended Euclidean algorithm.
Encryption transforms a message m into ciphertext c = m^e mod n. Decryption recovers m = c^d mod n. This works because of Euler's theorem: if m is coprime to n, then m^phi(n) = 1 mod n, so m^(e*d) = m^(1 + k*phi(n)) = m mod n. The public key is (n, e); the private key is (n, d). Anyone can encrypt, but only the holder of d can decrypt.
The current standard is RFC 8017, which specifies PKCS#1 v2.2 and mandates OAEP for new applications. FIPS 186-5 approves RSA with 2048 and 3072-bit keys for digital signatures and key establishment. NIST disallows 1024-bit keys for new use, as factoring a 1024-bit RSA modulus is within reach of well-funded adversaries. The largest publicly known RSA factorization is RSA-250 (829 bits), factored in 2020 by Boudot et al.
RSA is not used to encrypt bulk data directly. It is too slow and the plaintext size is limited by the modulus. In practice, RSA encrypts a symmetric key (AES), and the symmetric key encrypts the actual data. This is called hybrid encryption and is what TLS, PGP, and JWT (RSA-OAEP with AES-GCM) all do.
How to use this tool
- Select a key size: 1024-bit (broken, education only), 2048-bit (minimum recommended), or 4096-bit (high security). 2048 is the default and is sufficient for most applications
- Click Generate key pair. The browser generates two large primes, computes the modulus and exponents, and displays the public and private keys in PEM format
- Copy the public key if you want to share it. The private key is sensitive: never paste a real private key into any web tool. This generated key exists only in your browser session
- Choose a direction: Encrypt with public key or Decrypt with private key
- For encryption, type or paste your plaintext. The tool checks the OAEP byte limit (190 bytes for 2048-bit, 446 for 4096-bit) and shows an error if you exceed it
- Select output format: Base64 or Hex. For decryption, select the format your ciphertext is in
- For decryption, paste the ciphertext in the matching format. The tool validates the byte length matches the key size before attempting decryption
- Click Swap encrypt/decrypt to reverse the operation without regenerating keys
Real-world examples
Encrypting a short message with a 2048-bit key
Generate a 2048-bit key pair, paste `Hello RSA` as plaintext, select Base64 output, and click Encrypt. The tool encodes the 9-byte string as UTF-8, applies OAEP padding with a random seed, and produces a 256-byte ciphertext encoded as Base64. Each time you encrypt the same plaintext, the output differs because OAEP injects randomness.
Decrypting and verifying round-trip
After encrypting, click Swap to switch to decrypt mode. Paste the Base64 ciphertext from the previous step. The tool decodes it to 256 bytes, calls `crypto.subtle.decrypt` with the private key, and recovers `Hello RSA`. If you paste a ciphertext that was not produced by this public key, or alter a single byte, decryption fails with an error. This is OAEP's integrity check at work.
Hitting the OAEP byte limit
Generate a 1024-bit key and try to encrypt a 200-byte plaintext. The tool rejects it: with SHA-256 OAEP and a 1024-bit key, the maximum is 128 - 64 - 2 = 62 bytes. Switch to a 4096-bit key and the same 200-byte plaintext encrypts fine (limit is 446 bytes). This demonstrates why RSA is not used for bulk encryption. For larger payloads, generate a random AES-256 key, encrypt the data with AES-GCM, and encrypt the AES key with RSA.
Why 1024-bit keys are broken
Generate a 1024-bit key pair. The tool warns that 1024-bit RSA was factored in practice by 2020-era resources. The RSA Factoring Challenge (RSA-1024, now retired) offered a prize for factoring a 1024-bit modulus. While no public factorization of a 1024-bit RSA key has been announced, the computational cost is estimated at a few thousand core-years, well within nation-state budgets. Use 2048-bit minimum for anything real.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| RSA-2048-OAEP | 2048-bit modulus, OAEP/SHA-256 | TLS key exchange, JWT encryption, minimum recommended |
| RSA-4096-OAEP | 4096-bit modulus, OAEP/SHA-256 | High-security, slower key generation and encryption |
| RSA-1024-OAEP | 1024-bit modulus, OAEP/SHA-256 | Education only, broken by nation-state resources |
| RSA-PKCS1-v1.5 | Deterministic padding, no OAEP | Legacy, vulnerable to Bleichenbacher oracle attacks |
| ECDSA P-256 | 256-bit curve, ~128-bit security | Signatures, same security as RSA-3072 at smaller key size |
| ECDH P-256 | 256-bit curve, key agreement | Forward-secret key exchange, TLS 1.3 |
Limitations or considerations
RSA-OAEP can encrypt only a small payload per operation: 190 bytes with a 2048-bit key and SHA-256, 446 bytes with 4096-bit. For anything larger, use hybrid encryption. Generate a random AES key, encrypt the data with AES-GCM via the Block Cipher tool, and encrypt the AES key with RSA. This is how TLS and PGP work.
This tool does not display the raw RSA parameters (n, e, d, p, q). It exports keys in standard PEM format. To inspect the individual components of an RSA key, use the RSA Key Inspector or the ASN.1 DER Decoder.
1024-bit keys are included for education only. NIST SP 800-131A disallows 1024-bit RSA for key transport after 2013. The tool warns you when you select 1024-bit. For production, use 2048-bit minimum, or switch to elliptic curve cryptography (ECDSA, ECDH) which provides equivalent security with much smaller keys.
The tool does not support PKCS#1 v1.5 padding. OAEP is the only safe padding scheme for RSA encryption, and the Web Crypto API does not expose v1.5 for encryption. If you need to decrypt legacy v1.5 ciphertext, use OpenSSL with explicit flags, but be aware of the padding oracle risk.
Frequently asked questions
Why does the same plaintext produce different ciphertext each time?
RSA-OAEP adds a random seed before padding the message. This means encryption is non-deterministic: the same plaintext encrypted twice with the same public key yields different ciphertexts. This is a security feature. Without it (as in PKCS#1 v1.5), an attacker can detect repeated messages and mount chosen-ciphertext attacks.
What is the maximum plaintext size for RSA-OAEP with SHA-256?
The limit is keySize/8 - 2 * hashSize - 2 bytes. With SHA-256 (32-byte hash) and a 2048-bit key (256 bytes), the maximum is 256 - 64 - 2 = 190 bytes. With a 4096-bit key it is 446 bytes. With a 1024-bit key it is 62 bytes. If you need to encrypt more, use hybrid encryption: wrap an AES key with RSA, encrypt the data with AES.
Why is the public exponent always 65537?
65537 (0x10001) is a Fermat prime (2^16 + 1). It is large enough to avoid attacks that work against small exponents like e=3, but small enough that modular exponentiation m^e mod n is fast (only 17 multiplications via square-and-multiply). PKCS#1 recommends 65537, and nearly all real-world RSA keys use it. The Web Crypto API hardcodes it.
Is RSA secure against quantum computers?
No. Shor's algorithm, running on a sufficiently large quantum computer, can factor the RSA modulus in polynomial time, breaking RSA completely. A fault-tolerant quantum computer with around 20 million physical qubits could factor a 2048-bit RSA key in hours. NIST is standardizing post-quantum algorithms (ML-KEM, ML-DSA) to replace RSA and ECC. For now, RSA remains secure against classical computers.
What is the difference between RSA encryption and RSA signing?
Encryption uses the public key to encrypt and the private key to decrypt. Signing uses the private key to sign and the public key to verify. The underlying operation is the same (modular exponentiation), but the padding differs: encryption uses OAEP, signing uses PSS (Probabilistic Signature Scheme). This tool does encryption only. For RSA signatures, use a dedicated signing tool or the Web Crypto API with `RSASSA-PKCS1-v1_5` or `RSA-PSS`.
Can I use this tool with my existing RSA key pair?
The tool generates keys internally via the Web Crypto API and does not import external keys. If you have a PEM key, you can use the PEM Key Parser to inspect it, or use OpenSSL on the command line for encryption with an existing key. This tool is designed for learning and quick testing with freshly generated keys.
Conclusion
RSA remains the most widely deployed public-key cryptosystem, specified in RFC 8017 and approved in FIPS 186-5 for 2048-bit and larger keys. This tool shows the full cycle: key generation, OAEP encryption, and decryption, all in the browser. For symmetric encryption to pair with RSA key wrapping, see the AES Encrypt / Decrypt tool. For key agreement without encryption, see the Diffie-Hellman Key Exchange. For digital signatures on elliptic curves, see the ECDSA Signature Tool.