RSA Cipher

How to use it

1. Paste your public key in SPKI PEM form (BEGIN PUBLIC KEY) into the left box.
2. Paste your private key in PKCS8 PEM form (BEGIN PRIVATE KEY) into the right box.
3. Type a short message (about 190 bytes max for a 2048-bit key) and click Encrypt.
4. Copy the Base64 ciphertext from the output, or paste one there and click Decrypt.
5. Keys are never stored - re-paste them for a new browser session.

Common use cases

• Trying key pairs you generated - confirm an RSA key pair actually encrypts and decrypts round-trip.
• Understanding hybrid encryption - see why RSA wraps small payloads only, and why real systems pair it with AES.
• Debugging PEM formats - quickly tell a SPKI public key from a PKCS8 private key by which side accepts it.
• Secure handoff demos - show how a message encrypted with the public key can only be opened with the private key.

Why it stays private

Key parsing, encryption and decryption run entirely in this page via the Web Crypto API. Keys and messages are never uploaded, never sent to any server, and never written to storage. Closing the tab leaves nothing behind.

FAQ

Q: Why is my long message rejected? A: RSA-OAEP with SHA-256 can only encrypt slightly less than the key size in bytes - about 190 for 2048-bit keys. Real systems use hybrid encryption: AES-GCM for the data, RSA to protect the AES key. This tool enforces the limit honestly instead of hiding it.

Q: What key formats does it accept? A: Encrypt needs a SPKI-encoded public key (BEGIN PUBLIC KEY); decrypt needs a PKCS8-encoded private key (BEGIN PRIVATE KEY). RSA private keys in PKCS1 form (BEGIN RSA PRIVATE KEY) are not accepted.

Q: Where do I generate a key pair? A: Any standard tool works, for example OpenSSL (openssl genpkey plus openssl pkey -pubout) or your platform's key generation UI. Keep the private key offline except when decrypting.