RSA Tool: Generate Keys, Encrypt, Decrypt, Sign, Verify
Generate RSA key pairs as PEM, encrypt and decrypt with RSA-OAEP, and sign or verify with PKCS#1 v1.5 or PSS, all in your browser with the Web Crypto API. Keys never leave your device.
About the RSA Tool
The RSA Tool generates RSA key pairs, encrypts and decrypts short messages with RSA-OAEP, and signs and verifies messages with RSASSA-PKCS1-v1_5 or RSA-PSS. Pick a mode at the top: Generate keys, Encrypt, Decrypt, Sign or Verify. A key pair you generate is filled into the other modes, so you can try a full round trip in a few clicks. All of the cryptography is done by your browser's built-in Web Cryptography API. Keys, messages and signatures never leave your device, and nothing is uploaded.
How to use it
Generate keys
- Choose a key size. 2048 bits is the default and the common minimum today; 3072 and 4096 bits give a larger security margin and take longer to generate.
- Press Generate key pair. The button shows a busy state while the browser searches for the two primes, which can take a few seconds for 4096 bits.
- Copy or download the private key (PKCS#8,
BEGIN PRIVATE KEY) and the public key (SPKI,BEGIN PUBLIC KEY) as.pemfiles.
Encrypt and decrypt
- In Encrypt, paste a public key, choose the OAEP hash (SHA-256 by default, SHA-1 for older systems) and type a message. The page tells you how many bytes the key can encrypt.
- Press Encrypt and copy the ciphertext as Base64 or hex. OAEP is randomised, so the ciphertext changes every time even for the same message.
- In Decrypt, paste the matching private key, the same OAEP hash and the ciphertext, then press Decrypt.
Sign and verify
- In Sign, paste a private key, choose the scheme and hash, type the message and press Sign.
- In Verify, paste the public key, the message and the signature (Base64 or hex), with the same scheme and hash, and press Verify. The page reads Signature is valid or Signature is NOT valid.
Privacy
Private keys are generated locally with the browser's cryptographically secure random number generator and are never sent to our servers. Keys you paste are read only in this tab and are forgotten when you close it. For keys that protect real systems, prefer generating them on the machine that will use them, for example with OpenSSL.
Key formats
The key fields accept PEM in the four formats in common use: PKCS#8 (BEGIN PRIVATE KEY) and SPKI (BEGIN PUBLIC KEY), which OpenSSL 3 writes by default, and the older PKCS#1 forms (BEGIN RSA PRIVATE KEY, BEGIN RSA PUBLIC KEY). A private key also works where a public key is needed, because the public key is part of it. Passphrase-protected keys and certificates are not read; remove the passphrase with openssl pkey or extract the public key with openssl x509 -pubkey -noout first.
OAEP, PKCS#1 v1.5 and PSS
RSA-OAEP for encryption
OAEP (Optimal Asymmetric Encryption Padding) is the encryption padding recommended by PKCS #1 since version 2. It mixes a random seed into the message so the same plaintext never encrypts to the same ciphertext. It can only carry a short message: a 2048-bit key with SHA-256 holds at most 190 bytes. Real systems encrypt a random symmetric key with RSA and the data with AES. The old PKCS#1 v1.5 encryption padding is not offered because it is open to padding-oracle attacks.
PKCS#1 v1.5 and PSS for signatures
RSASSA-PKCS1-v1_5 is deterministic and still the most widely deployed signature scheme, used in TLS certificates and JSON Web Tokens with RS256. RSA-PSS adds a random salt and has a security proof; it is used by TLS 1.3 and PS256 tokens. Here the PSS salt is as long as the hash, which matches OpenSSL's rsa_pss_saltlen:digest.
Key sizes
1024-bit keys are not secure and are offered only for tests and legacy systems. 2048 bits is the accepted minimum, and NIST recommends 3072 bits for protection beyond 2030. Larger keys make signing and decryption slower.
OpenSSL equivalents
- Generate a key:
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private.pem, thenopenssl pkey -in private.pem -pubout -out public.pem. - Encrypt with OAEP and SHA-256:
openssl pkeyutl -encrypt -pubin -inkey public.pem -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -in message.txt | base64. - Sign with PKCS#1 v1.5 and SHA-256:
openssl dgst -sha256 -sign private.pem message.txt | base64.
Related tools
To read the header and claims of an RS256 token, use the JWT Decoder. To move a signature or ciphertext between Base64 and raw bytes, use the Base64 Encoder, and for fingerprints of files use the Hash Generator. Only need a key pair? Go straight to the RSA Key Generator.
Open-source credits
- All RSA operations use the browser's built-in Web Cryptography API (W3C Recommendation); no third-party cryptography library is loaded.
- The algorithms follow RFC 8017 (PKCS #1: RSA Cryptography Specifications Version 2.2). PEM follows RFC 7468, and the small PKCS#1 to PKCS#8 and SPKI wrapper written for this site follows RFC 5208 and RFC 5280. The tests check it against keys, ciphertexts and signatures produced by Node.js.
Frequently asked questions
Is it safe to generate an RSA private key in a web page?
The key is generated by your browser's Web Cryptography API from its cryptographically secure random number generator, and it is never sent anywhere. Even so, for keys that protect production systems the safest habit is to generate them on the machine that will use them, for example with openssl genpkey.
Why can I only encrypt a short message?
RSA encrypts one block no larger than the key, and OAEP padding takes part of it. A 2048-bit key with SHA-256 carries at most 190 bytes, and with SHA-1 at most 214. Real systems encrypt a random AES key with RSA and the data itself with AES.
Why does the ciphertext change every time I encrypt the same text?
OAEP mixes a fresh random seed into every encryption, so identical messages give different ciphertexts. That is deliberate: it stops an observer from telling whether two ciphertexts hide the same message. Each one still decrypts to the original text with the private key.
Should I sign with PKCS#1 v1.5 or PSS?
Use whatever the verifying system expects. PKCS#1 v1.5 is the most widely supported and is what RS256 tokens and most certificates use. PSS is the newer, provably secure scheme used by TLS 1.3 and PS256 tokens. Both are secure with a 2048-bit or larger key.
Why does decryption fail with my key?
Decryption fails when the private key does not match the public key used to encrypt, when the OAEP hash differs (SHA-1 and SHA-256 are not interchangeable), or when the ciphertext was changed or truncated. RSA deliberately gives no more detail than that, to avoid leaking information to an attacker.
Which key formats can I paste?
PEM in PKCS#8 (BEGIN PRIVATE KEY), SPKI (BEGIN PUBLIC KEY) and the older PKCS#1 forms (BEGIN RSA PRIVATE KEY, BEGIN RSA PUBLIC KEY). A private key also works where a public key is needed. Passphrase-protected keys and certificates must be converted with OpenSSL first.