RSA Encryption / Decryption
Generate RSA key pairs, encrypt with public key, decrypt with private key
Use RSA Encryption / Decryption
Step 1: Generate RSA Key Pair
Step 2: Encrypt or Decrypt
RSA-OAEP Details
Assumptions
Use this page when you need to inspect a browser-side RSA flow, generate a key pair, or verify that public-key encryption and private-key decryption behave as expected.
Worked example
Where This RSA Tool Helps
- Test PEM key generation and confirm that a public key can encrypt the sample payload your app is failing to process.
- Reproduce an RSA-OAEP issue before you hand the problem back to backend, mobile, or security teams.
Validate The RSA Workflow
- Make sure the ciphertext size and plaintext length stay within RSA-OAEP limits for the selected key size.
- Confirm that the correct public and private key pair is being used before comparing outputs.
- If the payload is large, switch to a hybrid flow and encrypt only the AES session key with RSA.
About This Tool
RSA Encryption and Decryption: Public-Key Cryptography for Secure Communication
The RSA Encryption/Decryption Tool provides a complete browser-based implementation of the RSA asymmetric cryptographic algorithm. RSA uses a mathematically linked pair of keys: a public key for encryption and a private key for decryption. This tool supports 2048 and 4096-bit keys with RSA-OAEP padding and SHA-256. All operations execute entirely within your browser via the Web Crypto API.
Real-World Use Cases
RSA powers TLS/SSL handshakes, SSH key authentication, JWT signing (RS256), PGP email encryption, and code signing certificates. In practice, RSA is used in hybrid encryption: RSA encrypts a random AES session key, and AES encrypts the actual data.
RSA Best Practices
Use minimum 2048-bit keys. Always use OAEP padding for encryption. For hashing alongside RSA, try our SHA-256 Generator and HMAC Generator. Browse all tools on the Encode/Decode tools page.
How RSA-OAEP Fits into Real Application Flows
Teams usually search for RSA encryption online when they need to debug a public-key workflow without setting up a full local script. Common tasks include generating a fresh PEM key pair, confirming that a browser or mobile app can encrypt data with the expected public key, and verifying that a backend service can decrypt with the matching private key. RSA-OAEP is designed for modern asymmetric encryption and is a better default than older PKCS#1 v1.5 padding for new work. If your broader flow also needs symmetric encryption for the main payload, pair this page with our AES Encryption Tool.
Payload Size Limits and Hybrid Encryption
A common reason RSA encryption appears to fail is simple payload size. RSA should encrypt small secrets such as API keys, session keys, or challenge data, not long JSON payloads or documents. The exact plaintext limit depends on key length and padding overhead, so a 2048-bit key can only encrypt a relatively small amount of raw data before OAEP rejects the input. In production systems the standard pattern is hybrid encryption: generate a random AES key, encrypt the real message with AES, then encrypt only that AES key with RSA. That gives you the convenience of public-key distribution without forcing RSA to carry large data directly.
Common RSA Debugging Mistakes
When ciphertext cannot be decrypted, first confirm that the key pair actually matches and that the public and private PEM blocks were not truncated, reformatted, or copied with missing line breaks. Next check that both sides use the same padding mode and hash settings, because OAEP parameter mismatches are a frequent source of interoperability bugs. Finally, remember that RSA encryption and RSA signing are different operations. If you are validating signatures, hashes, or message authentication, the right companion tools are our SHA-256 Generator and HMAC Generator.