RSA Encryption with a Public Key
Encrypt a short message with an RSA public key (PEM) using RSA-OAEP SHA-256, OAEP SHA-1 or PKCS#1 v1.5. Generate a test key pair in one click. Local only.
OAEP is the recommended padding. MGF1 uses the same hash, like Web Crypto and openssl pkeyutl -pkeyopt rsa_oaep_md.
RSA can only encrypt short data: for a 2048-bit key at most 190 bytes (OAEP SHA-256), 214 bytes (OAEP SHA-1) or 245 bytes (PKCS#1 v1.5). For longer data encrypt it with AES and encrypt only the AES key with RSA.
RSA encryption is randomized: encrypting the same text twice gives different ciphertexts, and both decrypt correctly.
Runs entirely in your browser. Your data is never uploaded.
What is RSA Encryption?
Encrypts a short message or a symmetric key with an RSA public key in PEM format (SPKI BEGIN PUBLIC KEY, PKCS#1 BEGIN RSA PUBLIC KEY, an X.509 certificate or a private key from which the public part is taken). Only the owner of the matching private key can decrypt the result.
How to use RSA Encryption
- Paste the recipient's Public key (PEM), or click Generate a test key pair (2048-bit) to try it out.
- Choose the Padding: RSA-OAEP (SHA-256) is recommended; match whatever the receiving code expects.
- Type the Plaintext (or switch the input encoding to Hex to encrypt raw bytes such as an AES key).
- Click Encrypt and copy the Base64 or Hex ciphertext.
Example
"Hello RSA" with a 2048-bit public key, RSA-OAEP (SHA-256), Base64 output
A 344-character Base64 string (256 bytes) that changes on every run
RSA-OAEP is randomized, so no fixed output exists; decrypting it with the private key returns "Hello RSA".
When to use RSA Encryption
Use RSA to encrypt small secrets – a password, a token or a randomly generated AES key – for someone whose public key you have. Do not use it for large data: encrypt the data with AES and encrypt only the AES key with RSA (hybrid encryption), or use PGP. Prefer OAEP; use PKCS#1 v1.5 only if a legacy system requires it.
How RSA Encryption works
RSA encryption computes c = mᵉ mod n on the padded message. OAEP (PKCS#1 v2.2) masks the message with MGF1 using SHA-256 or SHA-1 and random seed bytes; PKCS#1 v1.5 prepends random non-zero padding. Padding is randomized, so encrypting the same text twice gives different ciphertexts. The ciphertext is as long as the modulus (256 bytes for 2048-bit keys). The maximum message size is k − 2·hLen − 2 bytes for OAEP and k − 11 for v1.5 (190, 214 and 245 bytes for a 2048-bit key). Keys are parsed and encryption is done with node-forge; results interoperate with OpenSSL, Web Crypto and Node.js.
Common Use Cases
- Encrypt an AES session key for hybrid encryption tests
- Check that your backend can decrypt OAEP-SHA256 ciphertext from a browser
- Send a short secret to someone who gave you their public key
- Produce PKCS#1 v1.5 test data for a legacy API
- Learn how RSA message-size limits depend on key size and padding
Security Note
Keys and messages are processed only in your browser. Do not paste production private keys into any website you do not control – generate a test key pair instead.
FAQs
Why is my message too long?
RSA can only encrypt a few hundred bytes. With a 2048-bit key OAEP SHA-256 allows 190 bytes. Encrypt longer data with AES and use RSA only for the AES key.
Which padding should I choose?
RSA-OAEP with SHA-256 for new systems (Web Crypto RSA-OAEP with hash: 'SHA-256', OpenSSL pkeyutl -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256). OAEP SHA-1 is the default of many older libraries (Java RSA/ECB/OAEPWithSHA-1AndMGF1Padding). PKCS#1 v1.5 only for legacy compatibility.
Why does the ciphertext change every time?
Both paddings add random bytes before encryption. This prevents attackers from guessing short messages by encrypting candidates themselves.
Can I encrypt with a private key?
You can paste a private key – its public half is used for encryption. "Encrypting with the private key" in the sense of signing is a different operation and not offered here.