Encrypt a short message with an RSA public key and decrypt it with the matching private key, using RSA-OAEP through your browser's Web Crypto API. Paste PEM or JWK keys, or generate a test key pair in one click.
Last updated:
Do the same with OpenSSL
Everything runs locally with the Web Crypto API; keys and messages never leave this page. Generated key pairs are for testing; for real secrets, create keys on the machine that will keep them.
Advertisement
Advertisement
How to use the RSA Encryption Tool
Add keys: paste the recipient's public key to encrypt, or the private key to decrypt. Press Generate key pair to try it with fresh test keys.
Pick the OAEP hash. SHA-256 is the modern default; choose SHA-1 to work with OpenSSL, Java or .NET code that uses plain OAEP padding.
Encrypt: type the message and press Encrypt message. Copy the Base64 (or hex) ciphertext.
Decrypt: switch to the Decrypt tab, paste the ciphertext and press Decrypt message. The same hash and label must be used on both sides.
Check interoperability with the OpenSSL commands under Do the same with OpenSSL.
Maximum message size for RSA-OAEP
An OAEP-padded block can carry at most k − 2·hLen − 2 bytes, where k is the modulus length in bytes and hLen the hash output length (SHA-1 20, SHA-256 32, SHA-384 48, SHA-512 64 bytes). The ciphertext is always exactly k bytes long, whatever the message length.
Key size
Ciphertext
OAEP SHA-1
OAEP SHA-256
OAEP SHA-512
2048-bit
256 bytes (344 Base64 chars)
214 bytes
190 bytes
126 bytes
3072-bit
384 bytes (512 Base64 chars)
342 bytes
318 bytes
254 bytes
4096-bit
512 bytes (684 Base64 chars)
470 bytes
446 bytes
382 bytes
Sizes are counted in UTF-8 bytes, so letters such as é or emoji use 2 to 4 bytes each.
Key formats this tool reads
Header
Format
Use
BEGIN PUBLIC KEY
X.509 SubjectPublicKeyInfo (SPKI)
Encrypt
BEGIN RSA PUBLIC KEY
PKCS#1 public key
Encrypt
BEGIN CERTIFICATE
X.509 certificate (its public key is used)
Encrypt
BEGIN PRIVATE KEY
PKCS#8 private key
Decrypt (or encrypt via the derived public key)
BEGIN RSA PRIVATE KEY
PKCS#1 private key (traditional OpenSSL)
Decrypt
{"kty":"RSA", …}
JSON Web Key or JWKS
Encrypt or decrypt
Password-protected keys (BEGIN ENCRYPTED PRIVATE KEY) must be unlocked first with openssl pkey -in key.pem -out plain.pem. Need a key pair to start? Use the RSA key generator.
When to use RSA encryption
Short secrets such as a password, API token or symmetric key that only the private-key owner should read.
Hybrid encryption for anything longer: encrypt the data with AES-GCM (for example in the text encryption tool) and encrypt the random AES key with RSA.
Not for signatures: to prove who wrote a message, sign it (RSA-PSS or ECDSA) instead of "encrypting with the private key".
Use 2048-bit keys at minimum and 3072-bit keys for data that must stay secret beyond 2030, following NIST SP 800-57 guidance.
Frequently asked questions
How does RSA encryption work?
RSA uses a key pair. Anyone can encrypt with the public key, but only the holder of the private key can decrypt. Mathematically the message m becomes c = m^e mod n with the public exponent e and modulus n, and is recovered as m = c^d mod n with the private exponent d. OAEP padding adds randomness and integrity checks before that step.
Why is the ciphertext different every time?
RSA-OAEP mixes a fresh random seed into the padding for each encryption, so the same message and key give a different ciphertext every time. This is intentional: it stops an attacker from guessing the message by encrypting candidates and comparing. All versions decrypt to the same text.
How long can the message be?
One RSA-OAEP block holds at most k − 2h − 2 bytes, where k is the key size in bytes and h the hash length. A 2048-bit key with SHA-256 fits 190 bytes; with SHA-1 it fits 214 bytes. For longer data, encrypt it with AES and encrypt only the AES key with RSA (hybrid encryption).
Why does decryption fail with a message from OpenSSL or Java?
The most common cause is a hash mismatch. openssl pkeyutl with rsa_padding_mode:oaep and Java's RSA/ECB/OAEPPadding use SHA-1 by default, while this tool defaults to SHA-256. Switch the OAEP hash to SHA-1 and try again. A different OAEP label or the wrong private key also cause failures.
Does it support PKCS#1 v1.5 padding?
No. The Web Crypto API only offers RSA-OAEP for encryption, because the older PKCS#1 v1.5 encryption padding is vulnerable to padding-oracle attacks. RSA-OAEP is the recommended scheme in PKCS#1 v2.2 (RFC 8017).
Can I encrypt with the private key and decrypt with the public key?
Not with RSA encryption. Using the private key on data is signing, which proves who created it rather than hiding it. If you paste a private key into the public key box, this tool derives the public key from it and encrypts normally.
Are my keys and messages safe here?
Everything runs in your browser with Web Crypto; nothing is uploaded or stored. Even so, avoid pasting production private keys into any web page. Generated key pairs are fine for testing and learning.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.