RSA Encryption Online: Real RSA-OAEP Keys and Step-by-Step Math

Learn RSA with a full small-prime step table, or use real-strength RSA-OAEP encryption via your browser.

This tool runs in two genuinely different modes rather than one simplified stand-in for the other: 'Learn the math' generates textbook-scale RSA keys from small primes you can inspect by eye, with every step of prime testing, key derivation and modular exponentiation shown; 'Real encryption' generates a full-strength 2048 or 4096-bit RSA-OAEP key pair through the browser's native SubtleCrypto and actually encrypts real messages with it.

How to encrypt a message with RSA

  1. Switch to Real encryption, choose a 2048 or 4096-bit modulus and press Generate key pair. A 4096-bit pair can take noticeably longer to appear.
  2. The public key is shown as Base64 SPKI, the same bytes that sit between the BEGIN and END lines of a PEM public key. The private key never leaves the page, there is no field for importing an outside key, and the pair is gone when you reload.
  3. Type your message. The counter shows its UTF-8 size against the limit: 190 bytes at 2048 bits or 446 bytes at 4096 bits, and accented letters or emoji take more than one byte each.
  4. Press Encrypt to get Base64 ciphertext, then Decrypt to recover the text with the matching private key. Encrypting the same message twice gives different ciphertext, because OAEP mixes in fresh randomness every time.

Learn the math: small primes, every step visible

Two small primes you choose (or generate at random within a small range) become n = p times q and phi(n) = (p-1) times (q-1). Primality itself is checked with the Miller-Rabin test using a fixed set of deterministic witnesses that give an exact — not merely probable — answer for any number this small, so there's no chance of a false positive slipping through at toy scale. The public exponent e defaults to the smallest workable candidate from a short standard list (65537, 257, 17, 5, 3, tried in that order) that's coprime to phi(n) and won't reduce encryption to the identity function.

The private exponent d is computed with the Extended Euclidean Algorithm, and this tool records every row of that algorithm's iterative table — quotient, remainder, and both running coefficients — so the worked derivation of d matches exactly what a textbook table would show. Encrypting and decrypting a number then runs modular exponentiation via square-and-multiply, again with every bit of the exponent and the running result recorded as a visible step, computed entirely in native JavaScript BigInt arithmetic to avoid the overflow a fixed-size number type would hit almost immediately at even modest key sizes.

RSA key generation, step by step

These are the numbers Learn the math starts with, so you can follow along in the tool's own worked table.

  1. Choose two different primes. The defaults are p = 61 and q = 53; Generate random primes picks two from 11 to 97, and every candidate is checked with deterministic Miller-Rabin.
  2. Multiply them for the modulus, n = 61 × 53 = 3233, and compute φ(n) = (61 − 1) × (53 − 1) = 3120, the count of numbers from 1 to n that share no factor with n.
  3. Pick a public exponent e that is smaller than φ(n) and coprime to it. The tool tries 65537, 257, 17, 5 and 3 in that order; 65537 exceeds 3120, so it settles on e = 257.
  4. Derive the private exponent d with the Extended Euclidean Algorithm so that e × d leaves remainder 1 when divided by φ(n). Here d = 2513, because 257 × 2513 = 645,841 = 207 × 3120 + 1.
  5. Encrypt with c = mᵉ mod n and decrypt with m = cᵈ mod n. The default message m = 42 encrypts to c = 1581, and 1581²⁵¹³ mod 3233 brings back 42.

Real encryption: genuine RSA-OAEP at production key sizes

Switching modes generates an actual 2048 or 4096-bit RSA key pair through crypto.subtle.generateKey, using RSA-OAEP padding with SHA-256 and the standard 65537 public exponent — the same primitive real TLS certificates and encrypted-messaging key exchange use, not a scaled-down imitation. Key generation itself isn't shown step by step, because SubtleCrypto's implementation is opaque by design; what you get instead is the actual public key (exportable as base64-encoded SPKI) and working encrypt/decrypt operations against it.

RSA-OAEP can only encrypt a single block directly, and that block has a hard ceiling: modulusLength/8 minus twice the hash length minus 2, which works out to 190 bytes at 2048 bits. A longer message simply won't fit — this tool doesn't chunk or hybrid-encrypt it for you, matching how RSA-OAEP is actually meant to be used in practice: to wrap a much shorter symmetric key, not to encrypt a full message directly.

OAEP vs PKCS#1 v1.5 padding

Unpadded, textbook RSA is deterministic and malleable: the same message always yields the same ciphertext, and an attacker can multiply ciphertexts together with predictable effects on the plaintext. Padding fixes both problems by packing randomness and a checkable structure into the block before the exponentiation.

PKCS#1 v1.5 encryption padding puts random nonzero bytes behind a fixed two-byte prefix. In 1998 Daniel Bleichenbacher showed that a server which reveals whether a decrypted block had valid padding lets an attacker decrypt ciphertexts through repeated queries, and variants of that attack kept turning up in TLS stacks for two decades, including ROBOT in 2017.

OAEP instead masks the message with two hash-derived values keyed by a random seed, and it has a security proof under standard assumptions. This tool uses RSA-OAEP with SHA-256 only; Web Crypto doesn't expose v1.5 encryption at all. OAEP's overhead is twice the hash length plus 2 bytes, 66 in total, which is why a 256-byte block at 2048 bits carries at most 190 bytes of message.

Neither mode is something you should build on

Questions people ask about RSA & Asymmetric Crypto Demo

Why does 'Learn the math' mode use such small prime numbers?
So every step — primality testing, computing n and phi(n), deriving the private exponent through the Extended Euclidean Algorithm, and the modular exponentiation used to encrypt and decrypt — stays small enough to actually read and follow by hand. Real RSA keys use primes hundreds of digits long specifically because that scale makes factoring n computationally infeasible, which is the opposite of what a teaching tool needs.
Is the 'Real encryption' mode actually secure, or is it also just for learning?
The cryptography itself is real: a genuine 2048 or 4096-bit RSA-OAEP key pair generated through the browser's native SubtleCrypto implementation, the same primitive used in production systems. What's missing is everything around it that a real deployment needs — secure key storage, certificate infrastructure, revocation — so treat it as a correct demonstration of the primitive, not a complete secure-messaging system.
Why can't I encrypt a long message directly in real encryption mode?
RSA-OAEP has a hard per-block size limit determined by the key size and hash length — 190 bytes at 2048 bits — because that's how the padding scheme's math works, not an arbitrary restriction. Real systems handle this by using RSA only to encrypt a short symmetric key and then encrypting the actual message with that symmetric key, which this tool doesn't automate for you.
What should I actually use if I need to encrypt something for real?
A maintained tool or library built specifically for the job, such as age for file encryption or a well-reviewed cryptography library implementing a modern hybrid scheme, rather than hand-assembling raw RSA calls. This demo is accurate about what RSA-OAEP does, but a safe real-world system needs correct key management and protocol design around it that a single-purpose demo page doesn't provide.
What RSA key size should I use?
2048 bits is the usual minimum today, and NIST treats it as acceptable through 2030. 3072 or 4096 bits give longer-term margin at the cost of slower key generation and decryption. Real encryption mode offers 2048 and 4096, while the toy keys in Learn the math are only a few digits long.
What is the difference between OAEP and PKCS#1 v1.5 padding?
Both add randomness so equal messages don't encrypt identically. OAEP masks the whole block with hash-derived values and has a proof of security; v1.5 uses a simpler layout that leaks the plaintext to an attacker who can learn whether padding checks pass. OAEP is the only encryption padding this tool implements.
What is the difference between RSA and AES?
RSA is asymmetric: anyone can encrypt with the public key, only the private key decrypts, and a single operation handles just a small block. AES is symmetric, uses one shared key, is fast, and handles data of any length. Real systems combine them, using RSA or elliptic-curve key exchange to protect an AES key.
Why is the public exponent usually 65537?
65537 is prime and equals 2¹⁶ + 1, so in binary it is a 1, fifteen 0s and a 1: encrypting takes only 16 squarings and one multiplication. It is also large enough to avoid the attacks that hit e = 3 with weak padding. Real encryption mode always uses it; toy keys fall back to smaller values when φ(n) is too small.

Related tools on BrakeTools

Content reviewed 2026-09-27.