RSA playground

Generate test key pairs, encrypt and decrypt short messages, or sign and verify with RSA.

Development playground. Do not paste production private keys. Generated private keys are unencrypted, kept in page memory and lost on reload. Clear does not erase your clipboard or guarantee secure memory wiping.

RSA scheme

New key size

Generate replaces the keys below. Changing the scheme clears the workspace; use separate keys for encryption and signing.

Public key (SPKI PEM)

Private key (unencrypted PKCS#8 PEM)

Message (UTF-8) to encrypt, or Base64 ciphertext to decrypt

Result

Ready.

Both schemes use SHA-256. OAEP uses an empty label, with a maximum of 190 / 318 / 446 UTF-8 bytes for 2048 / 3072 / 4096-bit keys. Ciphertexts and signatures use standard Base64. PSS uses a 32-byte salt; this is not RS256 JWT signing. To test a round trip, copy the ciphertext into the message field before decrypting, or copy the signature into the signature field while keeping the original message. This tool handles text, not binary files.

General input limit: 1,000,000 characters per field; AES uses the smaller limits stated above. SHA, HMAC, AES and RSA require HTTPS or localhost and browser Web Crypto. Inputs are processed locally, not stored by these tools or placed in the URL.

These pages do not load the site’s AdSense script. Browser extensions, compromised devices or scripts injected by hosting settings are outside the tool’s control. Use synthetic test data; a public website is not a secure key vault.

Technical references: Web Crypto API, JWT (RFC 7519), Base encodings (RFC 4648).