Generate RSA key pairs and encrypt/decrypt messages using RSA-OAEP with the WebCrypto API.
RSA-OAEP encrypts a message with a public key so that only the matching private key can decrypt it. This tool generates a fresh key pair in the browser, then encrypts and decrypts text with the WebCrypto implementation of RSA-OAEP, the standard padding scheme for RSA encryption. The surprise is scale: RSA is not a general message encoder. A 2048-bit key carries at most 190 bytes of plaintext with SHA-256 OAEP, and the same message produces different ciphertext on every run because OAEP adds random padding. Nothing you enter or generate ever leaves the page.
A concrete input and expected output from the current implementation.
Input
Hello, world! (encrypt with the public key of a freshly generated 2048-bit pair)
Expected output
A 256-byte ciphertext (344 characters if displayed as base64) that differs on every run; decrypting it with the private key returns exactly 'Hello, world!'.
RSA-OAEP is randomized: the padding layer draws a fresh random seed per encryption, so the ciphertext cannot be predicted or reproduced, yet always decodes back to the same message. The 256-byte length is fixed by the 2048-bit modulus, not the 13-byte message.
The browser generates two large primes p and q and computes the modulus n = p*q; the public key is (n, e) with e usually 65537, and the private key is the exponent d that inverts e modulo (p-1)(q-1). WebCrypto performs this in one asynchronous call, and the key material lives only in the page's memory - nothing is sent over the network.
Before encryption, EME-OAEP mixes the message with a random seed using hash-based masks, and the padded result must fit inside the modulus. Plaintext is therefore capped at k - 2*hLen - 2 bytes (190 bytes for a 2048-bit key with SHA-256), while the ciphertext is always exactly k bytes. Decryption reverses the masks and verifies the padding, so the wrong key yields an error rather than garbage.
RSA-OAEP intentionally mixes a fresh random seed into the padding before each encryption, as specified in RFC 8017, so ciphertext is nondeterministic. This prevents attackers from learning anything by comparing two encryptions of the same text. Every run decrypts to the same message, so the changing output is not a bug.
No. RSA-OAEP fits only k - 2*hLen - 2 bytes of plaintext per operation, which is 190 bytes for a 2048-bit key with SHA-256. Production systems therefore use hybrid encryption: RSA encrypts a small symmetric key, and that key encrypts the actual data with AES or similar.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.