Advanced RSA Cipher Tool
Generate RSA key pairs, encrypt and decrypt text and files, and sign and verify messages with standard PEM keys.
100% client-side · Built on your browser's Web Crypto API · Nothing is stored or uploaded
Your RSA key pair
Public key fingerprint (SHA-256): none yet
Keys live only in this page's memory. Download your private key if you need it later; closing or reloading the tab erases it.
Encrypt text
Uses the public key on the Keys tab, so you can encrypt to anyone whose public key you paste there.
Encrypt several messages
Decrypt text
Uses the private key on the Keys tab.
Decrypt several messages
Create a signature
Signs with the private key on the Keys tab (RSA-PSS, SHA-256). The exact text is signed, including every space and line break.
Verify a signature
Checks against the public key on the Keys tab, so paste the signer's public key there first.
Encrypt a file
Encrypts the whole file with AES-256-GCM and wraps the key with the public key on the Keys tab. Files up to 200 MB.
No file processed.
Decrypt a file
Uses the private key on the Keys tab. Choose a file that was encrypted with this tool.
No file processed.
Never share your private key. Anyone who has it can read your messages and forge your signatures.
How This RSA Tool Works
All cryptography is done by your browser's built-in Web Crypto API: RSA-OAEP with SHA-256 to protect keys, RSA-PSS with SHA-256 for signatures, and AES-256-GCM to encrypt the actual data. Because RSA can only handle small inputs, every message gets its own random AES key, which is wrapped with the recipient's public key (standard hybrid encryption), so text and files of any reasonable size work. Keys are standard PEM, so you can use them with OpenSSL and other software.
Standard Algorithms
RSA-OAEP, RSA-PSS and AES-GCM from the browser, not home-made maths
Text and Files
Hybrid encryption handles long messages and whole files safely
Standard PEM Keys
Import and export SPKI and PKCS#8 keys that work with OpenSSL
Encrypt to Anyone
Paste a recipient's public key and check its SHA-256 fingerprint
Nothing Stored
No history, no local storage and no network requests for your data
Honest Limits
1024-bit and smaller keys are refused; for high-stakes secrets use audited offline tools
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is RSA encryption?
RSA (Rivest-Shamir-Adleman) is a public-key cryptosystem. You create a key pair: the public key can be shared with anyone and is used to encrypt data or to verify signatures, and the private key must stay secret and is used to decrypt data or to create signatures. Its security rests on the difficulty of factoring the product of two very large primes.
2. What key size should I use?
2048 bits is the accepted minimum today (NIST rates it at roughly 112 bits of security), 3072 bits gives roughly 128 bits and is a good choice for long-lived keys, and 4096 bits is slower to generate with a smaller practical gain. Keys of 1024 bits or fewer are considered broken, so this tool does not offer them and refuses to encrypt or sign with them.
3. How does this tool encrypt long text and files?
RSA can only encrypt a few hundred bytes directly, so the tool uses standard hybrid encryption. It makes a fresh random AES-256-GCM key for every message, encrypts your data with it, and then wraps that AES key with your recipient's public key using RSA-OAEP with SHA-256. Everything is packed into one Base64 text (or one file), so the output is longer than the input. The format is specific to this tool: only this tool can decrypt it.
4. Is this tool safe for sensitive data?
The cryptography is done by your browser's built-in Web Crypto API (RSA-OAEP, RSA-PSS and AES-GCM), not by hand-written maths, and nothing leaves your device: the page's content security policy blocks outgoing network requests. Even so, a web page is a convenience, not a replacement for audited, offline software. For high-stakes secrets use established tools such as GnuPG or age, and always keep your private key somewhere safe.
5. How do I send an encrypted message to someone?
Ask them to generate a key pair and send you their public key (the text starting with -----BEGIN PUBLIC KEY-----). Paste it into the public key box on the Keys tab, encrypt your message on the Encrypt tab, and send them the result. Only their private key can decrypt it. Before trusting a public key, compare its fingerprint with the owner over a different channel, such as a phone call, so nobody can swap it on the way.
6. How do digital signatures work here?
Signing uses RSA-PSS with SHA-256. Your private key produces a signature over the exact message text; anyone with your public key can check that the message has not changed and that it was signed by the holder of the matching private key. A signature is only as trustworthy as your confidence that the public key really belongs to the signer. Ideally use separate key pairs for encrypting and for signing; generate a second pair if you need both.
7. Can I use these keys in other software?
Yes. Public keys are standard SPKI PEM (BEGIN PUBLIC KEY) and private keys are unencrypted PKCS#8 PEM (BEGIN PRIVATE KEY), which OpenSSL and most libraries read directly. Keys that start with BEGIN RSA PRIVATE KEY or BEGIN ENCRYPTED PRIVATE KEY must be converted first with OpenSSL. Only the ciphertext format is specific to this tool.
8. Does the tool store or send my keys?
No. Keys, messages and files exist only in this page's memory and disappear when you close or reload the tab, so download your private key if you need it again. Nothing is written to local storage, there is no history, and the only thing the site remembers is your language choice for the menu.
9. What if my browser does not support the Web Crypto API?
The tool shows a warning and disables its buttons rather than falling back to weaker, hand-written cryptography. The Web Crypto API needs a modern browser and a secure (HTTPS) page.