RSA Encrypt & Decrypt Tool
RSA Encrypt & Decrypt Tool: Imports RSA public key via SubtleCrypto, applies Optimal Asymmetric Encryption Padding (OAEP), and outputs ciphertext.
About this rsa encrypt & decrypt tool
Imports RSA public key via SubtleCrypto, applies Optimal Asymmetric Encryption Padding (OAEP), and outputs ciphertext Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Uses Web Crypto RSA-OAEP with SHA-256: encrypt mode imports a public JWK and returns Base64 ciphertext; decrypt mode imports a private JWK and returns plaintext. It does not manage keys or certificate trust.
Worked verification example
Scenario: Decrypt a fixed RSA-OAEP/SHA-256 test ciphertext with its supplied demonstration private JWK.
Sample input:
Processing: Imports the supplied private JWK, decrypts the Base64 ciphertext using RSA-OAEP/SHA-256, and returns UTF-8 plaintext. This public test key must not protect real secrets.
Illustrative output:
Security parameters & input constraints
The UTF-8 plaintext limit is RSA modulus bytes minus 66 for SHA-256 OAEP; larger input is rejected. The page does not create keys, transport ciphertext or secure the exposed private JWK. Invalid keys or ciphertext cause Web Crypto errors.
Cryptographic digests, encoded strings, and signatures generated by RSA Encrypt & Decrypt Tool should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in RSA Encrypt & Decrypt Tool execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
RSA Encrypt & Decrypt Tool verification · Audit standards
How to use it
- Generate an RSA-OAEP key pair first; enter JSON with operation encrypt, its publicJwk and plaintext.
- Run Web Crypto RSA-OAEP-SHA-256 locally and read Base64 ciphertext.
- For decrypt, supply operation decrypt, the matching privateJwk and ciphertext; read plaintext.
Frequently asked questions
Which operation and fields are accepted?+
`operation` defaults to `encrypt` only when missing or `null`; empty and unknown values are rejected. Encryption requires `publicJwk`; text is formed as `String(plaintext || text || "")`. Decryption requires `privateJwk` and `ciphertext`.
How do I encrypt and decrypt a message?+
Generate keys, submit `{ "operation": "encrypt", "publicJwk": { ... }, "plaintext": "abc" }`, then copy its `ciphertext` into `{ "operation": "decrypt", "privateJwk": { ... }, "ciphertext": "..." }`. The matching private key returns `abc`.
What limits RSA-OAEP plaintext?+
The tool measures UTF-8 bytes and limits plaintext to modulus bytes minus 66 for SHA-256 OAEP. It reports the calculated maximum when the text is too long.
Can I use the signing JWK to encrypt?+
No. Encryption imports an RSA-OAEP `publicJwk` or `privateJwk`. The separately generated RSASSA signing JWKs have different permitted operations.