How to use it
Work through the four tabs in order. Keys builds a key pair from two primes: type your own, press Random primes, or load the textbook example (p = 61, q = 53, e = 17). Encrypt & decrypt turns a number or a short text into ciphertext and back. Sign & verify uses the same maths the other way round, and Break & pitfalls factors small keys and shows why plain “textbook” RSA must never be used on its own. All arithmetic is exact whole-number arithmetic, so even 1024-bit primes give exact results.
This is a learning tool, not a way to protect real data: it adds no padding and keeps every key inside the page.
Controls
- Number fields accept digits only; spaces and commas are ignored. Results update while you type.
- Random primes picks two different primes of the chosen size and tests them (trial division for small sizes, Miller–Rabin for large ones) in small slices, so the page stays responsive. While it works, the same button reads Stop; Esc also stops any running search.
- 65537 if valid and Smallest valid e choose the public exponent for you.
- Show all digits prints long numbers in full instead of shortened. Copy buttons always copy the full value.
- Number / Text and Encrypt / Decrypt switch the mode. Switching the direction moves the result into the input, so you can follow a round trip.
- Decrypt with the CRT decrypts with the Chinese remainder theorem and shows its steps.
- Arrow keys move between the tabs.
How it works
RSA was first described publicly in 1977 by Ron Rivest, Adi Shamir and Leonard Adleman and is named after their initials. Choose two different primes p and q and multiply them: n = p·q. Euler’s totient φ(n) = (p − 1)(q − 1) counts the numbers from 1 to n that share no factor with n. Pick a public exponent e with gcd(e, φ(n)) = 1, and the extended Euclidean algorithm finds the private exponent d with e·d ≡ 1 (mod φ(n)). The public key is (n, e); d, p and q stay secret.
Why decryption works: e·d = 1 + k·φ(n), and Euler’s theorem says mφ(n) ≡ 1 (mod n) whenever m shares no factor with n, so cd = med = m·(mφ(n))k ≡ m. The Chinese remainder theorem extends this to every m from 0 to n − 1. The Carmichael function λ(n) = lcm(p − 1, q − 1) can replace φ(n); it usually gives a smaller d that works as well.
Powers are computed by square-and-multiply: read the exponent in binary, square at every bit after the first and also multiply by the base at every 1. A 2048-bit exponent needs only about 2048 squarings. To sign, the owner computes s = md mod n; anyone can check that se mod n = m with the public key.
Security rests on factoring: whoever finds p and q can compute φ(n) and then d. Trial division needs up to √n divisions, and Pollard’s rho roughly the fourth root of n steps when p and q have similar sizes, so both explode as keys grow. The general number field sieve, the fastest known method, does far better, yet the public record in October 2026 was RSA-896, an 896-bit challenge number factored in September 2026. That is why real keys have 2048 bits or more.
Things to try
- Load the textbook example and encrypt m = 65. You should get c = 2790, and decrypting gives 65 again. Then sign 65, change the message by one and watch the verification fail.
- Type e = 18 with p = 61 and q = 53 and read why no d exists.
- Generate 1024-bit primes and compare the CRT decryption time with the direct one.
- Encrypt a word in Text mode with the textbook key: each byte is its own block, so equal letters give equal blocks, which is just a substitution cipher.
- Run the timing table and watch trial division fall behind Pollard’s rho.
Frequently asked questions
Why is a large prime only “probably prime”?
Miller–Rabin can prove a number composite, but not prime. A composite passes one round with probability at most 1/4, so 16 or 24 random rounds leave a negligible chance of error. Below 3.3 × 1024 the page uses 13 fixed bases, which is a proven test, and below 232 it uses trial division.
Why must p and q differ?
With p = q, n = p² and its square root reveals p at once. The formula φ(n) = (p − 1)(q − 1) would also be wrong.
Why does text need blocks?
RSA works on numbers smaller than n. The page turns text into UTF-8 bytes and packs as many bytes into each block as always stay below n. With n = 3233 that is a single byte per block.
Why is 65537 so common?
It is prime and equals 216 + 1. Its binary form has only two 1s, so encrypting takes 16 squarings and one multiplication.
Sources
- Rivest RL, Shamir A, Adleman L (1978). A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM 21(2), 120–126. The method itself: keys from two primes, encryption, signatures and security that rests on factoring.
- Sorenson J, Webster J (2017). Strong pseudoprimes to twelve prime bases. Mathematics of Computation 86(304), 985–1003. The bound of about 3.3 × 1024 below which the first 13 primes as bases make Miller–Rabin a proof.
- Weis SA (2026). RSA-896. Online announcement with the two prime factors. The 896-bit factoring record of September 2026.