About this online tool
hidevtool RSA workbench runs in your browser: generate RSA key pairs, encrypt UTF-8 text with a public key, or decrypt Base64 ciphertext (PKCS#1 v1.5 or OAEP SHA-256). Keys and plaintext never leave your device.
Online RSA encrypt & decrypt capabilities
Three tabs
- Generate keys — choose 512–4096 bit, PKCS#1 or PKCS#8, and an optional private key password.
- Encrypt — paste a public key PEM and plaintext; ciphertext is Base64.
- Decrypt — paste private key PEM (encrypted keys need the password) and Base64 ciphertext.
Algorithm
Choose PKCS#1 v1.5 or RSA-OAEP (SHA-256) for encrypt and decrypt. Both sides must use the same padding and Base64 ciphertext.
PEM formats
- Public key: SPKI (BEGIN PUBLIC KEY) or PKCS#1 (BEGIN RSA PUBLIC KEY).
- Private key: PKCS#8 (BEGIN PRIVATE KEY), PKCS#1 (BEGIN RSA PRIVATE KEY), or encrypted PEM.
- Ciphertext: Base64 (no PEM wrapper).
Size limits
- RSA encrypts only small payloads (roughly tens to low hundreds of bytes depending on key size).
- For long files, encrypt a random AES key with RSA and encrypt data with AES (hybrid encryption).
Security tips
- 1Prefer 2048-bit keys minimum; 4096-bit for long-lived or high-value keys.
- 2Never share private keys in chat or email; treat generated keys as secrets.
- 3Optional password on generate exports an encrypted private key—do not lose the password.
- 4Use signatures (e.g. JWT tools on this site) when you need proof of origin, not RSA encrypt alone.
- 5Rotate keys on a schedule and after any suspected leak.
Common use cases
Dev & test keys
Quickly mint a key pair for local microservices or integration tests without openssl CLI.
Config & license blobs
Encrypt small license strings or tokens your app decrypts with an embedded public key.
Debugging OAEP
Reproduce RSA-OAEP encrypt/decrypt steps against another library or backend.
Frequently asked questions
- What key format is required?
- Public keys: SPKI or PKCS#1 RSA public PEM. Private keys: PKCS#8, PKCS#1, or password-protected encrypted PEM (PKCS#8 or legacy).
- Does this support RSA1 / RSA2 like payment docs?
- No. In payment and open-platform docs, RSA1/RSA2 usually mean API signing and verification (for example SHA-1 vs SHA-256 with RSASSA-PKCS1-v1_5), not encrypting arbitrary text with a public key. This page only does PKCS#1 v1.5 or OAEP encrypt/decrypt—it does not replace sign_type or notify signature workflows.
- Why did encryption fail?
- Plaintext may be too long for the key size, or the PEM block is malformed. Check key type (public vs private) matches the tab.
- Is data uploaded?
- No. Generation, encryption, and decryption run entirely in your browser.