Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Security

RSA Encrypt / Decrypt

· Last updated：2026-06-24

Encrypt text with an RSA public key or decrypt ciphertext with the matching private key, using OAEP padding (SHA-1 or SHA-256). Handles long messages by chunking. Keys and data stay local. PKCS#1 v1.5 is intentionally not offered (Node disables it for decryption due to Bleichenbacher attacks).

Details

What this tool helps you do

A practical RSA OAEP encryption/decryption tool.

  • Mode: encrypt (public key → ciphertext) or decrypt (private key → plaintext).
  • Padding: OAEP (Optimal Asymmetric Encryption Padding) with SHA-1 or SHA-256 hash. OAEP is the modern, semantically-secure scheme recommended for new RSA encryption. PKCS#1 v1.5 is intentionally omitted — it is vulnerable to Bleichenbacher padding-oracle attacks and Node.js refuses to decrypt with it.
  • Chunking: RSA can only encrypt a small block at once (key bytes − 2×hash size − 2). Messages longer than that are split into blocks, each encrypted separately, and the ciphertexts concatenated. Decryption splits on the modulus boundary and reverses it.
  • Encoding: ciphertext is hex or base64.

Why OAEP max block = k − 2hLen − 2: OAEP adds a hash-length seed and label hash plus 2 delimiter bytes, so the usable payload per block shrinks accordingly.

Use cases: end-to-end message encryption demos, encrypting a small payload to someone's public key, learning RSA in practice. Everything runs locally.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team
Text311
Encryption40
Keys17
Public Key7
Private Key6
RSA5

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Security
Input types
select, textarea, text
Output type
html
Sample coverage
4
API ready
Yes

Overview

Securely encrypt plaintext using an RSA public key or decrypt ciphertext using a matching private key directly in your browser. This tool utilizes secure OAEP padding with SHA-1 or SHA-256 and automatically handles longer messages by chunking them into block-sized payloads, keeping all cryptographic operations entirely local.

When to use

  • When you need to encrypt a sensitive configuration value or API key using a recipient's RSA public key before sharing it.
  • When you need to decrypt a ciphertext payload locally using your passphrase-protected or unencrypted RSA private key.
  • When testing asymmetric encryption workflows or verifying RSA key pairs using secure OAEP padding configurations.

How it works

  1. 1Select the operation mode (encrypt with public key or decrypt with private key) and paste your PEM-formatted RSA key.
  2. 2Choose the OAEP hash algorithm (SHA-256 or SHA-1) and the preferred ciphertext encoding format (Hex or Base64).
  3. 3Input your plaintext message or ciphertext; the tool automatically chunks data exceeding the RSA block limit and processes it locally.

Use cases

  • Encrypting database credentials with a production public key before committing them to a repository.
  • Decrypting automated alert payloads sent by external systems that encrypt data using your public key.
  • Verifying that a generated RSA public/private key pair functions correctly with OAEP padding.

Examples

1. Encrypting a Secret Token with a Public Key

DevOps Engineer

Background

A DevOps engineer needs to send a database password to a remote server administrator securely.

Problem

The password must be encrypted using the administrator's public key so only they can read it.

How to use

Set the mode to 'Encrypt with public key', paste the administrator's PEM public key, enter the password in the message field, select OAEP SHA-256, and choose Base64 encoding.

Outcome

The tool generates a Base64-encoded ciphertext block that can be safely shared over insecure channels.

2. Decrypting a Configuration Payload

Backend Developer

Background

A developer receives an encrypted API credential block from a client system.

Problem

The credential block is encrypted with the developer's public key, and they need to retrieve the plaintext using their private key.

How to use

Set the mode to 'Decrypt with private key', paste the PEM private key (and passphrase if encrypted), paste the Hex-encoded ciphertext, and select the matching OAEP SHA-256 hash.

Outcome

FAQ

Why is PKCS#1 v1.5 padding not supported?

PKCS#1 v1.5 is vulnerable to Bleichenbacher padding-oracle attacks and is disabled for decryption in modern runtimes like Node.js.

How does the tool handle messages that exceed the RSA block size limit?

It automatically splits the message into smaller chunks, encrypts or decrypts each block separately, and concatenates the results.

Are my private keys or messages uploaded to a server?

No. All encryption and decryption operations are performed locally in your browser, ensuring your keys and data never leave your device.

What is the maximum payload size for a single RSA block?

The maximum size is determined by the key size in bytes minus two times the hash length minus two (k - 2hLen - 2).

Can I decrypt a private key that is protected by a passphrase?

Yes, you can provide the passphrase in the designated input field to decrypt passphrase-protected PEM private keys.

Home
Tools3206
Samples593
Visualizations468
Viewers103
Hubs236
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance645

Calculators, numerics, date logic, statistics, and finance tools

Design & Color298

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

Article to X and LinkedIn Drafts: Fact Review and Handoff
Markdown Interactive Deck Review and Offline Handoff
Small-Room Furniture Layout Review and Move-In Handoff
FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Media

Copyright-Free MP3 Audio Samples

Collection of royalty-free audio samples for testing and development purposes including nature sounds, meditation music, and ambient audio

Python

Web Image Processing Python Samples

Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

Java

Android Image Processing Java Samples

Android Java image processing examples including reading/saving images, scaling, and format conversion

Kotlin

Android Image Processing Kotlin Samples

Android Kotlin image processing examples including reading/saving images, scaling, and format conversion

Cryptography

Hash Algorithm Comparator

Hash the same input with MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE3 at the same time and compare them side by side: output length, hex/Base64 digest, security status (broken / modern), and a relative speed benchmark. Great for teaching, choosing a hashing algorithm, or sanity-checking checksums.

Format Conversion

Web Push RFC 8030 Request + VAPID + RFC 8291 Payload Encryption Encoder

Encode a complete Web Push send: RFC 8291 aes128gcm payload encryption, RFC 8292 VAPID ES256 JWT, RFC 8030 headers, APNs/FCM cross-walk and decrypt round-trip verification.

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Security

Excel Field-Level Decryptor

Decrypt specific fields in Excel files using various decryption methods to restore encrypted information

The tool decrypts the ciphertext and displays the original API credential plaintext.