⌘ K
rsa-oaep · sha-256 · pem · local

Encrypt or decrypt with RSA

RSA-OAEP encryption with SHA-256. Use a PEM public key to encrypt, a PEM private key to decrypt. Best for small payloads (e.g. an AES key). Runs entirely in your browser.

RSA Encrypt / Decrypt
Mode
encrypt
pub key
Algorithm
OAEP
SHA-256
Input
—
—
Status
—
web crypto
input · public key + plaintext
Public key (PEM)
Plaintext
output · ciphertext (base64)

Result will appear here…

Quick Start

How RSA-OAEP encryption works

RSA-OAEP encrypts a small payload (typically up to ~190 bytes for 2048-bit keys with SHA-256). For bulk data, encrypt an AES key with RSA and use AES for the actual content (hybrid encryption).

  1. 01

    Pick mode

    Encrypt with a public key, decrypt with a private key.

    Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.

    modeUTF-8TextEncoderlosslesslive
    mode · raw bytesencrypt · UTF-8
    pub key → ct
    loaded · UTF-8MIME · ready
  2. 02

    Paste PEM key

    SPKI for public, PKCS#8 for private — both standard OpenSSL formats.

    Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.

    keyWeb Cryptosubtledeterministiclive
    key · optionsPEM · live
    -----BEGIN PUBLIC KEY-----
    options applied · livelive
  3. 03

    Provide payload

    Plaintext (encrypt) or base64 ciphertext (decrypt).

    Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.

    inputmemoisedoptionsinstantreactive
    in · encoded≤ 190 B · ready
    Hello
    encoded · livelossless
  4. 04

    Run & copy

    Output is base64 ciphertext or UTF-8 plaintext.

    Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.

    exportclipboardblobMIME-correctclient-side
    ok · copiedready · done
    Copied
    shipped · ready to shipsuccess
Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Related toolsRSA KeysAES EncryptAES DecryptEd25519 KeysJWT EncoderSHA-256
Use Cases

When to use RSA-OAEP

Wrapping symmetric keys, signing nonces, legacy systems.

Wrap an AES key

Encrypt an AES session key with RSA — hybrid encryption. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Small secrets

Tokens, keys, short config values. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Legacy integrations

When the counterparty only speaks RSA. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

License key blobs

Encrypt entitlement tokens for offline validation. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

Bootstrapping channels

First-message handshake before a Diffie-Hellman swap. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Teaching tool

Show keypair-based asymmetric encryption. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready
FAQ

Frequently asked questions

RSA-OAEP is limited to (key size in bytes − 2 × hash size − 2). For 2048-bit / SHA-256 that's 190 bytes max. Use AES for bulk data.
Optimal Asymmetric Encryption Padding — randomized padding that prevents ciphertext analysis. The modern default for RSA encryption.
It's the standard label hash for RSA-OAEP. SHA-1 is also common but deprecated.
No — this tool is encrypt/decrypt only. For RSA signatures use a dedicated tool with RSA-PSS or RSASSA-PKCS1-v1_5.
No. RSA-OAEP runs via Web Crypto — entirely locally in your browser.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!