Generate RSA keys from small primes, encrypt and decrypt with modular exponentiation, then factor n to see why key size matters. Interactive, in-browser.
This interactive RSA playground lets you generate a key pair from small primes, encrypt and decrypt numbers with modular exponentiation, and then break the key by factoring the modulus — so you can see, first-hand, why real RSA uses enormous primes. It shows every intermediate value: the primes p and q, the modulus n, the totient, the public and private exponents, and each step of encryption and decryption. Everything runs in your browser. The key sizes here are deliberately tiny for readability, which means they are for learning only and must never be used to protect real data.
RSA is the classic introduction to public-key cryptography because its security rests on one asymmetry you can watch happen: multiplying two primes is easy, but factoring their product back into those primes is hard. This tool makes that asymmetry concrete by letting you do both.
The playground follows the standard RSA construction, and shows each value as it is computed:
p and q. Presets range from 8-bit toys (p=11, q=13) up to 16-bit demonstrations, each labelled with how weak it is.n = p × q. This becomes part of both the public and private keys and is the number an attacker must factor.n that are coprime to it.e that is coprime to φ(n). Common choices are 3, 17 and 65537; the tool offers these and explains the trade-off.d, the modular inverse of e modulo φ(n) — the number such that e × d ≡ 1 (mod φ(n)), found with the extended Euclidean algorithm.The public key is the pair (n, e) and can be shared with anyone. The private key is (n, d) and must be kept secret. The whole scheme hinges on the fact that computing d requires φ(n), and computing φ(n) requires knowing p and q — which is why factoring n breaks everything.
To encrypt a message m (a number less than n), RSA computes the ciphertext c = me mod n. To decrypt, it computes m = cd mod n. Both are modular exponentiation: raise a number to a power, keeping only the remainder modulo n at each step. The playground uses fast square-and-multiply exponentiation and can show the process. A worked example with the classic p=61, q=53 key (n=3233): with e=17, the message m=65 encrypts to c=6517 mod 3233 = 2790, and with the matching d, 2790d mod 3233 returns 65. The magic — that raising to e and then to d gets you back the original — is guaranteed by Euler's theorem, because e and d were chosen as inverses modulo φ(n).
The break tab factors n by trial division and reports how many iterations and how long it took. On an 8-bit key it finishes instantly; step up to the 14- and 16-bit presets and you can watch the effort climb steeply. That growth is the entire security argument. Multiplying p and q takes microseconds no matter how large they are, but the best known factoring algorithms take time that grows super-polynomially in the size of n. Real RSA uses keys of 2048 or 4096 bits — primes hundreds of digits long — where factoring is believed to be infeasible for any classical computer within the lifetime of the data. The tiny keys here factor in milliseconds precisely so you can see, rather than take on faith, why size is everything.
To say it plainly: the keys this tool generates provide zero security. An 8-bit or 16-bit modulus is factored by this very page in a blink, and even the largest preset is trivially breakable. The playground exists to teach the mathematics — key generation, modular exponentiation, the role of the totient, and the factoring asymmetry — not to protect anything. For real cryptography, use a vetted library (such as your platform's standard crypto module or OpenSSL) with at least 2048-bit keys, proper padding (OAEP), and secure key storage. Never roll your own RSA for production, and never use short keys.
The public key (n, e) is shared and used to encrypt (or verify signatures). The private key (n, d) is secret and used to decrypt (or sign). They are mathematically linked through the totient of n.
65537 is a prime of the form 216+1, which makes encryption fast (few bits set) while avoiding the security weaknesses that very small exponents like 3 can introduce with poor padding. The tool lets you compare 3, 17 and 65537.
It is computing baseexponent mod n efficiently, reducing modulo n as you go so the numbers stay small. It is the core operation of both RSA encryption and decryption.
Because the private exponent d is derived from φ(n), and φ(n) can only be computed if you know the prime factors p and q of n. Factor n and you can reconstruct the private key.
No. The keys are far too small and are broken instantly. Use them to understand the maths, then use a real library with 2048-bit or larger keys for anything that matters.
2048 bits is the common minimum today, with 3072 or 4096 bits for longer-term protection. The primes involved are hundreds of digits long, which is what makes factoring infeasible.
In practice, no. RSA encrypts a small value — typically a symmetric key or a padded hash — and the bulk data is encrypted with a fast symmetric cipher. This playground demonstrates the core operation on small numbers.
RSA is not only for encryption. The same key pair supports digital signatures, and understanding this deepens the intuition the playground builds. To sign, you apply the private key to a hash of the message — effectively signature = hashd mod n — and anyone can verify it by applying the public key: hash = signaturee mod n. It is encryption run with the keys swapped. Because only the holder of d could have produced a value that decrypts correctly with e, a valid signature proves the message came from the key owner and was not altered. This is why the same factoring hardness that protects encrypted messages also protects signatures: forging one without the private key means solving the same infeasible problem. In practice the message is hashed first (with SHA-256, for example) and padded, which is where the hash generator connects to RSA.
Experimenting with small keys surfaces mistakes that are invisible at production scale. Pick a public exponent e that shares a factor with φ(n) and no valid d exists — the tool will show the modular inverse failing, which is exactly why e must be coprime to the totient. Try to “encrypt” a message value larger than n and it wraps around and cannot be recovered, demonstrating why the message must be smaller than the modulus and why real RSA encrypts a short key rather than bulk data. And factoring even a 16-bit modulus in a visible fraction of a second makes it viscerally clear that textbook RSA without adequate key size and padding is not security theatre you can skip. These are the same failure modes that, at 2048 bits and with proper padding, are engineered away — but seeing them in miniature is the fastest way to understand why those safeguards exist.
Continue with the public-key concepts explainer for the bigger picture of asymmetric cryptography, contrast RSA with the classical Caesar cipher to appreciate how far ciphers have come, and use the hash generator to explore the digests that RSA signatures are computed over.
RSA (Rivest-Shamir-Adleman) is the first widely adopted public key cryptosystem, published in 1977. It enables secure communication, digital signatures, and key exchange without requiring parties to share a secret key in advance. RSA's security is based on the computational difficulty of factoring the product of two large prime numbers — a problem that remains intractable for classical computers at sufficient key sizes.
RSA is used in TLS/SSL certificates, PGP email encryption, code signing, secure boot, and countless other security protocols. While newer elliptic curve algorithms offer equivalent security with smaller keys, RSA remains foundational to understanding public key cryptography and is still the most widely deployed asymmetric algorithm.
RSA key generation, encryption, and decryption follow these mathematical steps:
| Operation | Formula | Used For |
|---|---|---|
| Encrypt | c = m^e mod n | Confidentiality — encrypting data with the recipient's public key |
| Decrypt | m = c^d mod n | Decrypting data with your private key |
| Sign | s = hash(m)^d mod n | Digital signatures — proving authorship with your private key |
| Verify | hash(m) = s^e mod n | Verifying a signature with the signer's public key |
| RSA Key Size | Equivalent Symmetric Strength | Status |
|---|---|---|
| 1024-bit | ~80-bit | Deprecated — factorable with sufficient resources |
| 2048-bit | ~112-bit | Minimum acceptable — adequate through ~2030 |
| 3072-bit | ~128-bit | Recommended for new deployments |
| 4096-bit | ~152-bit | Long-term security, but slower operations |