Skip to main content
Tool Factory

Keys, Certificates & Tokens

RSA Encryption

Encrypt a short message with an RSA public key using RSA-OAEP, SHA-256 by default. Get Base64 or hex ciphertext, made in your browser.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

Run the tool when your input is ready.

Options

Use RSA-OAEP for new encryption. Other schemes support compatibility. RAW has no padding and is unsafe for new encryption.

Your result appears here

Encrypt a short message with an RSA public key using RSA-OAEP, SHA-256 by default. Get Base64 or hex ciphertext, made in your browser.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

RSA-OAEP uses the selected digest for both its hash and MGF1. The OAEP label stays empty.

The result contains ciphertext in the selected output format.

  • Encrypt a short secret, such as an API token, for a holder of an RSA public key.

Sources: RFC 8017: RSAES-OAEP encryption scheme

Set the public key and OAEP digest

  1. Paste a PUBLIC KEY or RSA PUBLIC KEY PEM block.
  2. Enter the message text.
  3. Choose the encryption scheme and digest required by the recipient, then select Encrypt.

Encrypt Hello with an RSA public key

Input: Hello

Settings: RSA Public Key (PEM) from a new 2048-bit test pair; Encryption Scheme RSA-OAEP; Message Digest Algorithm SHA-256; Ciphertext format Base64

Result: A 344-character Base64 ciphertext that decodes to 256 bytes. The exact text changes on each run.

OAEP padding is random, so two runs give different ciphertexts. Both decrypt to Hello with the matching private key.

Message size and padding compatibility

  • OAEP message capacity depends on key size and digest size. Use hybrid encryption for larger data.
  • RAW has no padding; PKCS#1 v1.5 and SHA-1 options serve legacy compatibility.
  • Encryption does not authenticate the sender.