RSA calculator
Pick two primes p and q, a public exponent e and a message number m smaller than n. The calculator builds the key pair, finds d as the inverse of e modulo φ(n), encrypts m to c and decrypts c back, so you can follow or check textbook RSA by hand.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Enter two different primes p and q. Small ones like 61 and 53 keep the numbers readable.
- Enter the public exponent e. It must be between 1 and φ(n) and coprime with φ(n).
- Optionally enter a message m, a whole number below n. The calculator shows the private exponent d, the ciphertext c and the decrypted value, which should equal m.
How RSA works
- Keys. n = p × q and φ(n) = (p − 1)(q − 1). Choose e with gcd(e, φ(n)) = 1 and compute d = e⁻¹ mod φ(n). The public key is (e, n), the private key is (d, n).
- Encryption. c = mᵉ mod n.
- Decryption. m = cᵈ mod n. It works because e × d = 1 + kφ(n), and by Euler’s theorem m^φ(n) ≡ 1 (mod n).
Large powers are computed by repeated squaring, so even 64-bit primes finish instantly. p and q are checked with a deterministic Miller–Rabin test.
Worked example
p = 61, q = 53, e = 17, m = 65.
- n = 61 × 53 = 3233, a 12-bit modulus.
- φ(n) = 60 × 52 = 3120; λ(n) = lcm(60, 52) = 780.
- d = 17⁻¹ mod 3120 = 2753; the check line reads 17 × 2753 mod 3120 = 1.
- Public key (17, 3233), private key (2753, 3233).
- c = 65¹⁷ mod 3233 = 2790, and 2790²⁷⁵³ mod 3233 gives back 65.
Tips
- Pick e first, then check. 65537 is the usual choice in practice; with tiny primes it is often larger than φ(n), so use 3, 7 or 17 instead.
- Messages are numbers. Text must be turned into numbers first (for example, character codes), and each number must be below n.
- Find d by hand with the extended Euclidean algorithm; the extended Euclidean calculator shows every step of that inverse.
Frequently asked questions
How is the private key d calculated?
d is the modular inverse of e modulo φ(n): the number with e × d ≡ 1 (mod φ(n)). It is found with the extended Euclidean algorithm. For p = 61, q = 53 and e = 17, φ(n) = 3120 and d = 2753, because 17 × 2753 = 46,801 = 15 × 3120 + 1.
Why does e have to be coprime with φ(n)?
Only then does e have an inverse modulo φ(n). If e and φ(n) share a factor, no d exists and the message could not be decrypted uniquely. The calculator names the common factor when that happens.
What is the difference between φ(n) and λ(n)?
φ(n) = (p − 1)(q − 1) is Euler's totient; λ(n) = lcm(p − 1, q − 1) is Carmichael's function and divides φ(n). Either works for finding d; λ gives a smaller d (413 instead of 2753 in the example), and modern standards use it.
Is this safe for encrypting real data?
No. The numbers here are tiny and there is no padding, so anyone can factor n or spot repeated messages. Use it to learn and check homework; for real encryption use a vetted library with 2048-bit or larger keys.
Why must the message be smaller than n?
Encryption works modulo n, so m and m + n give the same ciphertext. A message of n or more could not be told apart from a smaller one after decryption.