RSA Encrypt & Decrypt
Encrypt, decrypt, sign and verify text with RSA PEM keys — OAEP or PKCS#1 v1.5, base64 output. Runs in your browser, so keys never leave your device.
Input
Public key (or X.509 certificate) to encrypt/verify; private key (PKCS#8 or PKCS#1) to decrypt/sign. Make a pair with the RSA Key Generator.
Signatures use RSASSA-PKCS1-v1_5.
Output
More ways to use this tool
REST API
curl -X POST https://api.iotools.cloud/v1/tool/rsa-encrypt-decrypt \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"operation": "decrypt",
"key": "-----BEGIN RSA PRIVATE KEY-----\r\nMIICXQIBAAKBgQD…",
"message": "u1JIhl3aynqWQWgdS6/BKeDtdR4bY/Z9vNNf4iosLHKePeml…",
"signature": "",
"scheme": "oaep-sha256",
"hash": "sha256"
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `rsa-encrypt-decrypt` tool (RSA Encrypt & Decrypt) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.
Embed widget
<iframe
src="https://iotools.cloud/embed/rsa-encrypt-decrypt/"
width="100%" height="520" frameborder="0" scrolling="no" loading="lazy"
title="RSA Encrypt & Decrypt — iotools.cloud"
sandbox="allow-scripts allow-forms allow-same-origin allow-downloads allow-popups allow-popups-to-escape-sandbox"
allow="clipboard-write"
style="width:100%;border:1px solid #e5e7eb;border-radius:12px;overflow:hidden"></iframe>
<script src="https://iotools.cloud/embed.js" async></script>Drop this into your own page — free, no key required, just a link back.
| Cost per API/MCP call | From 5 credits |
|---|---|
| Need more credits? | View pricing |
Also available with
Guides
Encrypt, decrypt, sign and verify text with RSA keys in PEM format, entirely in your browser. Your private key is never uploaded.
How to use
- Pick an operation. Encrypt and verify use the public key; decrypt and sign use the private key.
- Paste the PEM key (PKCS#8 or PKCS#1 private keys, SPKI public keys, or an X.509 certificate for the public side).
- Enter the message, or the base64 ciphertext when decrypting. For verify, also paste the base64 signature.
- Choose the padding (RSA-OAEP is recommended) or the signature hash, then copy the base64 result.
Need a key pair? Use the RSA Key Generator.
How long a message can I encrypt?
RSA encrypts only short messages. With a 2048-bit key and OAEP-SHA-256 the limit is 190 bytes. For larger data, encrypt a random symmetric key with RSA and the data with AES.
Why does decryption fail?
The padding must match the one used to encrypt, and the ciphertext must have been produced with the matching public key. RSA-OAEP output differs on every run, which is normal.
Which signature format is used?
RSASSA-PKCS1-v1_5 with the hash you choose, base64-encoded. It is deterministic, so signing the same message twice gives the same signature.