RSA Calculator

Q: What values of e can be used in RSA encryption?

Common values for the public exponent e in RSA include 3, 5, 17, 257, and 65537. The most widely used value is 65537 (2^16 + 1) because it offers a good balance of encryption speed and security. Smaller exponents like 3 make encryption faster but can be vulnerable to certain attacks if proper padding is not used. The exponent must always be coprime with lambda(N) for the private key d to exist.

Q: Why must the message be smaller than the RSA modulus N?

The RSA encryption and decryption operations use modular arithmetic modulo N. If the message M is greater than or equal to N, the modular reduction C = M^e mod N loses information because multiple plaintexts can produce the same ciphertext. In practice, messages are split into blocks smaller than N, or hybrid encryption is used where RSA encrypts a symmetric session key rather than the full message.

Q: What is the Carmichael function lambda(N) in RSA?

The Carmichael function lambda(N) for RSA is computed as lcm(p-1, q-1), where p and q are the two prime factors of N. It determines the order of the multiplicative group modulo N and is used to compute the private key d. For any integer a coprime to N, a^lambda(N) ≡ 1 mod N. Using lambda(N) instead of Euler's totient φ(N) gives the smallest possible decryption exponent d while maintaining correctness.

Q: Is RSA still secure in 2025 and 2026?

RSA remains secure when implemented with sufficiently large key sizes (2048 bits or higher). However, its security is threatened by advances in quantum computing. Shor's algorithm can factor large numbers in polynomial time, which would break RSA entirely. NIST is standardizing post-quantum cryptography algorithms as replacements. For most current applications, RSA-2048 and RSA-4096 remain computationally infeasible to break with classical computers.

Q: What is the difference between RSA and symmetric encryption?

RSA is an asymmetric (public-key) encryption algorithm that uses two separate keys: a public key for encryption and a private key for decryption. Symmetric encryption like AES uses a single shared key for both encryption and decryption. RSA is much slower than symmetric encryption and is typically used to exchange symmetric keys or sign digital documents, while the actual data encryption is done with AES or ChaCha20.

Q: How do you compute the modular inverse d in RSA?

The private exponent d is computed as the modular multiplicative inverse of e modulo lambda(N), meaning e x d ≡ 1 mod lambda(N). This is calculated using the Extended Euclidean Algorithm, which finds integers x and y such that e x x + lambda(N) x y = gcd(e, lambda(N)). Since e and lambda(N) are coprime, gcd = 1, and x (taken modulo lambda(N)) gives d. Our calculator performs this computation automatically when you enter p, q, and select e.

Generate RSA public and private keys, encrypt and decrypt messages with this free calculator. Learn the RSA algorithm step-by-step with cryptography examples.

Calculate RSA

Prime (p):

Prime (q):

Encryption Exponent (e):

Message to Encrypt (M):

Ciphertext to Decrypt (C):

About This Calculator

The RSA Calculator is a free educational tool for understanding the RSA public-key cryptosystem, one of the most widely used encryption algorithms in modern cryptography. Named after its inventors Rivest, Shamir, and Adleman (1977), RSA enables secure data transmission through asymmetric encryption where a public key encrypts messages and a private key decrypts them. This calculator is ideal for students learning cryptography, computer science educators demonstrating public-key infrastructure, and developers testing RSA parameter generation.

The RSA algorithm operates on the mathematical difficulty of factoring the product of two large prime numbers. Given two distinct primes p and q, the calculator computes the modulus N = p x q and the Carmichael function lambda(N) = lcm(p-1, q-1). You select a public exponent e that is coprime with lambda(N) -- common choices include 3, 17, 257, and 65537. The calculator then derives the private key d as the modular multiplicative inverse of e modulo lambda(N) using the Extended Euclidean Algorithm. For encryption, the plaintext message M (as a number less than N) is transformed into ciphertext C = M^e mod N. Decryption recovers the original message M = C^d mod N.

How to use: Enter two prime numbers p and q, select an encryption exponent e from the dropdown, optionally enter a numeric message to encrypt, and optionally enter a ciphertext to decrypt. The calculator displays the modulus N, Carmichael function lambda(N), public key (e, N), private key (d, N), encrypted message, and decrypted message, along with step-by-step breakdowns of each computation.

Note on key sizes: For demonstration purposes, this calculator uses small prime numbers where the arithmetic stays within JavaScript safe integer range. Production RSA implementations use primes of at least 1024 bits (roughly 308 decimal digits) to achieve security. Try the example with p = 89, q = 67, e = 17, and message M = 1415 to see the algorithm in action.

Frequently Asked Questions

What is the RSA algorithm and how does it work?

The RSA algorithm is a public-key cryptosystem developed by Rivest, Shamir, and Adleman in 1977. It uses two large prime numbers p and q to generate a public key (e, N) for encryption and a private key (d, N) for decryption. The security of RSA relies on the practical difficulty of factoring the product of two large prime numbers. Encryption computes C = M^e mod N, and decryption recovers M = C^d mod N.

How are RSA public and private keys generated?

RSA key generation begins by selecting two distinct prime numbers p and q. The modulus N is computed as p x q. The Carmichael function lambda(N) is calculated as lcm(p-1, q-1). An encryption exponent e is chosen such that 1 < e < lambda(N) and gcd(e, lambda(N)) = 1. The decryption exponent d is then computed as the modular multiplicative inverse of e modulo lambda(N), satisfying e x d ≡ 1 mod lambda(N). The public key is (e, N) and the private key is (d, N).

What values of e can be used in RSA encryption?

Common values for the public exponent e in RSA include 3, 5, 17, 257, and 65537. The most widely used value is 65537 (2^16 + 1) because it offers a good balance of encryption speed and security. Smaller exponents like 3 make encryption faster but can be vulnerable to certain attacks if proper padding is not used. The exponent must always be coprime with lambda(N) for the private key d to exist.

Why must the message be smaller than the RSA modulus N?

The RSA encryption and decryption operations use modular arithmetic modulo N. If the message M is greater than or equal to N, the modular reduction C = M^e mod N loses information because multiple plaintexts can produce the same ciphertext. In practice, messages are split into blocks smaller than N, or hybrid encryption is used where RSA encrypts a symmetric session key rather than the full message.

What is the Carmichael function lambda(N) in RSA?

The Carmichael function lambda(N) for RSA is computed as lcm(p-1, q-1), where p and q are the two prime factors of N. It determines the order of the multiplicative group modulo N and is used to compute the private key d. For any integer a coprime to N, a^lambda(N) ≡ 1 mod N. Using lambda(N) instead of Euler's totient φ(N) gives the smallest possible decryption exponent d while maintaining correctness.

Is RSA still secure in 2025 and 2026?

RSA remains secure when implemented with sufficiently large key sizes (2048 bits or higher). However, its security is threatened by advances in quantum computing. Shor's algorithm can factor large numbers in polynomial time, which would break RSA entirely. NIST is standardizing post-quantum cryptography algorithms as replacements. For most current applications, RSA-2048 and RSA-4096 remain computationally infeasible to break with classical computers.

What is the difference between RSA and symmetric encryption?

RSA is an asymmetric (public-key) encryption algorithm that uses two separate keys: a public key for encryption and a private key for decryption. Symmetric encryption like AES uses a single shared key for both encryption and decryption. RSA is much slower than symmetric encryption and is typically used to exchange symmetric keys or sign digital documents, while the actual data encryption is done with AES or ChaCha20.

How do you compute the modular inverse d in RSA?

The private exponent d is computed as the modular multiplicative inverse of e modulo lambda(N), meaning e x d ≡ 1 mod lambda(N). This is calculated using the Extended Euclidean Algorithm, which finds integers x and y such that e x x + lambda(N) x y = gcd(e, lambda(N)). Since e and lambda(N) are coprime, gcd = 1, and x (taken modulo lambda(N)) gives d. Our calculator performs this computation automatically when you enter p, q, and select e.