RSA-OAEP Encrypt & Decrypt

Use browser-local RSA-OAEP with SHA-256 and visible plaintext size limits for interoperable public-key encryption.

Public key (SPKI PEM)

Private key (PKCS#8 PEM)

Plaintext

Ciphertext (Base64)

ReadyRSA-OAEP · SHA-256. A 2048-bit key allows up to 190 plaintext bytes.

All cryptographic operations run locally in your browser. Keep private keys secret and use production key-management practices for real systems.

RSA-OAEP Tool: Payload Limit & Key Evidence

Encrypt locally with RSA-OAEP and audit key size, SHA-256 payload limit, plaintext bytes and ciphertext length.

Quick-win audit

Browser-local cryptographic utilities

preserves the established Web Crypto workflows while connecting token, key, KDF, encryption/signature, fingerprint and verification jobs. Inputs stay in your browser unless the page clearly states that a network request is required.

Protocol boundary

Correct primitive output does not certify a complete protocol, key-management system, parameter choice, endpoint, or production deployment. Match the source system exactly and use established application/security libraries for production authentication and storage.

Practical guide and verification

Use the tool first, then use these checks to interpret, verify and hand off the result without displacing the primary workflow.

Match the OAEP parameters at both ends

RSA-OAEP interoperability depends on the key, modulus size, hash function, mask-generation settings, and label convention. Do not assume that two systems using the name “OAEP” automatically agree. Record the exact protocol parameters and test with a non-sensitive known sample before integrating real application data.

Respect the RSA payload-size boundary

RSA is designed for small payloads, not whole files or long messages. The maximum OAEP plaintext depends on modulus size and hash length. If the data is larger, a common design is to encrypt data with an authenticated symmetric cipher and use RSA only for a small key or key-wrapping step defined by the protocol you are implementing.

Protect private keys outside the test page

A browser-local tool can help verify a key pair or test vector, but a production private key should follow the storage, access-control, rotation, and backup rules of the system that owns it. Avoid pasting long-lived production keys into ad-hoc workflows when a dedicated key-management path is available.

Verify ciphertext handling as bytes, not appearance

Ciphertext is binary data and is usually transported through Base64 or another encoding. Keep encoding separate from encryption, preserve exact bytes, and test a complete encrypt→decrypt round trip. A changed line break, truncated Base64 string, or mismatched text encoding can break the handoff even when the cryptographic operation itself is correct.