RSA Calculator - Generate RSA Keys and Run a Round-Trip

An RSA calculator is a public-key cryptography workbench that takes two primes, a public exponent, and a plaintext integer, then returns the modulus, Euler's totient, private exponent, ciphertext, and recovered plaintext in a single pass. It follows the RSA algorithm Rivest, Shamir, and Adleman published in 1978, useful for cryptography homework, exam prep, and quick sanity checks on small keys.

• • Verify textbook RSA examples by hand: Enter p = 61, q = 53, e = 17, m = 65 to confirm ciphertext c = 2790 and recovered plaintext 65.
• • Work RSA homework and exam problems: Plug in any small prime pair and an exponent, then read off phi(n) and d. The page also rounds-trip the message to check your hand-written answer.
• • Demonstrate modular exponentiation interactively: Use the live inputs to show how c = m^e mod n grows with m and shrinks back to m under decryption, which is the core idea behind RSA.
• • Compare textbook exponent 17 with production default 65537: Swap the public exponent e and watch the private exponent d and the ciphertext change while the modulus and recovered plaintext stay the same.

The algorithm is the one Rivest, Shamir, and Adleman published in 1978, bounded to small primes so the page can show every step on a single screen.

Before you enter p and q, the Prime Number Checker confirms both inputs are prime, which is the first assumption RSA relies on before it can compute phi(n) = (p-1)(q-1).

The calculator runs the textbook RSA flow: build the modulus, derive Euler's totient, compute the private exponent as the modular inverse of the public exponent, encrypt with modular exponentiation, and decrypt the same way to confirm the round-trip.

• p, q (primes): Two distinct prime numbers that multiply to give the modulus n. The widely cited textbook presentation picks p = 61 and q = 53 for its worked example.
• n = p * q (modulus): The public modulus published with the key. Factoring n back into p and q is the hard problem that keeps RSA secure.
• phi(n) = (p-1)(q-1) (Euler totient): Counts integers from 1 to n-1 coprime to n, and for two distinct primes simplifies to (p-1)(q-1).
• e (public exponent): Published with the key. The production default is 65537 = 2^16 + 1; textbook values are 3, 5, 7, 17.
• d (private exponent): The modular inverse of e modulo phi(n), satisfying e * d = 1 (mod phi(n)). It is the secret half of the key pair.
• m, c (message, ciphertext): Plaintext integer m in 0 to n-1; ciphertext c = m^e mod n. Decryption returns m = c^d mod n.

Encryption and decryption both use modular exponentiation, which keeps the running cost down even for the large exponents that production RSA uses.

The recovered plaintext at the bottom of the panel should always match the input m, which is the round-trip check that proves the key pair is consistent.

According to Rivest, Shamir, Adleman (1978), A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, RSA encrypts a message m by computing c = m^e mod n and decrypts by computing m = c^d mod n, where the modulus n is the product of two large primes p and q.

Because every step is a modular reduction, the Modulo Calculator (in modular-exponentiation mode) lets you verify 65^17 mod 3233 = 2790 by hand without dealing with the full 28-digit intermediate value.

Four ideas show up every time RSA is taught. Knowing what each one represents turns the formulas into a checklist you can apply to any small key.

These four concepts cover the public side, the secret side, the link between them, and the arithmetic that ties the message and ciphertext together.

A good warm-up before you trust the RSA round trip is to pick a small prime pair, double-check p * q and (p - 1)(q - 1) by hand, and watch the mod n reduction above; every step has to be exact for the recovered plaintext to match.

Five quick steps turn two primes and a plaintext integer into a complete RSA key pair and a verified round-trip. The calculator is for teaching and small demonstration keys; production RSA uses 2048 to 4096-bit primes the page does not handle.

1. 1 Pick two distinct primes p and q: Choose any two primes under 100000, ideally under 1000 for a fast on-screen example. The defaults (p = 61, q = 53) reproduce the canonical textbook example.
2. 2 Choose a public exponent e coprime to phi(n): Set e to a small prime such as 3, 5, 7, or 17 for a classroom example, or 65537 to match production defaults. gcd(e, phi) must equal 1.
3. 3 Enter the plaintext integer m: Pick any integer in 0 to n-1. The default m = 65 mirrors the canonical textbook example; m = 0 and m = 1 are useful for verifying the round trip.
4. 4 Read the modulus, totient, and private exponent: The first three result rows show n, phi(n), and d. Treat d as the secret half of the key pair and never share it in production.
5. 5 Verify the round trip: The bottom row prints the recovered plaintext. It should match the input m. If not, double-check that p and q are both prime and that e is coprime to phi(n).

Try the canonical textbook example: enter p = 61, q = 53, e = 17, and m = 65. The page shows n = 3233, phi(n) = 3120, d = 2753, ciphertext c = 2790, and recovered plaintext 65.

When you teach RSA, the Exponential Notation Calculator helps you show how 65^17 first grows to a 28-digit integer and then collapses to 2790 once the mod n reduction is applied.

A calculator-based RSA pass turns a five-step algorithm into a single read, which is exactly what cryptography instructors and self-learners need when they want to focus on the math.

• • All five outputs on one screen: The page shows n, phi(n), d, ciphertext, and recovered plaintext together, so the entire key pair and round trip appear without flipping between notes.
• • Verifies the round trip automatically: Decrypting the ciphertext and printing the recovered plaintext next to the input m is the fastest way to confirm the key pair is internally consistent.
• • Uses BigInt-safe modular exponentiation: Modular exponentiation uses BigInt internally, which keeps the integer math exact even for large exponents.
• • Honors textbook and production defaults: Small exponents like 17 reproduce the canonical textbook example, and the form accepts 65537 so you can switch to the production default without changing inputs.

The RSA formulas are fixed, but five real-world inputs change the numbers you see. Knowing them up front keeps the demo outputs predictable.

• • The calculator is for teaching RSA on small keys. Production RSA uses 2048 or 4096-bit primes, far beyond what a browser page can display or even store as BigInt without performance cost.
• • Real RSA also pads the message with OAEP or PKCS #1 v1.5 before encryption, which this calculator does not. A textbook RSA implementation on a real plaintext is vulnerable to well-known attacks.
• • The p and q inputs must be prime for the formulas to hold. The calculator does not enforce primality, so enter a known prime pair (or run both values through a prime checker first) when you need a valid key.

Treat the page as a teaching and verification tool. For real cryptographic work, use a vetted library such as OpenSSL, libsodium, or the Web Crypto API.

According to IETF RFC 8017 - PKCS #1 v2.2 RSA Cryptography Standard, the recommended RSA public exponent is e = 65537 = 2^16 + 1, and 2048 bits is the current minimum RSA key size.

When you teach RSA, the Chinese Remainder Theorem Calculator shows how the same congruence and coprimality ideas power RSA-CRT, the private-key optimization that splits a decryption into two faster residues mod p and mod q.