RSA Encryption Toy

Pick two primes, enter a message, and watch RSA encrypt then decrypt it.

Worked example — RSA Encryption Toy

Private key (n, d)	1783

These are the values the calculator shows when the page opens. Change any input above to recompute them.

Loading interactive simulation...

Lesson

The theory — RSA Encryption Toy

RSA is one operation used twice. Encrypting is m^e mod n and decrypting is c^d mod n — the same modular exponentiation, with a different exponent. The trick is choosing the pair so that doing it twice returns the message, while knowing one exponent tells you nothing about the other. Everything the panel prints is the search for that pair. Published by Rivest, Shamir and Adleman in 1978, and — as emerged only when GCHQ declassified it in 1997 — found by Clifford Cocks four years earlier and left in a drawer.

What each symbol means

n: the modulus, p·q. Public. Its factors are the secret, not the number itself.
φ(n): Euler’s totient, (p−1)(q−1). The panel can print it because it was handed p and q; an attacker holding only n cannot, and getting φ from n is as hard as factoring.
e: the public exponent. Any number coprime to φ(n) will do, which is why it changes when you change a prime.
d: the private exponent, e⁻¹ mod φ(n). One modular inverse — instant to compute if you know φ, and the whole game if you do not.

Where the formula comes from

Multiply the primes: n = p·q. At the defaults that is 61 · 53 = 3233. This number is published. Recovering 61 and 53 from 3233 takes a moment by hand, which is the honest reason this is called a toy.
Compute φ(n) = (p−1)(q−1) = 60 · 52 = 3120. This is the hinge of the whole scheme: n is public and φ(n) is not, and the only known route from one to the other runs through the factorisation.
Pick e coprime to φ(n), then solve e·d ≡ 1 (mod φ(n)) for d. The panel shows 7⁻¹ mod 3120 = 1783. Note what that step is not: it is not hard. Given φ it is a single modular inverse. The secrecy of d rests entirely on the secrecy of φ.
Why the round trip works: by construction e·d = 1 + kφ(n), so m^ed = m^1+kφ(n) ≡ m (mod n) — Euler’s theorem. Decryption is not an inverse operation invented separately; it is the same exponentiation, with the exponent that undoes the first one.

How to read what you see

The row worth watching is e, because it is not a constant. At the default primes it reads 7; change p to 67 and it becomes 5. The reason is in the row above it: e must be coprime to φ(n), and φ moved from 3120 to 3432. Then compare the two exponents on screen — e = 7 against d = 1783. The public one is tiny and the private one is not, and neither fact is a coincidence: e is chosen small on purpose so encryption is cheap, and d is whatever the inverse turns out to be. The last row is the proof that it worked: m′ = 42, the number you typed.

Assumes: That the message is a number smaller than n. With n = 3233 there is nothing to encrypt above 3232, which is why real RSA never encrypts a message directly — it encrypts a padded symmetric key of a few hundred bits and lets a faster cipher carry the actual text. It also assumes p ≠ q, and that you never reuse a prime in a second modulus: two moduli sharing a factor are both broken by a single greatest common divisor.
Breaks when: You can break this page without factoring anything. Set p = 67, q = 53 and the message to 3. The panel picks e = 5, and prints the ciphertext as 243 — which is just 3⁵. Because 3⁵ is smaller than n = 3551, the modular reduction never happened, so the ciphertext is an ordinary power and the fifth root of 243 is 3. No key, no factoring, message recovered. Try m = 5 and you get 3125, which is 5⁵; at m = 8 the power finally exceeds n and the ciphertext becomes an unhelpful 809. This is not a flaw in the page — it is the reason nobody encrypts a bare number. Real RSA pads the message with structured randomness first, which is what RFC 8017 specifies and what makes it a cryptosystem rather than an exponentiation.

The private key is derived, not chosen 🖖

Watch the panel build d. With the default primes it prints φ(n) = 60 · 52 = 3120, then falls back to e = 7 — its preferred 65537 is larger than φ itself here — and finally computes d ≡ 7⁻¹ mod 3120 = 1783. That last step is one modular inverse, instant on any machine. Nothing about d is secret in its own right: it drops straight out of φ(n), and φ(n) drops straight out of p and q. RSA therefore does not hide the private exponent, it hides the factorisation. Here n = 3233, which a laptop splits before you finish this sentence; an RSA-2048 modulus runs to 617 decimal digits, and every step on screen is otherwise the same.

The padlock only you can open 🖖

RSA gives everyone an open padlock (your public key) that they can snap shut around a message, but only your private key can reopen it. Because locking and unlocking use different keys, you can publish the public one for the whole world to see without giving away how to decrypt. This tool lets you run the full lock-and-unlock cycle with tiny primes; real systems use the same steps with numbers hundreds of digits long.

Encryption run backwards is a signature 🖖

The very same RSA operation, run in the opposite direction, proves who sent a message instead of hiding it. If you "decrypt" a message with your private key, anyone can "encrypt" it back with your public key to check it really came from you - that is a digital signature. So one piece of math powers both confidentiality and authentication, just by swapping which key goes first.

Problems solved in full

An RSA key pair for p = 61 and q = 53 5 steps
Generate the RSA key pair for p = 61 and q = 53, and encrypt m = 42. Every number below follows from those three, the public exponent included.
1. The modulus is published and the totient is destroyed, yet both are one multiplication away from the primes. φ(n) counts the integers below n sharing no factor with it, which for a product of two distinct primes is (p − 1)(q − 1).
  
  $n = 61 \cdot 53 = 3233, ϕ (n) = (61 - 1) (53 - 1) = 60 \cdot 52 = 3120$
2. The public exponent must be invertible modulo φ, which means coprime to it. Factor φ and the small candidates eliminate themselves, leaving 7 as the smallest odd exponent available. Real keys use 65537, but that is larger than this φ, so the tool falls back to the smallest coprime.
  
  $3120 = 2^{4} \cdot 3 \cdot 5 \cdot 13 ⟹ g cd (3, ϕ) = 3, g cd (5, ϕ) = 5, g cd (7, ϕ) = 1 ⟹ e = 7$
3. Inverting 7 modulo 3120 is the extended Euclidean algorithm and nothing more. Three divisions reach a remainder of 1, and unwinding those same three lines writes that 1 as a combination of 3120 and 7.
  
  $3120 = 445 \cdot 7 + 5, 7 = 1 \cdot 5 + 2, 5 = 2 \cdot 2 + 1 ⟹ 1 = 3 \cdot 3120 - 1337 \cdot 7$
4. The coefficient of 7 in that combination is negative, and a negative inverse is made positive by adding the modulus once. Encryption is then a single modular exponentiation, done by squaring twice rather than by multiplying 42 by itself seven times.
  
  $d \equiv - 1337 \equiv 1783 (mod 3120), c = 4 2^{4} \cdot 4 2^{2} \cdot 42 = 1550 \cdot 1764 \cdot 42 \equiv 240 (mod 3233)$
5. Decryption never has to be checked by brute force, and for realistic key sizes it could not be. The two exponents were built so that their product is one more than a multiple of φ, and Euler's theorem finishes it for any m coprime to n — which 42 is.
  
  $e d = 7 \cdot 1783 = 12481 = 4 \cdot 3120 + 1 ⟹ c^{d} \equiv m^{e d} = m (m^{ϕ})^{4} \equiv m = 42$
Answer

The tool prints n = 3233, φ = 3120, d = 1783 and c = 240, and confirms that 240 decrypts back to 42. The part worth keeping is what φ actually is. It is not a second secret standing beside p and q — it is the same secret written differently. Given n and φ you have p + q = n − φ + 1 = 114 and pq = 3233, a quadratic whose discriminant is a perfect square, and it hands back 61 and 53 in one line. So a key generator that leaks φ has leaked the factorisation just as completely as if it had printed the primes, which is why φ is computed once, used to find d, and then thrown away.

$p + q = n - ϕ + 1 = 114, pq = 3233 ⟹ x^{2} - 114 x + 3233 = 0 ⟹ x = 61, 53$
Factoring 3233 into 61 × 53 to defeat RSA security 6 steps
The panel factors 3233 into 61 × 53 before you have finished reading the page. That factorisation is the entire security of RSA, apparently defeated instantly. Work out what makes the identical problem impossible one key size up.
1. The two numbers the panel starts from: the modulus, and the totient that follows from the two primes.
  
  $n = 61 \times 53 = 3233, ϕ (n) = 60 \times 52 = 3120$
2. An attacker needs only one fact: the smaller prime cannot exceed the square root of the modulus. Anything larger would need a partner smaller than itself.
  
  $p \leq n ⟹ 3233 = 56.86, π (56) = 16$
3. So the search runs over primes up to 56, and there are sixteen of them. The sixteenth is 53. Sixteen divisions is not security, it is a rounding error.
  
  $53 < 56.86 \in {2, 3, 5, \dots, 53} ⟹ k \leq 16$
4. Now put in a modulus anyone actually uses. 2048 bits means n near 2²⁰⁴⁸, and the square root of that is 2¹⁰²⁴, about 10³⁰⁸.
  
  $n \approx 2^{2048} ⟹ n = 2^{1024} \approx 1 0^{308}$
5. Price it. At a billion trial divisions a second, that is 10²⁹⁹ seconds — against a universe roughly 4 × 10¹⁷ seconds old.
  
  $\frac{1 0 ^{308}}{1 0 ^{9} s ^{- 1}} = 1 0^{299} s \approx 1 0^{291} yr$
6. Time is the wrong unit for a number that size, so compare it to something physical instead.
  
  $1 0^{308} ⋙ 1 0^{80}$
Answer

Sixteen divisions against 10³⁰⁸ — and 10³⁰⁸ is 10²²⁸ times the number of atoms in the observable universe, so you could not even store the counter. The useful part is the shape rather than the size: the attacker's work grows like √n while the key grows like log n, so every two extra bits of key double the cost of breaking it and cost the defender two bits. That asymmetry is the whole product. The tool's instant answer is not a flaw in the demonstration — it is the demonstration, because 3233 is what a modulus looks like when the asymmetry has not been given room to work.

$16 ⟷ 1 0^{308}; O (n), n = 2^{2048}$

References (4)

The idea RSA is an instance of — public keys, two years earlier: W. Diffie & M. Hellman, "New directions in cryptography." IEEE Transactions on Information Theory 22(6), 644–654, 1976.
What real RSA wraps round the message, and why the bare exponentiation on this page is not a cryptosystem: K. Moriarty (Ed.), B. Kaliski, J. Jonsson & A. Rusch, "PKCS #1: RSA Cryptography Specifications Version 2.2." RFC 8017, November 2016 — RSAES-OAEP in §7.1.
The scheme the tool walks through, including e·d ≡ 1 mod φ(n): R. L. Rivest, A. Shamir and L. Adleman, "A method for obtaining digital signatures and public-key cryptosystems." Communications of the ACM 21(2), 120–126, 1978.
Why the security rests on factoring rather than on hiding d: A. J. Menezes, P. C. van Oorschot and S. A. Vanstone, Handbook of Applied Cryptography, §8.2. CRC Press, 1996. ISBN 978-0-8493-8523-0.

By the 42Math team · Updated 2026-08-17

Reviewed against published sources. Corrections welcome. Editorial policy · Corrections

All Computing lessons →

Example problems

p=61, q=53 - p=61, q=53: classic textbook RSA
Tiny primes - p=7, q=11: tiny primes, easy to trace
Larger primes - p=101, q=103: larger key space
Textbook - p=17, q=19: textbook exercise