RSA Key Calculator — a teaching walkthrough, not a key generator

The RSA key calculator above runs every stage of RSA key generation on two small primes you choose, then encrypts a number with the public key and decrypts it again with the private key so you can see the round trip close. It reports the modulus, both candidate moduli for the private exponent, the private exponent itself, and the ciphertext, and it explains in writing what has gone wrong whenever the inputs cannot produce a valid key.

Arb Digital publishes this as an education page. RSA is usually taught as a sequence of formulas that arrive without motivation, and the arithmetic with realistic numbers is far too large to follow. Small primes make every step visible. What they cannot do is provide security, and that boundary is the most important thing on this page: this tool must never be used to generate a real key. It exists so the algorithm makes sense, nothing more.

What This RSA Key Calculator Does

It performs five operations. It multiplies the two primes to form the modulus n. It computes Euler's totient of n and the Carmichael function of n, both of which describe the size of the group the exponents live in. It checks that the public exponent e is usable, meaning it shares no factor with whichever function you chose. It inverts e in that modulus to obtain the private exponent d. Then it computes the ciphertext of your message and decrypts that ciphertext back, showing the recovered value.

Every intermediate step is printed in the working panel, including the actual modular exponentiation, so the page can be used to check homework rather than merely produce an answer. Where an input is invalid — a composite in a prime field, two equal primes, a public exponent sharing a factor with the totient, or a message that is not smaller than the modulus — the tool says which condition failed and why it matters, instead of returning a meaningless number.

If you want to test a candidate prime on its own, our prime number checker and prime factorization calculator do that job directly, and the modulo calculator handles single remainder operations.

How to Use It

1. Enter two different primes for p and q. Keep them small enough that you can verify the arithmetic yourself.
2. Choose a public exponent e that shares no common factor with the totient. If it does, the tool will tell you and name the shared factor.
3. Enter a message as a plain number smaller than the modulus n.
4. Pick the totient or the Carmichael function to derive d. Both give a working key; the Carmichael version gives the smaller exponent.
5. Read the working panel. It shows the encryption, the decryption, and confirmation that the recovered number matches what you put in.

The Formula and How It Is Calculated

Start with two distinct primes. Their product n = p × q is the modulus, and it is public. Euler's totient of n counts how many numbers below n share no factor with it, and for a product of two distinct primes that is simply φ(n) = (p − 1)(q − 1). With p = 61 and q = 53 the modulus is 3,233 and the totient is 60 × 52 = 3,120.

Choose a public exponent e that is coprime to the totient. Seventeen works here, because 3,120 factors as 2⁴ × 3 × 5 × 13 and contains no 17. The private exponent d is then the modular inverse of e: the number that satisfies e × d ≡ 1 (mod φ(n)). For e = 17 and φ = 3,120 that number is 2,753, and you can verify it by hand: 17 × 2,753 = 46,801, which is 15 × 3,120 + 1.

Encryption raises the message to the public exponent modulo n, c = m^e mod n. With m = 65 that gives 65¹⁷ mod 3,233 = 2,790. Decryption raises the ciphertext to the private exponent, m = c^d mod n, and 2,790²⁷⁵³ mod 3,233 returns 65. The round trip works because raising to e and then to d means raising to e × d, which is one more than a multiple of the group order, and Euler's theorem says that leaves the original value untouched.

The Carmichael function λ(n) is the least common multiple of p − 1 and q − 1 rather than their product. For 61 and 53 that is lcm(60, 52) = 780, and inverting 17 modulo 780 gives 413. That is a smaller private exponent than 2,753 and it decrypts exactly the same ciphertexts, because 780 divides 3,120. Modern specifications define d against λ for precisely that reason.

Why This Must Never Generate a Real Key

Two independent reasons, either of which is fatal on its own.

The first is size. RSA's security rests entirely on factoring the modulus being infeasible. A modulus of 3,233 factors in microseconds by trial division; so does one of a hundred digits, given a laptop and a modern algorithm. NIST's Recommendation for Key Management: Part 1 – General sets out the key sizes considered adequate and the periods over which that assessment holds. Nothing this page can produce comes remotely near them.

The second is randomness, and it is the reason that simply typing bigger primes here would still be unsafe. Real key generation requires primes drawn unpredictably from an enormous space by a cryptographically secure random number generator, of the kind specified in NIST's Recommendation for Random Number Generation Using Deterministic Random Bit Generators. Primes a human chooses, or that come from an ordinary pseudorandom function, are drawn from a tiny predictable set. There is a documented history of deployed keys being recovered because their primes were generated with insufficient entropy, and the mathematics is untouched by that failure — it simply does not matter how good the algorithm is if the inputs were guessable.

There is a third reason this page cannot produce a usable system even in principle: textbook RSA, which is what is implemented here, is not what anybody deploys. It is deterministic, so the same message always yields the same ciphertext, and it is multiplicative, so an attacker can transform ciphertexts in predictable ways. Real use wraps the operation in a padding scheme that adds randomness and structure. Encrypting without one is broken regardless of key size. Generate real keys with a maintained library, and use this page to understand what that library is doing.

Where the Difficulty Actually Lives

Every operation in RSA is easy except one. Multiplying two primes is easy. Raising a number to a power modulo n is easy, because repeated squaring turns thousands of multiplications into a few dozen. Finding a modular inverse is easy, because the extended Euclidean algorithm runs in a handful of steps. Testing whether a number is prime is easy, because probabilistic tests settle it quickly without factoring anything.

The hard operation is recovering p and q from n. Everything rests on that asymmetry. If you can factor n, you can compute the totient, invert e yourself and read every message, which is why the private key is not really d — it is the pair of primes, and d is merely derived from them. This is also why the private exponent must never be published even in part, and why implementations store p and q alongside d to speed decryption using the Chinese remainder theorem.

Note what this asymmetry does not say. It does not say factoring is proven hard; there is no such proof. It says no efficient classical algorithm is publicly known, which is a statement about the current state of knowledge rather than about mathematics. That distinction is why key sizes are revised upward over time and why post-quantum alternatives are being standardised: a sufficiently large quantum computer running Shor's algorithm would factor efficiently and RSA would end, without any flaw in the arithmetic on this page.

Reading the Failure Messages

Most of what makes RSA confusing to learn is the set of conditions that have to hold at once, so the tool names each one when it breaks. If p or q is composite, the totient formula is simply wrong — (p − 1)(q − 1) only counts the coprime residues when both factors are prime, so d will not invert e and decryption will fail silently. If p equals q, the modulus is a perfect square and factoring it is a square root away.

If e shares a factor with the totient, no inverse exists at all: there is no d such that e × d leaves remainder one, so the key cannot be completed. The tool reports the greatest common divisor so you can see which factor is the problem. And if the message is not smaller than n, the modular reduction wraps it around and decryption returns a different, smaller number — the round trip fails not because the maths is wrong but because information was discarded before the maths began. Our LCM and GCF calculator is useful for checking coprimality by hand, and the number base converter helps when converting a message to and from an integer.

Common Mistakes to Avoid

• Treating a small-prime key as usable — a modulus of this size factors instantly, and no amount of correct arithmetic makes it secure.
• Choosing primes yourself — even large primes are unsafe unless drawn unpredictably by a cryptographic random number generator.
• Picking an e that shares a factor with the totient — no modular inverse exists, so the key cannot be completed at all.
• Encrypting a message larger than the modulus — the reduction discards information and the decrypted value will not match.
• Using textbook RSA without padding — deterministic, unpadded encryption is broken independently of key size.

Related Free Tools From Arb Digital

Test candidate primes with the prime number checker, break a number apart with the prime factorization calculator, take remainders with the modulo calculator, check coprimality with the LCM and GCF calculator, or study a classical cipher with the Caesar cipher translator and the Vigenère cipher translator. The full free online tools hub lists every developer tool we publish.

Frequently Asked Questions

This page is an educational walkthrough of a published algorithm. It is not a key generator and must not be used to protect anything. Generate production keys with a maintained cryptographic library.