Pick two prime numbers and watch every value in RSA get made. Change any number and the whole page recalculates, so you can see what each step depends on.
This is done once, by the person who wants to receive secret messages.
Primes are used because they let the owner calculate φ(n) instantly in step 3. Real RSA uses primes about 300 digits long. Here we keep them small so you can follow the math. Type any number: if it is not prime, you'll get the nearest primes to pick from.
n is public. Everyone can see it, but nobody can easily split it back into p and q when the primes are large. That is the whole secret of RSA.
φ(n) is private. The owner can calculate it because they know p and q. An attacker only sees n, so they can't.
Rule: e must be between 1 and φ(n), and share no common factor with φ(n) (their gcd must be 1). Otherwise step 5 is impossible. Tap a valid choice or type your own.
d is the number that "undoes" e. It must satisfy (e × d) mod φ(n) = 1. We find it with the Extended Euclidean Algorithm.
Divide repeatedly, like the normal gcd method, while tracking an extra number t. When the remainder hits 0, the last t (adjusted to be positive) is d.
The message must be turned into a number m that is smaller than n.
Anyone can do this, because e and n are public.
Huge powers are never calculated directly. Write the exponent in binary, keep squaring m, and multiply in the squares where the bit is 1. Take mod n after every step so numbers stay small.
Only the owner can do this, because only they know d.
The whole system drawn with your own numbers. Press play to watch the message travel, or select any box to read what it does.
Each letter becomes its character code, and each code is encrypted separately. This needs n of at least 128, so use the textbook example or random primes.
An attacker sees only the public key. To find d, they must factor n back into p and q. With small primes, that's easy.