How this instrument works
RSA turns two prime numbers into a working lock and key. Multiply two primes p and q together and the product n = pq becomes the public modulus — the number everyone can see. Multiply the two primes' predecessors instead, (p − 1)(q − 1), and you get Euler's totient φ(n) — a count of the numbers smaller than the modulus that share no common factor with it. Everything else in the scheme, including the ciphertext c = mᵉ mod n produced here, sits on top of those two derived numbers.
The reason the scheme closes on itself is Euler's theorem, an eighteenth-century generalization of Fermat's little theorem: for any message coprime to the modulus, raising it to the totient's power leaves a remainder of exactly 1 when divided by the modulus. Pick a public exponent e and there exists a matching private exponent d with e·d exactly one more than a multiple of the totient; encrypting and then decrypting simply walks the message forward and back around that same cycle length, landing where it started. This sheet stops at the ciphertext, but the private key that reverses it — d = 3 in the worked example below — always exists once e and the totient share no common factor.
Two limits matter in practice. The message m has to sit inside the window 0 ≤ m < n, because modular arithmetic wraps anything larger back into that range — encrypt a value at or past the modulus and information is lost, not hidden. And while the arithmetic works identically for primes of any size, real RSA keys use p and q hundreds of digits long: multiplying them into n = pq stays easy, but recovering p and q from the modulus alone, the only known way to break the scheme outright, becomes computationally hopeless long before brute force could finish.
- Enter two primes in Prime, p and Prime, q — the classic teaching pair is 3 and 11, or use larger primes to watch the modulus grow.
- Set Public exponent, e to a value that shares no common factor with φ(n); 7 is the standard textbook choice for small examples.
- Type the value you want to encrypt into Message, m (0 ≤ m < n) — it must stay below the modulus or the wraparound erases information.
- Read Public modulus, n = pq and Euler's totient, φ(n) to see the two numbers every RSA key is built from.
- Result reports Encrypted message, c = mᵉ mod n — the ciphertext a receiver holding the matching private key could decrypt back to m.
Worked example — encrypting the message 5
Take the smallest pair of odd primes used in every RSA textbook: p = 3 and q = 11. The public modulus is n = p × q = 3 × 11 = 33, and the totient is φ(n) = (p − 1)(q − 1) = 2 × 10 = 20. Choosing public exponent e = 7, which shares no common factor with 20, and a message m = 5, encryption computes c = 5⁷ mod 33. Since 5⁷ = 78,125 and 78,125 = 2,367 × 33 + 14, the ciphertext is c = 14.
The private key that reverses this step is d = 3, since 7 × 3 = 21 is exactly one more than a multiple of 20 = φ(n). Raising the ciphertext back up confirms the round trip: 14³ = 2,744, and 2,744 mod 33 leaves 5 — the original message, recovered exactly. Swap primes of one and two digits for primes of two hundred digits, and the same three lines of arithmetic are the entire mathematical content behind real-world RSA key exchange.
Questions
Why does RSA need two primes instead of one?
Because factoring is only hard when the modulus hides two roughly equal, secret prime factors. If it were itself prime, or built from several small factors, anyone could find them quickly and derive the totient that unlocks the private key. Two large primes multiplied together give the widest possible gap between 'easy to check' — multiplying p × q — and 'hard to reverse' — factoring the result back into p and q.
What is Euler's totient φ(n) actually counting?
It counts the integers from 1 up to the modulus that share no common factor with it. For a product of two distinct primes, φ(n) = (p − 1)(q − 1) — the shortcut this calculator uses directly rather than checking every integer individually. With p = 3 and q = 11, φ(33) = 2 × 10 = 20, meaning exactly 20 of the whole numbers from 1 to 33 are coprime to 33.
Why must the public exponent e share no factor with φ(n)?
Because encryption has to be reversible. A private exponent d only exists as the modular inverse of e when e and the totient are coprime — otherwise no d satisfies e·d ≡ 1 (mod φ(n)), and the ciphertext could never be decrypted back to the message. e = 7 works with the totient equal to 20 because their greatest common divisor is 1.
What happens if the message m is not smaller than n?
It gets encrypted as its remainder modulo the modulus instead of as itself, silently losing information — two different messages that differ by a multiple of the modulus produce identical ciphertext. That is why the field is labelled m (0 ≤ m < n): staying inside that window is what lets decryption recover the exact original message rather than some other number merely congruent to it.
Is this the same RSA used to secure real websites?
The arithmetic is identical, but production RSA adds a padding scheme, typically OAEP, so that encrypting the same message twice never produces the same ciphertext, and it uses primes several hundred digits long rather than the two-digit ones here. This calculator shows the 'textbook RSA' mathematics that every padded, production version still builds on underneath.
What is the common student mistake with this formula?
Computing mᵉ in full before reducing it, instead of reducing as the exponent builds. Even this small example has 5⁷ = 78,125; real keys raise numbers hundreds of digits long to exponents just as large, and computing that power outright is impossible on any computer. Practical implementations use modular exponentiation — repeated squaring, reducing mod n at each step — to keep the intermediate numbers small; the final answer comes out identical either way.