RSA Toy (insecure)

Explore textbook RSA on a number. Choose different odd primes p and q below 100, a public exponent e and a message m. Calculate shows c = mᵉ mod n and the recovered m = cᵈ mod n. Example loads p=61, q=53, e=17, m=65; after calculation c=2790 and m=65. Reset restores 11,13,7,42 and clears the result; the input never calculates itself.

Calculation steps shows n=pq, φ(n)=(p−1)(q−1), and d, the modular inverse of e: e×d mod φ(n)=1. The public key is (n,e), the private key (n,d). e must be greater than 1, smaller than φ(n) and coprime to it; m must be from 0 to n−1. Enter at most four decimal digits per field; decimals, scientific notation and longer input are rejected without truncation.

The power table shows square-and-multiply, reading exponent bits from least to most significant. Each row gives the current factor and accumulator after processing that bit: multiply the accumulator by the factor modulo n for bit1, keep it for bit0, then square the factor modulo n for the next row. Switch Encrypt/Decrypt to inspect either calculation; this changes the view without rebuilding the keys. Text equations and table values stay readable instead of being painted into a canvas.

This is deliberately insecure textbook RSA: small keys, deterministic integer messages, no padding such as OAEP and no text/file encryption. Even knowing that the number decrypts correctly does not establish security. Exact BigInt computation stays in the browser. Raw fields, completed calculation, open steps and the chosen trace are kept in local browser storage across reloads and language changes. A completed result is reconstructed from the same four bounded inputs, never from stored key/output values. Empty and invalid drafts remain unchanged and wait for Calculate. Older parameter-only links remain readable without automatically calculating. If a draft exceeds automatic storage, it stays live during app navigation and shows a copy-before-reload warning; reloading restores the previous saved version.