What each number is
Six numbers, and knowing which are public is the whole picture.
p and q are two distinct primes. Secret, and after key generation they can be discarded — though keeping them speeds decryption up considerably.
n = pq is the modulus. Public. Everyone sees it.
φ(n) = (p−1)(q−1) counts the numbers below n that are coprime with it. Secret, and this is the crux: computing it requires knowing p and q.
e is the public exponent, chosen coprime with φ(n). Public. In practice it is almost always 65537, which is prime and has only two bits set, making exponentiation fast.
d is the modular inverse of e. Secret, and it is the private key.
Why the round trip works
Encrypting raises to the power e; decrypting raises to the power d. They undo each other, and the reason is Euler’s theorem.
Euler’s theorem says m^φ(n) ≡ 1 (mod n) whenever m is coprime with n. Since ed ≡ 1 (mod φ(n)), we have ed = 1 + kφ(n) for some k, so m^ed = m × (m^φ(n))^k ≡ m × 1 ≡ m.
That is the whole proof. Encryption and decryption are the same operation with different exponents, and the exponents were chosen so that applying both returns the original.
It also works when m shares a factor with n, though that needs the Chinese remainder theorem rather than Euler’s theorem directly — and if it happened you would have factored n by accident, which is a far bigger problem than the message.
Why this is not secure
Two separate reasons, and both matter.
The primes here are tiny. A 100,000-limit prime is factored instantly, so anyone can derive the private key from the public one. That is deliberate: numbers small enough to be broken are the ones safe to demonstrate with, and small enough to follow by hand.
Textbook RSA is insecure even with large primes. This is the part that surprises people.
It is deterministic: the same message always gives the same ciphertext, so an attacker who can guess the plaintext can confirm it by encrypting. For a message that is one of a few possibilities — yes or no, a price, a name from a list — that is fatal.
Short messages can be recovered outright. If mᵉ is smaller than n, no wrapping happens and taking an ordinary integer eth root recovers m with no key at all.
It is also malleable: multiplying a ciphertext by 2ᵉ multiplies the plaintext by 2, without the key.
Real implementations pad with OAEP, which adds randomness and structure and removes all three problems. RSA without padding is not RSA as anyone deploys it.
Why references disagree about d
Work an RSA example from two textbooks and you may get two different private keys. Both can be right.
The original 1978 paper uses Euler’s totient, φ(n) = (p−1)(q−1). That is what this page uses.
Modern implementations use Carmichael’s function, λ(n) = lcm(p−1, q−1). It is a divisor of φ(n), so it gives a smaller d — which makes decryption faster.
Every d produced either way decrypts correctly, because both satisfy the congruence that the proof needs. So a d that differs from a textbook’s is not necessarily wrong.
The check that matters is the round trip, which this page performs and displays. That is why the test suite verifies by round trip rather than by matching a published key.
Where it gets used
TLS. RSA has long been used to exchange keys when a browser connects to a site, though elliptic-curve methods have largely displaced it for that.
Signatures. Signing runs the operation the other way: the private key produces something anyone with the public key can verify. Code signing, certificates and document signing all rest on it.
SSH and PGP. RSA key pairs remain common for both.
Its future. Shor’s algorithm factors efficiently on a sufficiently large quantum computer, which would break RSA outright. No such machine exists, and post-quantum standards are being adopted in anticipation — a reminder that the security assumption is about difficulty, not impossibility.
Sources and methodology
RSA is a published algorithm; these are the references.
Method. Everything runs on arbitrary-precision integers, and the primes are capped at 100,000 — small enough to factor instantly, which is exactly what makes them safe to demonstrate with. The suite verifies correctness by round trip rather than by matching a published key: this page uses Euler’s φ(n) where many references use Carmichael’s λ(n), which yields a different but equally valid private key, so only the round trip distinguishes right from wrong. That engine is verified on every change against 99 hand-written assertions, including that every message below n round-trips correctly across three key pairs, and that a non-prime input, equal primes, and an exponent sharing a factor with φ(n) are each refused with the reason. The count and the per-case breakdown are published on the formula verification page.
Read the guide
The modular exponentiation that RSA is built on has its own page, with the square-and-multiply method shown.