RSA-OAEP decrypt
Decrypt a file produced by RSA-OAEP encrypt, with the matching private key, on your device.
Runs on your device. The file is never uploaded.
RSA-OAEP decrypt imports a PKCS8 key from PEM and turns .rsa ciphertext back into the original bytes, naming the result by dropping that suffix or adding .dec. The hash is fixed at SHA-256. Bare ciphertext is all it reads, so a PGP message, a JWE envelope or PKCS#1 v1.5 padding comes back as a failed decryption.
Questions
Which key opens a .rsa file?
The private key from the same pair, as a PKCS8 PEM, generated with purpose=encrypt. Paste the BEGIN PRIVATE KEY block from RSA key pair generate. The tool imports it for RSA-OAEP with SHA-256, the exact algorithm RSA-OAEP encrypt used. A signing key will not import, and neither will a public key.
Why do I get "decryption failed"?
Because OAEP unpadding did not produce a valid message. The rest of the message says wrong private key, or the input is not RSA-OAEP ciphertext for this key. A ciphertext meant for a different pair, a file that was altered in transit, and a file that was never RSA output all fail identically. The tool does not guess and does not return partial bytes.
What is the recovered file called?
Your input name with .rsa removed, so token.bin.rsa comes back as token.bin. If the name does not end in .rsa the tool appends .dec instead. Nothing about the original name is stored inside the ciphertext, so the name comes only from the file you dropped.
Can it decrypt anything other than this site output?
Yes, if it is bare RSA-OAEP ciphertext with SHA-256. The file bytes go straight to crypto.subtle.decrypt. It does not parse PKCS#7, CMS, a PGP message or a JWE envelope, and it cannot handle PKCS#1 v1.5 padding or a different OAEP hash. Anything with a wrapper around the ciphertext has to be unwrapped first.
Is my private key safe to paste here?
It never leaves the page. The PEM is decoded and imported by crypto.subtle in a Web Worker in this tab, marked non-extractable, used for the run and then discarded. There is no upload, no logging and no storage. The judgement is still yours: pasting a production private key into any web page, including this one, is a decision about the device and browser you are on.
Why can it only handle small files?
RSA-OAEP decrypts a single block, at most the modulus size. That is the other side of the limit on the encrypt tool, roughly modulusLength/8 minus 66 bytes of plaintext. To move a large file, encrypt a random key with RSA and the file itself with AES-GCM encrypt.