RSA-OAEP encrypt
Encrypt a small file with an RSA public key (RSA-OAEP), on your device.
Runs on your device. The file is never uploaded.
RSA-OAEP encrypt loads an SPKI public key from PEM and encrypts a small file under RSA-OAEP with SHA-256, writing raw ciphertext to your file name with .rsa added. The padding seed is fresh every run, so one input gives different bytes each time. Anything past roughly the modulus in bytes minus 66 is refused as too large.
Questions
Why does encryption fail on my file?
Almost always because the file is too large. The refusal starts "encryption failed" and explains that RSA-OAEP can only encrypt a small message, roughly modulusLength/8 minus 66 bytes. For a 2048-bit key that is about 190 bytes, for 4096-bit about 446. RSA is not a bulk cipher. To protect a real file, use AES-GCM encrypt with a password, or encrypt a random key here and move the file separately.
What algorithm and padding is this?
RSA-OAEP with SHA-256, through crypto.subtle in your browser. Both are fixed: there is no option to change the hash or to switch to PKCS#1 v1.5. The public key is imported from PEM in SPKI form, which is what RSA key pair generate produces when purpose is set to encrypt. A key made with purpose=sign is an RSA-PSS key and will not import here.
What is the output file?
Your filename with .rsa added, so token.bin becomes token.bin.rsa. The contents are the raw ciphertext bytes, exactly as long as the modulus, which is 256 bytes for a 2048-bit key. There is no header, no algorithm marker and no key identifier, so you have to remember yourself which key it was encrypted to.
Why is the ciphertext different each time?
OAEP padding uses a fresh random seed on every encryption. Encrypting the same bytes to the same public key twice gives two different files, and both decrypt correctly. That is what stops an observer from spotting repeated messages. It also means you cannot compare two .rsa files to see whether they hold the same content.
Why did my PEM not load?
The tool looks for a BEGIN and END block with a base64 body. If there is nothing between them it refuses with "not a PEM key (missing -----BEGIN/END----- block or body)". If the block is present but holds the wrong kind of key, an OpenSSH public key, an RSA-PSS key or a private key pasted where the public one goes, the Web Crypto import fails instead. Paste the PUBLIC KEY block from RSA key pair generate with purpose=encrypt.
Does the file or the key get uploaded?
No. Import and encryption both run through crypto.subtle in a Web Worker in this tab. The public key you paste and the file you drop stay on your device, and the result is produced locally. Nothing is sent anywhere, and the tool works with the network off.