Public & private keys,
from the math up

Hand out open padlocks. Keep the only key.

Imagine you mail open padlocks to everyone. Anyone can snap one shut on a box and send it to you — but only you hold the key that opens them. The padlock is your public key; the key is your private key.

That's the whole trick. The two are mathematically linked, but knowing the padlock tells you nothing useful about the key. Everything else on this page is just how to build that padlock out of numbers.

• Encrypt: anyone locks a message with your public key → only your private key opens it.
• Sign: you lock with your private key → anyone can confirm with your public key it was really you.

Same pair of keys, used in opposite directions, gives you both secrecy and proof of identity. Hold onto that — it's the part most people never quite see clearly.

All of this lives on a clock, not a number line.

A 12-hour clock already does modular arithmetic. 5 hours after 9 o'clock isn't 14 o'clock — it's 2. You wrapped around 12. We write that 14 mod 12 = 2.

Cryptography uses this constantly: pick a modulus n, and every number wraps back into the range 0…n−1. Wrapping is what throws away information — and that's exactly what makes the math hard to reverse. Spin the clock and feel it.

Multiplying is easy. Un-multiplying is the whole game.

Multiply two primes: 17 × 11 = 187 — trivial. Now reverse it: given just 187, find the two primes. You'd have to try candidates. With 187 that's quick; with a 600-digit number it would outlast the universe.

That gap — cheap one way, hopeless the other — is a one-way function. RSA's is "multiply two big primes." The "trapdoor" is that if you happen to know the primes, a shortcut opens up. The private key is that secret knowledge.

Why "just try all factors" stops working.

Factoring difficulty doesn't grow gently — it explodes with the size of the number. This is the single fact that keeps your wallet safe. Drag the key size and watch the estimated work.

Every step shown, every number checkable by hand.

This is the actual RSA algorithm — just with tiny primes so you can follow it. Pick two primes and walk through it. The math is identical to what secures real keys; only the size differs.

Real keys use two primes each hundreds of digits long. The steps you just did are exactly the same — RSA is this, scaled up until factoring n is impossible.

Lock a number with the padlock. Watch only the private key open it.

Using the key pair you just built, encryption is one formula: raise the message to the power e, mod n. Decryption raises the result to the power d, mod n. The wrapping makes them cancel out — but only with the right d.

Run the keys backwards and you get a signature.

Swap the order. If you raise a message to your private d, anyone can raise the result to your public e and recover the message. Since only you know d, a result that checks out could only have come from you. That's a digital signature — the basis of every blockchain transaction.

Your blockchain address is a public key. Your signature is your spend.

Now the use cases click into place. A wallet is a key pair. Your address is derived from the public key — safe to share. "Signing a transaction" means running the private-key direction over the transaction details. Nodes verify with your public key. No password sits on a server to be stolen; control is knowledge of the private number.

Lose the private key and the funds are gone forever. There's no reset, because there's no authority — only math.

Real blockchains mostly don't use RSA — but the idea is identical.

Bitcoin and Ethereum use elliptic-curve cryptography (ECC), not RSA. The reason is efficiency: ECC gives the same security as RSA with far smaller keys (a 256-bit ECC key ≈ a 3072-bit RSA key). The hard "one-way" problem is different — adding points on a curve instead of multiplying primes — but the structure you learned is exactly the same: a public value freely shared, a private scalar kept secret, easy one way and infeasible to reverse.

• RSA — one-way problem: factoring a product of two big primes. Easy to teach (this page).
• ECC — one-way problem: the elliptic-curve discrete log. Smaller, faster, used by Bitcoin/Ethereum.
• Both — same padlock-and-key logic; same encrypt-vs-sign duality.

A looming caveat worth telling students: large quantum computers would break both RSA and today's ECC. "Post-quantum" cryptography — based on still-harder problems — is already being standardised in anticipation.