[{"data":1,"prerenderedAt":668},["ShallowReactive",2],{"tool-content:hybrid-encryption":3,"published-tool-content":453},{"id":4,"title":5,"body":6,"category":427,"dataVersion":428,"description":429,"extension":430,"featured":431,"icon":432,"keywords":433,"meta":440,"navigation":431,"path":441,"seo":442,"seoTitle":443,"slug":444,"status":445,"stem":446,"updatedAt":447,"usageTips":448,"__hash__":452},"tools\u002Ftools\u002Fhybrid-encryption.md","RSA + AES 混合加解密工具",{"type":7,"value":8,"toc":412},"minimark",[9,13,17,20,33,36,39,53,56,68,71,74,98,101,117,120,124,298,330,333,336,369,372,377,380,384,387,391,394,398,401,405,408],[10,11,12],"h2",{"id":12},"什么时候使用",[14,15,16],"p",{},"适合只有接收方 RSA 公钥、需要加密超过 RSA 单次长度限制的文本。它把 RSA 用于保护随机会话密钥，把较长正文交给 AES-GCM。",[10,18,19],{"id":19},"快速使用",[21,22,23,27,30],"ol",{},[24,25,26],"li",{},"加密时粘贴接收方公钥，或先生成一组 RSA 密钥。",[24,28,29],{},"输入正文并点击“生成混合加密信封”，得到 Hybrid v1 JSON。",[24,31,32],{},"接收方使用配套私钥解密整个 JSON；私钥不要和信封一起传递或保存。",[10,34,35],{"id":35},"工具说明",[14,37,38],{},"这个工具把 RSA 和 AES 组合成一个浏览器本地数字信封：",[21,40,41,44,47,50],{},[24,42,43],{},"每次加密生成新的 32 字节随机 AES-256 会话密钥。",[24,45,46],{},"使用 AES-256-GCM 加密 UTF-8 正文。",[24,48,49],{},"使用接收方的 RSA 公钥和 OAEP\u002FSHA-256 包装会话密钥。",[24,51,52],{},"把包装后的会话密钥、IV、密文和认证标签保存为 Hybrid v1 JSON。",[14,54,55],{},"解密时，接收方先使用 RSA 私钥解封 AES 会话密钥，再通过 AES-256-GCM 校验信封并还原正文。RSA 只处理固定长度的随机密钥，所以正文不再受 RSA 单次明文长度限制；实际可处理长度仍取决于当前浏览器的内存。",[14,57,58,59,63,64,67],{},"页面算法固定为 ",[60,61,62],"code",{},"RSA-OAEP + SHA-256"," 和 ",[60,65,66],{},"AES-256-GCM","，不提供 PKCS#1 v1.5、AES-CBC 或无认证模式。密钥、明文、会话密钥和信封只在当前浏览器中处理，不会上传或保存。",[10,69,70],{"id":70},"密钥格式",[14,72,73],{},"公钥加密支持：",[75,76,77,83,89,95],"ul",{},[24,78,79,80],{},"SPKI PEM：",[60,81,82],{},"BEGIN PUBLIC KEY",[24,84,85,86],{},"PKCS#1 PEM：",[60,87,88],{},"BEGIN RSA PUBLIC KEY",[24,90,91,92],{},"X.509 PEM 证书：",[60,93,94],{},"BEGIN CERTIFICATE",[24,96,97],{},"RSA 公钥 JWK",[14,99,100],{},"私钥解密支持：",[75,102,103,109,114],{},[24,104,105,106],{},"PKCS#8 PEM：",[60,107,108],{},"BEGIN PRIVATE KEY",[24,110,85,111],{},[60,112,113],{},"BEGIN RSA PRIVATE KEY",[24,115,116],{},"包含完整私密参数的 RSA 私钥 JWK",[14,118,119],{},"页面可以生成 2048、3072 或 4096 位 RSA 密钥对，默认使用 2048 位。生成结果是 SPKI 公钥和未加密 PKCS#8 私钥。",[10,121,123],{"id":122},"hybrid-v1-信封","Hybrid v1 信封",[125,126,131],"pre",{"className":127,"code":128,"language":129,"meta":130,"style":130},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"v\": 1,\n  \"alg\": \"RSA-OAEP-256\",\n  \"enc\": \"A256GCM\",\n  \"encryptedKey\": \"\u003CBase64 RSA ciphertext>\",\n  \"iv\": \"\u003C12-byte Base64>\",\n  \"ciphertext\": \"\u003CBase64>\",\n  \"authTag\": \"\u003C16-byte Base64>\"\n}\n","json","",[60,132,133,142,165,188,209,230,251,272,292],{"__ignoreMap":130},[134,135,138],"span",{"class":136,"line":137},"line",1,[134,139,141],{"class":140},"sMK4o","{\n",[134,143,145,148,152,155,158,162],{"class":136,"line":144},2,[134,146,147],{"class":140},"  \"",[134,149,151],{"class":150},"spNyl","v",[134,153,154],{"class":140},"\"",[134,156,157],{"class":140},":",[134,159,161],{"class":160},"sbssI"," 1",[134,163,164],{"class":140},",\n",[134,166,168,170,173,175,177,180,184,186],{"class":136,"line":167},3,[134,169,147],{"class":140},[134,171,172],{"class":150},"alg",[134,174,154],{"class":140},[134,176,157],{"class":140},[134,178,179],{"class":140}," \"",[134,181,183],{"class":182},"sfazB","RSA-OAEP-256",[134,185,154],{"class":140},[134,187,164],{"class":140},[134,189,191,193,196,198,200,202,205,207],{"class":136,"line":190},4,[134,192,147],{"class":140},[134,194,195],{"class":150},"enc",[134,197,154],{"class":140},[134,199,157],{"class":140},[134,201,179],{"class":140},[134,203,204],{"class":182},"A256GCM",[134,206,154],{"class":140},[134,208,164],{"class":140},[134,210,212,214,217,219,221,223,226,228],{"class":136,"line":211},5,[134,213,147],{"class":140},[134,215,216],{"class":150},"encryptedKey",[134,218,154],{"class":140},[134,220,157],{"class":140},[134,222,179],{"class":140},[134,224,225],{"class":182},"\u003CBase64 RSA ciphertext>",[134,227,154],{"class":140},[134,229,164],{"class":140},[134,231,233,235,238,240,242,244,247,249],{"class":136,"line":232},6,[134,234,147],{"class":140},[134,236,237],{"class":150},"iv",[134,239,154],{"class":140},[134,241,157],{"class":140},[134,243,179],{"class":140},[134,245,246],{"class":182},"\u003C12-byte Base64>",[134,248,154],{"class":140},[134,250,164],{"class":140},[134,252,254,256,259,261,263,265,268,270],{"class":136,"line":253},7,[134,255,147],{"class":140},[134,257,258],{"class":150},"ciphertext",[134,260,154],{"class":140},[134,262,157],{"class":140},[134,264,179],{"class":140},[134,266,267],{"class":182},"\u003CBase64>",[134,269,154],{"class":140},[134,271,164],{"class":140},[134,273,275,277,280,282,284,286,289],{"class":136,"line":274},8,[134,276,147],{"class":140},[134,278,279],{"class":150},"authTag",[134,281,154],{"class":140},[134,283,157],{"class":140},[134,285,179],{"class":140},[134,287,288],{"class":182},"\u003C16-byte Base64>",[134,290,291],{"class":140},"\"\n",[134,293,295],{"class":136,"line":294},9,[134,296,297],{"class":140},"}\n",[75,299,300,305,310,315,320],{},[24,301,302,304],{},[60,303,216],{}," 是 RSA-OAEP\u002FSHA-256 包装后的 32 字节会话密钥。",[24,306,307,309],{},[60,308,237],{}," 是每次加密重新生成的 12 字节随机 GCM IV。",[24,311,312,314],{},[60,313,258],{}," 不包含认证标签。",[24,316,317,319],{},[60,318,279],{}," 固定为 16 字节。",[24,321,322,324,325,63,327,329],{},[60,323,151],{},"、",[60,326,172],{},[60,328,195],{}," 的规范 JSON 会作为 AES-GCM AAD 参与认证。",[14,331,332],{},"Hybrid v1 是本站工具自己的 JSON 契约，不是 JWE Compact Serialization 或 JWE JSON Serialization。它不会读取 AES v1、v2、v3、v4 信封，也没有其他旧版混合信封兼容逻辑。",[10,334,335],{"id":335},"安全边界",[75,337,338,341,344,363,366],{},[24,339,340],{},"同一 RSA 公钥可以加密多条消息，但每条消息都会使用新的 AES 密钥和 IV。",[24,342,343],{},"RSA-OAEP 只负责会话密钥机密性；AES-GCM 同时保护正文机密性和信封完整性。",[24,345,346,347,324,349,324,351,324,353,324,355,324,357,359,360,362],{},"修改 ",[60,348,151],{},[60,350,172],{},[60,352,195],{},[60,354,216],{},[60,356,237],{},[60,358,258],{}," 或 ",[60,361,279],{}," 后，解密都会失败。",[24,364,365],{},"工具不会保存私钥。请勿在不可信设备、共享设备或已被注入脚本的页面中粘贴生产私钥。",[24,367,368],{},"这是加密工具，不包含发送方签名或身份认证；仅凭成功解密无法证明消息由谁发送。",[10,370,371],{"id":371},"常见问题",[373,374,376],"h3",{"id":375},"为什么不直接用-rsa-加密长文本","为什么不直接用 RSA 加密长文本？",[14,378,379],{},"RSA 每次只能处理远小于模数长度的数据，而且不适合直接加密大块内容。混合加密只让 RSA 包装固定的 32 字节会话密钥，把正文交给高效的 AES-GCM。",[373,381,383],{"id":382},"为什么没有算法下拉框","为什么没有算法下拉框？",[14,385,386],{},"这个页面用于提供单一、明确的现代组合。RSA 固定为 OAEP\u002FSHA-256，正文固定为 AES-256-GCM，避免生成缺少认证或仅用于旧系统兼容的信封。",[373,388,390],{"id":389},"这个-json-能直接当作-jwe-使用吗","这个 JSON 能直接当作 JWE 使用吗？",[14,392,393],{},"不能。字段含义与数字信封相似，但编码、AAD 和序列化契约由本工具定义。需要标准 JWE 时，应使用专门的 JOSE 实现。",[373,395,397],{"id":396},"能证明发送方身份吗","能证明发送方身份吗？",[14,399,400],{},"不能。任何拿到接收方公钥的人都可以生成可解密信封。如果还需要确认发送方身份，应在明确协议中增加数字签名。",[373,402,404],{"id":403},"密钥和正文会上传吗","密钥和正文会上传吗？",[14,406,407],{},"不会。密钥生成、随机数生成、RSA 包装、AES-GCM 加解密和复制都在当前浏览器中完成。",[409,410,411],"style",{},"html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":130,"searchDepth":144,"depth":144,"links":413},[414,415,416,417,418,419,420],{"id":12,"depth":144,"text":12},{"id":19,"depth":144,"text":19},{"id":35,"depth":144,"text":35},{"id":70,"depth":144,"text":70},{"id":122,"depth":144,"text":123},{"id":335,"depth":144,"text":335},{"id":371,"depth":144,"text":371,"children":421},[422,423,424,425,426],{"id":375,"depth":167,"text":376},{"id":382,"depth":167,"text":383},{"id":389,"depth":167,"text":390},{"id":396,"depth":167,"text":397},{"id":403,"depth":167,"text":404},"crypto","hybrid-envelope-v1","使用接收方 RSA 公钥加密较长文本：RSA 包装随机 AES-256 密钥，正文由 AES-GCM 保护。","md",true,"i-lucide-package-check",[434,435,436,66,437,438,439],"混合加密","RSA AES","RSA-OAEP","数字信封","会话密钥","Hybrid Encryption",{},"\u002Ftools\u002Fhybrid-encryption",{"title":5,"description":429},"RSA + AES 混合加解密工具 - RSA-OAEP 与 AES-256-GCM","hybrid-encryption","published","tools\u002Fhybrid-encryption","2026-07-25",[449,450,451],"加密时只需要接收方公钥，解密必须使用配套私钥","页面自动为每条消息生成新的 AES 会话密钥和 GCM IV，无需手动配置算法","输出是本站 Hybrid v1 JSON，不是标准 JWE，也不读取 AES v1\u002Fv2\u002Fv3\u002Fv4 信封","XyNS6INayqAsN_EoQE1ekXTbeF_dYTyhz8BOBKcbq1s",[454,469,481,493,507,519,521,533,545,557,570,581,594,607,619,633,645,656],{"slug":455,"title":456,"description":457,"status":445,"icon":458,"keywords":459,"featured":431},"asymmetric-encryption","RSA 非对称加解密工具","使用 RSA 公钥加密、私钥解密短文本；支持常见 PEM、JWK、X.509 公钥和旧系统兼容参数。","i-lucide-key-round",[460,461,436,462,463,464,465,466,467,468],"RSA 加密","RSA 解密","PKCS1Padding","OAEPWithSHA-256AndMGF1Padding","RSA 密钥生成","PEM 密钥","RSA JWK","PKCS#1 密钥","X.509 证书",{"slug":470,"title":471,"description":472,"status":445,"icon":473,"keywords":474,"featured":431},"base58-converter","Base58 编解码工具","在线使用 Bitcoin Base58 编解码 UTF-8 文本或 Hex 字节，并以文本、Hex 或二进制文件查看解码结果。","i-lucide-binary",[475,476,477,478,479,480],"Base58 编解码","Base58 编码","Base58 解码","Bitcoin Base58","Hex 转 Base58","Base58 在线工具",{"slug":482,"title":483,"description":484,"status":445,"icon":485,"keywords":486,"featured":431},"base64-converter","Base64 编解码工具","在线转换标准 Base64 与 Base64URL，支持 UTF-8 文本、Hex 字节、文件编码及二进制解码下载。","i-lucide-file-key-2",[487,488,489,490,491,492],"Base64 编解码","Base64URL","文件转 Base64","Hex 转 Base64","Base64 解码","Base64 在线工具",{"slug":494,"title":495,"description":496,"status":445,"icon":497,"keywords":498,"featured":431},"chacha20-poly1305","ChaCha20-Poly1305 加解密工具","使用 ChaCha20 或 XChaCha20-Poly1305 安全加解密文本，适合现代 AEAD 或对接 RFC 8439 的场景。","i-lucide-shield-check",[499,500,501,502,503,504,505,506],"ChaCha20-Poly1305","XChaCha20-Poly1305","ChaCha20 加密","Poly1305","RFC 8439","AEAD","AAD","PBKDF2",{"slug":508,"title":509,"description":510,"status":445,"icon":511,"keywords":512,"featured":431},"hex-converter","Hex 编解码工具","在线转换 UTF-8 文本与十六进制字节，支持大小写、0x 前缀以及空格或冒号分隔格式。","i-lucide-hash",[513,514,515,516,517,518],"Hex 编解码","十六进制编码","十六进制解码","文本转 Hex","0x Hex","Hex 在线工具",{"slug":444,"title":5,"description":429,"status":445,"icon":432,"keywords":520,"featured":431},[434,435,436,66,437,438,439],{"slug":522,"title":523,"description":524,"status":445,"icon":525,"keywords":526,"featured":431},"json-formatter","JSON 格式化与校验工具","在线校验、格式化和压缩 JSON 数据，支持 JSONC 单行与块注释，可准确定位格式错误，内容仅在浏览器本地处理。","i-lucide-braces",[527,528,529,530,531,532],"JSON 格式化","JSON 校验","JSON 压缩","JSONC","JSON 在线工具","JSON 注释",{"slug":534,"title":535,"description":536,"status":445,"icon":537,"keywords":538,"featured":431},"md5-generator","MD5 哈希工具","在线计算文本或文件的 MD5 摘要，支持十六进制大小写和 Base64 输出，内容仅在浏览器本地处理。","i-lucide-fingerprint",[539,540,541,542,543,544],"MD5 工具","MD5 哈希","文件 MD5","MD5 Base64","文本 MD5","MD5 摘要",{"slug":546,"title":547,"description":548,"status":445,"icon":549,"keywords":550,"featured":431},"qr-code","二维码生成与识别工具","在线生成二维码并下载 PNG 或 SVG，也可上传图片识别二维码内容；文本和图片只在浏览器本地处理。","i-lucide-qr-code",[551,552,553,554,555,556],"二维码生成","二维码识别","二维码解析","QR Code","在线二维码工具","二维码图片",{"slug":558,"title":559,"description":560,"status":445,"icon":485,"keywords":561,"featured":431},"rsa-key-converter","RSA 密钥格式转换与解析工具","识别 RSA 密钥或证书的实际格式，在 PEM、DER、JWK 之间转换，并用指纹核对是否为同一公钥。",[562,563,564,565,566,567,568,569],"RSA 密钥转换","PEM 转 JWK","JWK 转 PEM","PKCS#1 转 PKCS#8","SPKI 公钥","DER 解析","X.509 证书解析","RSA 指纹",{"slug":571,"title":572,"description":573,"status":445,"icon":497,"keywords":574,"featured":431},"sha256-generator","SHA-256 哈希工具","在线计算文本或文件的 SHA-256 摘要，支持十六进制大小写和 Base64 输出，内容仅在浏览器本地处理。",[575,576,577,578,579,580],"SHA-256 工具","SHA256 哈希","文件 SHA256","SHA256 Base64","文本 SHA256","SHA-256 摘要",{"slug":582,"title":583,"description":584,"status":445,"icon":458,"keywords":585,"featured":431},"sm2-encryption","SM2 公钥加解密工具","面向国密公钥加密生成 SM2 密钥对并处理文本，支持常见 C1C3C2 与旧式 C1C2C3 排列。",[586,587,588,589,590,591,592,593],"SM2 加密","SM2 解密","C1C3C2","C1C2C3","国密算法","SM2 密钥生成","压缩公钥","Hex 密文",{"slug":595,"title":596,"description":597,"status":445,"icon":598,"keywords":599,"featured":431},"sm4-encryption","SM4 对称加解密工具","面向国密系统使用 SM4-CBC 或 SM4-ECB 加解密文本，并与 Hex、Base64 密文接口联调。","i-lucide-lock-keyhole",[600,601,602,603,604,605,590,593,606],"SM4 加密","SM4 解密","SM4-CBC","SM4-ECB","PKCS7","NoPadding","Base64 密文",{"slug":608,"title":609,"description":610,"status":445,"icon":611,"keywords":612,"featured":431},"social-insurance","五险一金计算器","按城市、逐月工资、个人缴费基数和专项附加扣除，估算个人五险一金、累计预扣个税与税后收入。","i-lucide-calculator",[613,614,615,616,617,618],"五险一金","社保计算","公积金计算","缴费基数","税后工资","个税计算",{"slug":620,"title":621,"description":622,"status":445,"icon":598,"keywords":623,"featured":431},"symmetric-encryption","AES 对称加解密工具","使用共享密钥或口令加解密文本；默认采用 AES-256-GCM，并保留 CBC、CTR、CFB、ECB 等兼容模式。",[624,625,626,627,628,629,630,506,631,632],"AES 加密","AES 解密","AES-GCM","AES-CBC","AES-ECB","PKCS7Padding","ZeroPadding","AES AAD","AES 原始参数",{"slug":634,"title":635,"description":636,"status":445,"icon":637,"keywords":638,"featured":431},"timestamp-converter","时间戳转换工具","在线完成 Unix 时间戳与日期时间互转，自动识别秒或毫秒，支持 IANA 时区和多行批量转换。","i-lucide-clock-3",[639,640,641,642,643,644],"时间戳转换","Unix 时间戳","timestamp","日期转时间戳","时间戳转日期","毫秒时间戳",{"slug":646,"title":647,"description":648,"status":445,"icon":473,"keywords":649,"featured":431},"unicode-converter","Unicode 转换工具","在线将中文、Emoji 等普通文本转换为 \\uXXXX Unicode 转义，或把 Unicode 转义还原为可读文本，内容仅在浏览器本地处理。",[650,651,652,653,654,655],"Unicode 转换","Unicode 转中文","中文转 Unicode","Unicode 编码","Unicode 解码","Unicode 在线工具",{"slug":657,"title":658,"description":659,"status":445,"icon":660,"keywords":661,"featured":431},"yaml-json-converter","YAML 校验与 JSON 互转工具","在线校验 YAML 或 JSON 格式，并在 YAML 与标准 JSON 之间双向转换，可定位常见语法错误，内容仅在浏览器本地处理。","i-lucide-file-json-2",[662,663,664,665,666,667],"YAML 校验","YAML 转 JSON","JSON 转 YAML","YAML JSON 互转","YAML 在线工具","YAML 格式检查",1784957143881]