RSA Decrypt

Audience: Low-code Engineers

Skill Prerequisites: Actions, Tokens

Decrypts one or more RSA-encrypted values with a private key and saves the original text in tokens. The values must have been encrypted with the matching public key, for example with RSA Encrypt.

The action expects PKCS#1 v1.5 padding and the encrypted value as a base64 string. The decrypted bytes are read as UTF-8 text.

Typical Use Cases

• Decrypt a value you encrypted with RSA Encrypt
• Decrypt a value a browser or partner system encrypted with your public key
• Decrypt an AES key that was sent encrypted with RSA, then use it with AES Decrypt

Don't use it to

• Decrypt AES-encrypted values. Use AES Decrypt instead.
• Decrypt values encrypted with OAEP padding. This action only supports PKCS#1 v1.5.
• Check a password. Passwords should be hashed and compared, not decrypted.

Which to use

The value was encrypted with	Decrypt it with
RSA Encrypt, or another tool using your RSA public key and PKCS#1 v1.5 padding	RSA Decrypt
AES Encrypt, or another tool using AES-CBC with a shared key and IV	AES Decrypt
Connector Encrypt	Not with an action. Connectors and the Connector Format grid formatter decrypt these values.

Related Actions

Action Name	Description
RSA Encrypt	Encrypts short values with a public key.
Generate RSA Keys	Creates a key pair in PEM format, which this action can't read directly.
AES Decrypt	Decrypts AES-encrypted values.
Get Connector	Reads connector properties into tokens, for example to load a key.

Input Parameter Reference

Parameter	Description	Supports Tokens	Default	Required
Private Key	The RSA private key in .NET XML format, starting with <RSAKeyValue> and including the private parts, such as <P>, <Q> and <D>. PEM keys (-----BEGIN PRIVATE KEY-----) aren't accepted. The key generator linked in the parameter's help text creates keys in this format.	Yes	empty string	Yes
Fields	A list of values to decrypt. In Data to Decrypt, enter the encrypted base64 value, usually a token such as [PinEncrypted]. In Store in Token, enter the name of the token that gets the decrypted text, such as Pin. Square brackets around the name are removed.	Yes, in Data to Decrypt	empty	Yes

Output Parameters Reference

Token	Description
[<Store in Token>]	One token for each row in Fields, holding the decrypted text. An empty input gives an empty string.

When decryption fails

Situation	What happens
Private key is empty	Nothing. No tokens are set.
Encrypted value isn't valid base64	The action fails with Decryption error: Data beeing decrypted is invalid.
Wrong key, key isn't valid XML, or the value was changed	The action fails with Failed to decrypt. Make sure the data was encrypted with the public key that corresponds the private key used for decryption.

To handle a failure yourself, put the action inside Execute Actions and use its On Error actions.

Considerations

• Don't show decryption errors to outsiders. With PKCS#1 v1.5 padding, detailed error messages can help an attacker work out encrypted values. If the encrypted value comes from users or an API, return one general message from the On Error actions.
• Protect the private key. Anyone with it can decrypt everything encrypted with the public key. Load it from a token instead of typing it into the action, and never log it or send it to the browser.
• Match the padding. Values encrypted with OAEP padding, which many newer tools use by default, won't decrypt. Ask the sender to use PKCS#1 v1.5.
• Use a strong key. 1024-bit keys are no longer considered safe. Use 2048 bits or more.

Examples

tip

To understand how to use the below examples, please see Running Examples.

1. Decrypt a PIN

This action decrypts [PinEncrypted] with the private key in the [RsaPrivateKey] token and saves the text in [Pin].

{
    "Title": "RSA Decrypt",
    "ActionType": "RSADecrypt",
    "Description": "Decrypt the PIN",
    "Condition": "[PinEncrypted] != \"\"",
    "Parameters": {
        "Key": "[RsaPrivateKey]",
        "Fields": {
            "[PinEncrypted]": "Pin"
        }
    }
}

Revised 09/27/2026