Cryptography Lab: Ciphers, RSA, Hashes & AES
Free cryptography tools in your browser: Caesar, Vigenère, affine, Atbash and rail fence ciphers, crack secret messages with letter frequencies, build an RSA key from two primes step by step, Diffie-Hellman key exchange, MD5 and SHA-256 hashes, and real AES encryption with a password.
How it works
Letter frequencies
Bars = how often each letter appears in your text; the grey line = normal English. A Caesar shift slides the whole pattern sideways, which is why the peaks give it away.
1. Make a key pair
2. Send a message
3. Be the attacker: break the key
Anyone can see n and e. If they can split n back into p × q, they can work out d. Try it with the key above: small keys fall in a blink, real ones (2048 bits) would take longer than the age of the universe.
Agree on a secret over an open line
Alice and Bob each keep a private number and only ever send mixed results. Eve hears everything sent but still can't get the shared secret, the same way you can't un-mix paint.
With real numbers
The avalanche effect
Change one letter and about half of SHA-256's 256 bits flip. That is why a hash can prove a file was not changed, and why you can't work backwards from a hash.
Real encryption (AES-256-GCM)
This is the same strong encryption banks and messaging apps use, done by your browser's built-in Web Crypto. The password becomes a key with PBKDF2 (250,000 rounds). Nothing is sent anywhere: copy the result and send it any way you like.
Encrypt or decrypt a file
name.mesenc; a .mesenc file is decrypted back. Uses the password above.Encoding is not encryption: anyone can decode Base64, hex or Morse without a key. It just turns data into text that travels safely.
Modular power ae mod m (square and multiply)
Modular inverse (extended Euclid)
Clock arithmetic
“mod 12” is a clock: after 12 you start again at 0. Drag the slider to add hours.
Cryptography, explained
Cryptography is the maths of keeping messages secret and proving they were not changed. This page lets you try every big idea in it, from the Caesar shift Julius Caesar used to the RSA and AES encryption that protects the web today. Everything runs in your browser: nothing you type is uploaded.
What each tab does
- Ciphers: encrypt and decrypt with the Caesar shift, ROT13, Atbash, affine, Vigenère, Beaufort, keyword substitution and rail fence ciphers, with a picture of how each one moves the letters.
- Crack a cipher: break a secret message without the key using letter frequencies, the index of coincidence and the Kasiski test, the way codebreakers did for centuries.
- RSA: build a public and private key from two primes step by step (n = p × q, φ(n), e and d with the extended Euclidean algorithm), send a message, then try to break the key by factoring n.
- Key exchange: Diffie–Hellman, shown with mixing paint and with real numbers, and why the eavesdropper can't solve the discrete logarithm.
- Hashes: MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC32 of text or a file, plus the avalanche effect bit by bit.
- Encrypt with a password: real AES-256-GCM encryption of text or files with your browser's Web Crypto.
- Base64, hex, Morse… and Modular maths: the encodings and number tricks cryptography is built on.
Questions people ask
- What is the difference between a code, a cipher and encoding?
- A cipher changes letters or bits with a rule and a key (Caesar, AES). A code swaps whole words for code words from a book. Encoding (Base64, Morse) has no key at all: anyone can reverse it.
- Why is the Caesar cipher so easy to break?
- There are only 25 possible shifts, so a computer tries them all at once, and letter frequencies point to the right one: E, T and A stay the most common letters, just moved.
- Why does RSA use prime numbers?
- Multiplying two big primes is quick, but splitting the product back into them is extremely slow. Your public key holds the product n; only you know the two primes, and you need them to work out the private key d. See the prime number checker to factor numbers yourself.
- Is the RSA tab safe for real secrets?
- No. It is “textbook RSA” for learning: no padding, and keys you can see. For real secrets use the password tab (AES-256-GCM) or a proper app.
- Can a hash be reversed?
- No. A hash throws information away, so many inputs share each output; the only way back is guessing inputs. That is why short or common passwords get cracked: attackers hash billions of guesses.
- How strong is the password encryption?
- AES-256 itself has never been broken. The weak point is the password: the page estimates how long a guessing attack would take, so use a long passphrase.
What about quantum computers?
A big enough quantum computer would break RSA, Diffie–Hellman and elliptic curves with Shor's algorithm, and halve the strength of AES with Grover's. Try both, plus quantum key distribution and the new post-quantum standards, in Quantum Cryptography, and test any site with the Quantum-Safe Website Checker.
Related: Quantum Cryptography · Quantum-Safe Checker · Prime Numbers · Enigma Machine · Matrix Calculator · File Safety Check · More tools