Everything here runs in your browser, one operation at a time: the padding, the key schedule, each round, the modular arithmetic, the wire protocol. Each page explains why a step exists, where students trip over it, and what happens when an attacker gets involved.
No build step, no dependencies, no tracking. The implementations are written from the primitives and checked against an independent reference before they are published.
An animation that shows the wrong bytes teaches the wrong thing. Every implementation here is written in plain JavaScript, extracted from the published file, and tested against an independent implementation — a browser API, a reference library, or a published test-vector set — before it appears. The core is fenced in sentinel comments so the test harness runs the shipped code, never a copy.
Rotations, shifts, S-boxes and field arithmetic are shown as the bits they are, with wrapped and discarded bits coloured, so "linear over GF(2)" stops being a phrase and becomes something you can see. Each step carries the standard's own section reference.
RC4 carries the keystream bias that broke WEP. Diffie–Hellman carries the man-in-the-middle it cannot stop by itself. RSA carries what textbook RSA gets wrong. Cryptography is learned faster when the failure is next to the mechanism.
Every step is linkable (#step=42), the prose collapses to
maths-only for a lecture, pages print, and every step ends with a question a student can answer before moving on.
One-way functions: how a message of any length becomes a fixed-size fingerprint, and what breaks when the construction is wrong.
Padding, the message schedule and all 64 compression rounds, with the modular wraparound made visible.
The sponge construction, step by step: absorb, permute, squeeze — and why NIST chose a different shape.
Why hashing the key twice defeats length extension, and why a fast hash is the wrong tool for passwords.
Symmetric encryption: block ciphers, stream ciphers, and the difference between confidentiality and integrity.
The full AES-128/192/256 walkthrough: S-box, ShiftRows, MixColumns, key schedule, and every round key.
A 30-line stream cipher, its KSA and PRGA traced byte by byte — plus the biases that ended it.
The modern stream cipher: an ARX quarter-round you can check by hand, with a MAC that is an AEAD.
CBC, CTR, GCM — and a live padding oracle that recovers plaintext from error messages alone.
Secrets that can be agreed in public, and the number theory that makes them work — with the attacks that come from getting the details wrong.
Watch two parties compute the same secret from opposite ends of a modular exponentiation.
Key generation with real big integers, then encryption, decryption and signing — and what textbook RSA gets wrong.
Point addition over a small curve, drawn, then the discrete log problem that carries today's key exchange.
Where the primitives get assembled — and where most real-world failures actually happen.
An executable handshake that reproduces RFC 8448's published trace byte for byte: real X25519, the real HKDF key schedule, real AES-GCM records.
The handshake TLS 1.3 deliberately deleted — including a working padding oracle that recovers plaintext one byte at a time from padding-valid / padding-invalid alone.
The four-way handshake with real MICs, plus the two attacks that ended the PSK era.
Dragonfly on real P-256 arithmetic: hunting-and-pecking, the commit exchange, and why an attacker cannot test a single password guess offline.
The failure mode of a teaching animation is showing a plausible number that is wrong. So each page's implementation is checked in two independent ways before it ships.
CORE-START /
CORE-END markers; a harness lifts that exact text out of the published file and runs it against a
reference implementation over known vectors, boundary lengths and random inputs.| Page | Core implemented from scratch | Independent check | Vectors |
|---|---|---|---|
| SHA-256 | Padding, schedule, 64 rounds, feed-forward | WebCrypto crypto.subtle | 51 (empty, "abc", 55/56, 63/64, 119/120, 1000 B, random binary, non-ASCII) |
| AES | S-box from GF(2⁸) inversion + affine map, ShiftRows, MixColumns, key schedule | Node aes-128/192/256-ecb; in-page WebCrypto AES-CBC with a zero IV (browsers expose no raw ECB) | FIPS 197 C.1/C.2/C.3 + Appendix B, then 90 random key/plaintext pairs across all three key sizes |
| RC4 | KSA and PRGA, keystream and XOR | RFC 6229 §2 published keystreams, plus a separately written RC4 that must also reproduce them | 19 vectors including offsets 16/240/256 (the first 512 bytes of the stream), then 200 random key/message round trips |
| Diffie–Hellman | Square-and-multiply modular exponentiation on BigInt | Python's built-in pow() — an independent big-integer implementation | 28 groups: teaching primes, a 64-bit safe prime, a smooth-order prime, the RFC 7919 ffdhe2048 group, plus 25 random groups |
| RSA | Key generation, extended Euclid (Bézout table), square-and-multiply, CRT, integer roots, a from-scratch SHA-256 | Python's pow() and hashlib.sha256 | n, φ(n), λ(n), e·d ≡ 1 (mod φ and mod λ), c, m, the signature, and the digest re-derived from the message bytes |
| TLS 1.3 | The RFC 8446 key schedule and record layer, and X25519 written out from RFC 7748's ladder | RFC 8448 §3 — the IETF's own worked handshake trace, extracted from the RFC text by a script rather than transcribed | 31 published values: every secret, traffic key, IV, Finished MAC and transcript hash, plus the SHA-256 of three encrypted records |
| TLS 1.2 | The RFC 5246 §5 PRF, the master-secret and key-expansion schedule, RSA key transport, CBC with MAC-then-encrypt, and a real padding oracle | An independent Python implementation of the RFC's P_hash, plus the oracle's own output | The PRF output, master secret and key_block recomputed byte for byte; the oracle must return the plaintext it was given, on fresh random inputs and a two-block record |
| WPA2 | PBKDF2 PMK, the 802.11i PRF-512, the KCK/KEK/TK split, four EAPOL frames and their MICs | Python's pbkdf2_hmac and an independent implementation of the PRF and the EAPOL MIC | Three published IEEE vectors for the PMK, the PTK, and every MIC — each recomputed from the definitions in Python |
| WPA3 / SAE | Hunting-and-pecking to a curve point, the commit/exchange/confirm exchange on P-256 | WebCrypto's own ECDH — the point arithmetic must agree with it — plus explicit negative cases | The password element on the curve, both sides agreeing on the shared secret and the confirm, and a wrong password failing to authenticate |
Every page has a Maths only switch that drops the prose and leaves
the computation, and a Full mode that keeps the plain-English explanation, the pitfall and the
check-yourself question. Steps are linkable, so you can put cryptography.education/aes/#step=57
in a slide and land on the exact round you want to talk about.
Pages are print-styled: controls are dropped, panels avoid breaking across pages, and collapsed questions print open. A worked walkthrough prints as a handout.
Each page's step questions work as reading checks. Deeper exercises that the pages set up naturally: