Classical cryptography, explained and grounded

Classical Crypto Today is a reference for the cryptography actually running the internet right now — RSA, ECC, Diffie-Hellman, AES, SHA-2, TLS — the algorithms that post-quantum cryptography is set to replace. Understanding what's being replaced, and why, turns out to be the fastest way to understand what comes next.

Every claim on this site is meant to be checkable. Diagrams are computed from the real math, not hand-waved; Playground tools run real algorithms, not a simulation, and the two that can't (because no card network has published one) are labeled illustrative; and every module traces back to a real standard, RFC, or paper — listed in full in the Library.

This isn't a compliance tool, a certification body, or a vendor evaluation platform — the Assess quiz and migration checklist are explicitly starting points for a conversation, not a substitute for a real cryptographic inventory or an audit.

There's no scoring or trust-rating system for the content itself, no login, no tracking of what you read, and nothing you type into a Playground tool or the checklist is ever sent to a server — the checklist saves to your browser's local storage only, and every cryptographic operation runs entirely client-side. The one network request a tool makes is Entropy Testing's optional fetch of random bits, described below.

Classical Crypto Today is an independent, single-maintainer educational project. It has not received endorsement from NIST, IETF, Signal, or any other organization, standards body, or individual referenced in its content.

All information is sourced from publicly available standards, RFCs, and papers — listed in full in the Library — and cross-checked against them during writing. Despite that effort, the content may still contain inaccuracies; where this site and the underlying specification disagree, treat the specification as authoritative.

The explanatory text was drafted with Claude (Anthropic), synthesizing those sources rather than quoting them. If you spot an error, please open an issue on GitHub — see the Changelog for how corrections get published.

Classical Crypto Today is almost entirely a static site: no database and no user accounts. Its server does only a few things: fetch random bits for the Entropy Testing tool, read the public community discussions, and send Contact form messages.

• No personal data collection — no accounts, no tracking, and nothing you type on this site is sent to its server, except what you choose to send with the Contact form.
• Local-only persistence — your theme preference, sidebar state, reading progress, quiz scores, solved Challenges, migration-checklist progress, and bookmarks live in your browser's localStorage only. None of it leaves your device unless you export it yourself on the progress page, which builds the file, code, or link in your browser and uploads nothing.
• Client-side cryptography — every Playground operation runs entirely in your browser, via the Web Crypto API or, for the Payments tools, the site's own 3DES code. No keys, plaintexts, or ciphertexts are ever transmitted.
• Live random bits, on request — if you choose "Fetch live bits" in Entropy Testing, the site's /api/qrandom route asks the ANU Quantum Numbers API (or, once the site's monthly quota there is used up, ANU's free legacy server) for a batch of random bytes and passes them back. The only thing sent is how many bits you asked for; your browser never contacts ANU directly, so ANU sees the site's server, not you.
• Contact form — if you send a message from the Contact page, your name (if you give one), email address, topic and message go from the site's server to our inbox through Resend, an email delivery service. We use them only to reply, and the site itself doesn't store them.
• Discussions, only when you open them — the discussion widget, at the bottom of Learn, Use Case and Standards pages and on the Community pages, is giscus, a widget for this site's public GitHub Discussions. It loads only after you click "Show discussion", "Reply or react" on a discussion, or "Continue" when asking a question; from then on giscus.app and GitHub see your IP address and browser details, and if you sign in through it, giscus keeps a session token in your browser's localStorage. Anything you post is public on GitHub, under GitHub's terms and privacy statement. Reading the discussions under Community doesn't load the widget: the site's server fetches them from GitHub and shows them without images, so your browser doesn't contact GitHub.
• AI answers — new questions in Discussions get a first answer from Claude. A GitHub Action sends the question, the thread's title and the relevant site pages to Anthropic's API, and posts the reply marked as AI-written. Your GitHub username isn't included. How it works.
• The only analytics is Vercel Web Analytics, which records anonymized, aggregated page views to show which modules people actually read. It doesn't use cookies, identifies visits with a hash that's discarded after 24 hours, and can't track you across other sites or identify you individually.
• Questions welcome — ask about this policy, or anything else, in the community discussions.

The site's source code — everything under src/, config files, and build tooling — is proprietary: all rights reserved by privatekeys OU. It isn't published, and it may not be copied or reused without permission.

The written educational content — Learn module text, diagrams, glossary definitions, comparison tables, and quiz questions — is licensed separately, under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 (CC BY-NC-ND 4.0): you can share it non-commercially with attribution, but not modify or resell it without permission.