Break it yourself

Decode a hex string directly into the flag — no cipher involved, just an encoding.

Another pure encoding — decode base64 back into the flag.

A message XORed with one repeated byte. There's a shortcut hiding in how every flag on this site starts.

Someone on the team still encrypts things the way Julius Caesar did. Read their message.

A polyalphabetic cipher that held its reputation for three centuries. It didn't survive the fourth.

A full substitution cipher — no repeating shift, no keyword. Every letter maps to a different letter, consistently.

This time the XOR key repeats instead of being a single byte. Does that actually help?

Two messages, encrypted under what should have been two different one-time keys.

A session cookie is encrypted with AES-CBC. You don't have the key. You don't need it.

A service encrypts short messages with RSA, e=3, and never bothers with padding. What could go wrong?

An engineer wanted RSA encryption without the performance cost. They found a way.

A flawed key generator picked two primes that are suspiciously close together. This is scriptable in a few lines.

A modulus small enough that "real" RSA security assumptions don't apply at all.

You've intercepted a Diffie-Hellman public value. Recover the private exponent behind it.

An active attacker swapped the generator before the exchange completed. The shared secret only has two possible values now.

A toy elliptic curve, a public key, and the private key that produced it — small enough to brute force by hand.

A token's wrapping key was also given decrypt rights. That single misconfiguration is enough to extract a key that was never supposed to leave.