Real cryptography, running in your browser

Hash any text live and watch the digest change completely when you edit a single character.

Compute a real HMAC-SHA256 over a message and secret, then see why changing even one bit of the message makes verification fail.

Derive a real key from a password with a tunable iteration count, and feel the cost difference between 1,000 and 600,000 iterations yourself.

Feed in a bit string by hand or pull live bits from a quantum random number generator, then see Shannon entropy alongside all ten NIST SP 800-90B non-IID min-entropy estimators, side by side.

Encrypt a real message with real AES-256-GCM, see the IV, ciphertext, and auth tag, then decrypt it back — or tamper with one byte and watch decryption fail.

Encrypt a card number, an SSN, or any string over a fixed alphabet into another string of the same length and alphabet with real FF1 (NIST SP 800-38G) on AES, see all ten Feistel rounds, and check the result against NIST's sample vectors.

Wrap a key under a key-encrypting key with real AES-KW, check the RFC 3394 answer, step through all 6·n AES operations, then flip one bit or use the wrong KEK and watch the integrity check fail.

Generate a real 2048-bit RSA key pair in your browser, encrypt a short message with the public key, and decrypt it with the private key.

Sign with real RSA-PSS, choose the salt length, then open the signature with the public key to see the encoded message, the recovered salt, and which check fails when you tamper with it.

Generate a real P-256 key pair, sign a message, verify it — then tamper with the message and watch verification reject it.

Sign with real Ed25519 in your browser, check the RFC 8032 test vector, see that signing twice gives the same signature, and watch verification reject a tampered message or a malleable S.

Simulate Alice and Bob generating independent key pairs and deriving the exact same shared secret — without ever transmitting it.

Generate a real KMS-style KEK, wrap a fresh DEK with it via RSA-OAEP, encrypt data locally, then unwrap and decrypt — plus a second panel wrapping a key with real AES Key Wrap (RFC 3394).

Build a real three-link chain of trust — root, intermediate, and leaf — each signed with real ECDSA, then tamper with the leaf and watch verification catch it.

Build the same real three-link ECDSA chain as the certificate chain builder, then revoke the intermediate and watch a mathematically perfect signature still get rejected.

Walk through an actual Cryptoki call sequence — login, generate a key pair, sign, and attempt to wrap a non-extractable private key — with real Web Crypto operations standing in for the hardware token.

Run a real ECDH exchange, feed it through real HKDF bound to a transcript hash, and use the result to AES-GCM-encrypt a record — the exact chain TLS 1.3 runs on every connection.

Build a real HMAC-signed JWT from your own claims, or paste one in to decode its header and payload and verify its signature.

Simulate Bob publishing a key bundle and going offline, then Alice computing a shared secret from it anyway — the mechanism behind Signal's first-message problem.

Build a real ISO-0 PIN block, encrypt it with real 3DES under a demo Terminal PIN Key, then translate it to a second key — the exact HSM operation a PIN performs at every hop between terminal and issuer.

Compute a real CVV1, CVV2, and iCVV from the same PAN, expiry, and Card Verification Key — watch all three diverge from one formula, purely because the service code input differs.

Play both sides of a chip transaction: derive a card's keys from an issuer master key, compute a real ARQC cryptogram, then watch the issuer independently re-derive everything and answer with an ARPC the card verifies on its own.

Build a real EMV 3DS 2.x AReq, watch the ACS decide frictionless vs. challenge, sign a real ARes as a JWS with ECDSA, then verify it — or tamper with it and watch the signature catch it.

See the shape of CAVV generation — PAN, ATC, amount, and ECI feeding a MAC-style construction — clearly labeled as representative, since no card network has ever published its real, proprietary algorithm.

Tokenize one PAN for two different merchants, see the tokens come out different and domain-bound, then try replaying one merchant's token at the other and watch the vault reject it.

Wrap a key in a real TR-31 key block (versions A, B, C, or D), see the derived encryption and MAC keys, then parse it back, or relabel its key usage and watch the MAC reject the swap.

Derive a PIN pad's initial key from a Base Derivation Key and its Key Serial Number, step the transaction counter, and watch every intermediate and working key appear, in both TDES DUKPT and AES DUKPT.