Terms of Service

By using this site you agree to these terms. If you don't agree, please don't use it. The site is run by privatekeys OU ("we") as an independent, non-commercial project. There are no accounts, so there is nothing to sign up for or cancel.

Everything here, including the Learn modules, Use Cases, Standards pages, slide decks, quizzes, Challenges, the Assess quiz and the migration checklist, is meant to explain concepts. None of it is professional security, legal, compliance or investment advice, and none of it replaces a real cryptographic inventory, a risk assessment or an audit by qualified people.

We try to trace every claim to a published standard, RFC or paper, listed in the Library. Content can still be wrong or out of date, and standards change. Where this site and the underlying specification disagree, the specification wins.

The Playground tools, code samples and worked examples are teaching aids. Don't use them, or keys, ciphertexts, PIN blocks, tokens or other values they produce, to protect real secrets, real payment data or real systems. In particular:

• The Payments tools run on a from-scratch 3DES implementation written for teaching. It is tested against published vectors but has not been reviewed for side channels or certified in any way.
• Two Payments tools are labeled illustrative because no public algorithm exists for them. Their output is not what a real card network or issuer would compute.
• Sample keys and test vectors shown on the site are public. Treat anything you see on a page as compromised.

For production systems, use a well-reviewed library or a certified module (for example one validated under FIPS 140-3) and follow your organization's own policies.

Playground operations run in your browser, mostly through the Web Crypto API that your browser provides. Keys and inputs you enter stay on your device. That also means the results depend on your browser, its version and its settings, which we don't control. A tool may behave differently, or not work at all, in some browsers.

A few features rely on services run by others, under their own terms:

• ANU quantum random numbers. If you choose "Fetch live bits" in Entropy Testing, the site's server asks the ANU Quantum Numbers API (or ANU's free legacy server) for random bytes and passes them back. This service may be slow, rate-limited, capped for the month or unavailable, and we can't promise it works. The bytes are for studying randomness tests, not for generating keys.
• Hosting and analytics. The site is hosted on Vercel and uses Vercel Web Analytics for anonymized, aggregated page views, as described on the About page.
• GitHub. Source code, issue reports, feedback and the community discussions live on GitHub, which has its own terms. Posting and replying go through giscus, which loads only when you choose to open it. The Community pages show the public discussions as read by the site's server from GitHub.
• Email. Messages sent with the Contact form are delivered to us by Resend, an email delivery service.
• AI answers. New questions in the discussions are sent to Anthropic's API, and the answer Claude writes is posted in the thread, marked as AI-written. AI answers are educational, like the rest of the site, can be wrong, and aren't professional advice.

Please don't try to use the /api/qrandom route outside the Entropy Testing tool, for example by scripting bulk requests. It has a shared monthly budget, and abuse can take it away from everyone.

Your theme, sidebar state, reading progress, quiz scores, solved Challenges, migration-checklist answers and bookmarks are kept in your browser's localStorage, and your chosen profile in a small cookie. They never reach our server, and we can't see, back up or restore them. Clearing site data, switching browsers or using a private window will lose them. The progress page lets you export a copy yourself, and you are responsible for keeping it.

You agree not to:

• use anything learned or produced here to access systems or data you aren't authorized to access;
• attack, overload, or try to disrupt the site, its server route or its hosting;
• scrape the site in a way that degrades it for other visitors;
• present the site's content as your own, or as endorsed by us, beyond what its license allows.
• post spam, abuse, personal data, secrets or real keys in the discussions.

We may hide, edit or remove discussion posts that break these rules or are off-topic, and block accounts that keep doing so.

The Challenges teach how real attacks work so you can recognize and prevent them. Only practice those techniques on the puzzles here or on systems you own or have written permission to test.

The source code is proprietary, with all rights reserved, and the written educational content under CC BY-NC-ND 4.0. The License section on the About page says exactly what each covers. Names and marks of standards bodies, companies and products mentioned on the site belong to their owners, and mentioning them doesn't mean they endorse this site.

The site links to standards, RFCs, papers, books and other sites. We don't control them and aren't responsible for their content, availability or terms. A link is a pointer to a source, not an endorsement.

The site, its content and its tools are provided "as is" and "as available", without warranties of any kind, express or implied, including accuracy, completeness, fitness for a particular purpose, security and non-infringement. We don't promise the site will be available, error-free or free of vulnerabilities.

To the fullest extent the law allows, we aren't liable for any loss or damage that comes from using or relying on the site, including lost or exposed data, security incidents, failed audits or business losses, even if we were told it could happen. Some jurisdictions don't allow certain limits on liability, so parts of this section may not apply to you.

We may change, add or remove content and tools at any time, and we may update these terms. When the terms change, the date at the top of this page changes and the Changelog notes it. Continuing to use the site after a change means you accept the updated terms.

These terms are governed by the laws of the Republic of Estonia, without regard to its conflict-of-law rules. If any part of these terms is found unenforceable, the rest still applies.

To reach us privately, use the Contact form. Public corrections and other reports go to the project's GitHub issues. Please don't post security-sensitive details publicly there.