Zellio.io

Encryption Algorithm Simulator

Watch AES, SHA-256, RSA and Diffie-Hellman work, one step at a time.

Processed locally — nothing is uploaded

About Encryption Algorithm Simulator

The browser's own cryptography is the right thing to encrypt with and the wrong thing to learn from, because it takes a key and returns a result and shows nothing in between. These implementations do the opposite and expose every intermediate value, which also makes them unfit for protecting anything.

Four algorithms are laid open here. A block cipher turns sixteen bytes into sixteen other bytes through ten rounds of four operations, and each of those forty-odd states is shown as the grid the specification describes, with the bytes that changed picked out. A hash function grinds sixty-four rounds over eight working variables, and the table of them makes visible something a definition rarely conveys: only two of the eight are recomputed each round, and the rest merely shift along. The two number-theory constructions run on values small enough to check on paper.

Seeing the substitution table derived rather than printed is worth the visit on its own. It is usually presented as a magic square of 256 hex values to be copied into a source file, which invites the belief that the designers picked them by taste. They did not: each entry is the multiplicative inverse of its index in a finite field, followed by a fixed affine transformation, and both halves have a purpose — the inverse is highly non-linear, and the affine step removes the fixed points that a bare inverse would leave. This page computes the table from that definition at load, so what you see is the construction, not a transcription.

The two public-key pieces use deliberately tiny numbers. Multiplying two primes of two digits each gives a modulus a person can factor in their head, and that is the point: every step from the primes to the private exponent is arithmetic you can follow, and the only thing separating this from a real key is the size of the numbers. The key-agreement view makes the same trade, and shows the property that surprises people the first time — two parties end up holding the same number without either of them ever sending it, and a watcher who saw every message cannot compute it.

A warning belongs on the page and is repeated here. These implementations branch on secret data, allocate as they go and make no attempt at constant-time behaviour, so their timing leaks what they are working on. They have no padding scheme, no authentication, no nonce discipline and no key management. Textbook RSA, which is what the third view shows, is deterministic and therefore not safe for real messages even at a proper key size. Anything that needs to actually protect something belongs in the Text Encryptor, which calls the browser's audited implementation.

What makes the difference between a teaching implementation and a wrong one is testing against the published answers, which is how these are held in place. The block cipher reproduces the worked example in the federal standard, including its round keys and the intermediate states of the first round. The hash reproduces three published digests, including the empty message. The key agreement is checked to reach the same secret from both sides across a hundred pairs of private values. A change that broke any of them would fail the test suite before it reached this page.

Learn how this works

A Practical Guide to Everyday Developer Encoding & FormattingHow and when to use Base64, JSON formatting, hashing, JWTs, regex and cron — with free in-browser tools for each task.11 min read

Frequently asked questions

Can I encrypt something real with this?

No, and the page says so rather than hoping you notice. There is no padding, no authentication tag, no nonce handling and no protection against timing analysis, and the public-key views use numbers small enough to break by hand. Use the Text Encryptor for anything that matters; it uses the browser's own implementation with a proper key derivation.

Why does the last round of the block cipher skip an operation?

The column-mixing step is left out of the final round so that encryption and decryption have the same structure, which lets an implementation share code and hardware between the two directions. It costs nothing in security: mixing at the very end would be undone by the inverse operation anyway, since no further substitution follows it.

Where do the hash function's constants come from?

They are the fractional parts of the square roots of the first eight primes for the initial values, and of the cube roots of the first sixty-four primes for the round constants. Numbers chosen this way are called nothing-up-my-sleeve values: their derivation is public and obviously arbitrary, which is a defence against the suspicion that a constant was picked to hide a weakness. This page computes them rather than listing them.

Why are the RSA numbers so small?

So that every step is checkable. A real modulus is 2048 bits or more, which is a 617-digit number, and no worked example of that size teaches anything. The arithmetic is identical at both sizes: the difference is only that factoring a four-digit modulus takes a moment and factoring a real one takes longer than the universe has been running.

Is anything sent to a server?

No. Everything runs locally in your browser using standard web APIs — your text, files and inputs are never uploaded to a server, so the tool works even offline once the page has loaded.

Is it free?

Completely. There is no sign-up, no account, no watermark and no usage limit. The tool is supported by unobtrusive ads, not by selling or processing your data.

Pro Tips

  • →Change one hex digit of the plaintext and step through the rounds: by the third round almost every byte differs. That spreading is what the mixing operations exist to produce.
  • →Look at the substitution step alone and check one byte against the table in any reference. Matching it once is what turns the S-box from a mystery into a definition.
  • →In the hash view, watch which of the eight variables change each round. Six are last round's values shifted along, which explains why so many rounds are needed.
  • →Give the key agreement a larger prime and try to work out a secret from the public values alone. The difficulty grows out of reach fast, which is the entire security argument.
  • →Try an exponent that shares a factor with the totient in the RSA view: the page refuses it and says why, which is the condition the algorithm actually requires.

Common Use Cases

  • •Teaching a class or a colleague what a round of a block cipher does, with the state visible at each step.
  • •Checking your own implementation's intermediate values against a reference while debugging it.
  • •Preparing slides or notes that need the real numbers rather than a hand-waved diagram.
  • •Revising for an examination or an interview where the internals, not the API, are the subject.
  • •Settling a discussion about why textbook RSA is unsafe, with a deterministic ciphertext to point at.

How It Compares

Libraries and the browser's own cryptography do the real work and deliberately expose nothing, which is correct engineering and useless for learning. Diagrams in textbooks are static and stop at one example. Command-line tools will print intermediate values with the right flags, once you know which flags. What is unusual here is an implementation written to be watched, held to the published test vectors, that never asks you to install anything or to trust a page with a real key.

Related tools

Base64 Encode / DecodeConvert text or files to and from Base64 instantly in your browser.Code FormatterBeautify, minify and validate JSON, HTML, CSS, SQL, XML and YAML.Regex Tester & BuilderTest patterns against text and build common regex from presets.Slug / URL EncoderClean broken URLs or turn any title into a safe URL slug.