COMPUTERS · ENCRYPTION · ACT 01

AES-128

Ten rounds of four steps turn your first 16 bytes into noise only the key can undo.

YOUR MESSAGE

Computed on this device. Nothing you type is sent or stored.

0/40

ROUND 0 · THE BLOCK

Your first 16 bytes, poured into a 4×4 grid column by column. Every step from here is reversible — that is what lets the right key unlock it.

block: 4174206c65617374204920747269656416 bytes
key: 00000000000000000000000000000000128 random bits, made in this browser
locked: 14bc0f60b2413a93e817165033ab420b
unlocked: "At least I tried"the inverse cipher, same key
key − 1 bit: 279fb82c5da373ec1a4692b6561e05e1one key bit wrong: noise

✓ FIPS-197 Appendix B, checked round by round
✓ FIPS-197 Appendix C.1, both directions
… asking your browser's own AES

This is one block. A real message is cut into blocks and run through a mode such as GCM, which also proves the text was not altered; using AES block by block on its own (ECB) leaks patterns. AES-128 has 2¹²⁸ ≈ 3.4 × 10³⁸ keys, and no attack known does meaningfully better than trying them. Chosen by NIST in 2000 from Joan Daemen and Vincent Rijmen's Rijndael; standardised as FIPS 197 in 2001.

where this comes fromsources

Computed, not drawn: AES-128, SHA-256, RSA, Diffie–Hellman and the LWE toy all run in this page's own code, and each is checked against the standard's published test vectors and your browser's WebCrypto. Your message never leaves the page and is never stored. Drawn: the paint, the hall, the camera moves, the lattice (a picture of the idea, not ML-KEM's lattice). Drag to turn, pinch or scroll to zoom, double-tap to reset.

Tags: FACT is measured or published; MODELLED is an estimate from a published model or from this browser's own timing; SPECULATION is a guess about the future.

NIST FIPS 197, Advanced Encryption Standard (2001; FIPS 197-upd1, 2023) — Appendix B and C.1 test vectorsNIST FIPS 180-4, Secure Hash Standard (2015) — SHA-256 and the 'abc' exampleRivest, Shamir & Adleman, CACM 21(2), 1978; RFC 8017 (PKCS #1 v2.2, OAEP)Diffie & Hellman, 'New Directions in Cryptography', IEEE Trans. Inf. Theory, 1976; RFC 7748 (X25519); RFC 8446 (TLS 1.3)Boudot et al., RSA-250 factorisation, Feb 2020; Kleinjung et al., 'Factorization of a 768-bit RSA modulus', CRYPTO 2010Shor, FOCS 1994; Grover, STOC 1996; Vandersypen et al., Nature 414:883, 2001Gidney & Ekerå, Quantum 5:433, 2021; Gidney, arXiv:2505.15917, 2025; Roetteler et al., ASIACRYPT 2017NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), 13 Aug 2024; NIST IR 8547 (draft), Nov 2024NSA CNSA 2.0, Sept 2022