Lab / In-Browser Cryptography

The Lab

Post-quantum cryptography isn't a slide deck. It's running on this page. Generate real ML-KEM and ML-DSA keys, swap secrets, forge a signature and watch it fail, then see how hash functions scramble input.

Everything runs locally. All keys, secrets, and hashes are computed in your browser with self-hosted, open-source noble libraries. Nothing is sent anywhere.
01 / FIPS 203

Post-Quantum Key Exchange

Alice and Bob want a shared secret that eavesdroppers can't recover, even with a future quantum computer. Classic key exchange (X25519, RSA) falls to Shor's algorithm. ML-KEM (formerly Kyber) is based on lattice problems that no known quantum algorithm solves efficiently. It's the NIST standard now shipping in TLS, Signal, and SSH.

1Alice generates a keypair

She publishes the public key. The secret key never leaves her device.

2Bob encapsulates a secret

Using only Alice's public key, Bob makes a fresh 32-byte shared secret and a ciphertext that wraps it. He sends Alice the ciphertext.

3Alice decapsulates

With her secret key, Alice opens the ciphertext and recovers the same 32 bytes. An eavesdropper who saw the public key and ciphertext gets nothing.

The trade-off: size

Post-quantum security costs bytes. Here's ML-KEM-768 next to classic X25519 (a fresh X25519 exchange also ran in your browser just now).

X25519 (classic)ML-KEM-768 (post-quantum)

Why we deploy both: production systems use a hybrid (X25519 + ML-KEM, as in Chrome's and Cloudflare's TLS). An attacker has to break both. You get quantum resistance without betting everything on a young algorithm.

02 / FIPS 204

Signatures You Can't Forge

ML-DSA (formerly Dilithium) is the post-quantum replacement for RSA and ECDSA signatures. Sign a message, then flip a single bit of the signature and watch verification fail.

03 / Hashes & KDFs

Hash & KDF Playground

Type anything. Each hash function turns it into a fixed-size fingerprint, and the smallest change gives a completely different one. Outputs update as you type.

Avalanche effect · SHA-256

We flip one bit of your input's last character and hash both versions. A good hash changes about half of its 256 output bits. Gold squares are the bits that flipped.

Argon2id · password hashing

Fast hashes are wrong for passwords because attackers can try billions per second. Argon2id is deliberately slow and memory-hard, so each guess costs real RAM and time. It hashes the input above in a background thread, in pure JavaScript (native code is several times faster).

Need this in production?

We design hybrid post-quantum migrations, key management, and audited crypto for web, Web3, and backend systems.