Encryption Playground
Learn how AES and RSA encryption works step by step. Visualize encryption process, key generation, and cipher operations. Interactive cryptography tutorial
AES encryption looks like magic — paste a key and plaintext, get ciphertext, paste the same key plus ciphertext, get plaintext back. The interesting questions are how it actually works: what does the substitution table do, what is "ShiftRows", what is "MixColumns", why does block-mode choice matter so much (ECB vs CBC vs GCM)? This playground steps through AES round-by-round with intermediate states, lets you visualize ECB's catastrophic pattern leakage, and contrasts symmetric vs asymmetric (RSA, ECDH) with the same plaintext.
The encryption families and what each is for
- Symmetric (AES, ChaCha20) — same key encrypts and decrypts. Fast, used for everything bulk. Both parties must have the secret key.
- Asymmetric (RSA, ECC, EdDSA) — different keys for encryption/decryption. Slow, used for key exchange and signatures. Allows sharing data with someone whose public key you have without sharing a secret.
- AEAD (Authenticated Encryption with Associated Data) — GCM, ChaCha20-Poly1305. Encryption + integrity in one operation. Modern standard; replaces "encrypt-then-MAC".
- Hash functions (SHA-256, SHA-3) — one-way. Used in signatures, integrity, password storage.
- Key derivation (PBKDF2, Argon2, scrypt) — turn a password into a key. Designed to be slow on purpose, to make brute force harder.
Working example: AES-256 step by step
Input
Plaintext: "ABCDEFGHIJKLMNOP" (16 bytes, one AES block) Key: 256-bit (32 random bytes)
Output
AES-256 has 14 rounds. Each round: 1. SubBytes — substitute each byte through an S-box (non-linear transformation). 2. ShiftRows — rotate rows by 0, 1, 2, 3 positions. 3. MixColumns — matrix multiply columns in GF(2^8). Skip on last round. 4. AddRoundKey — XOR with the round's derived key. State evolution (each 4×4 byte matrix): Input: 41 42 43 44 / 45 46 47 48 / 49 4A 4B 4C / 4D 4E 4F 50 After Round 0 (key XOR): looks scrambled but reversible After Round 7 (mid): indistinguishable from random bytes After Round 14: ciphertext, no patterns from input visible Decryption: apply the same operations in reverse order with inverse S-box, inverse ShiftRows, inverse MixColumns, and the round keys applied backward.
The "magic" of AES is the SubBytes step — a non-linear S-box that destroys linear relationships in the data. Without it, AES would be vulnerable to algebraic attacks. The S-box was designed by Rijmen and Daemen specifically to resist all known linear and differential attacks.
Block modes and why they catastrophically matter
- ECB (Electronic Codebook) — each block encrypted independently. Same plaintext block → same ciphertext block. Visible patterns in images (the famous "ECB Penguin" demo). NEVER use ECB for anything.
- CBC (Cipher Block Chaining) — each block XOR'd with previous ciphertext before encryption. No pattern leakage. BUT — vulnerable to padding-oracle attacks if not properly authenticated.
- CTR (Counter) — encrypt a counter and XOR with plaintext. No padding needed. Parallel-encryptable. Safe against pattern leakage. BUT — no integrity.
- GCM (Galois/Counter Mode) — CTR + GMAC authentication. Encrypted + integrity-protected. The modern default for new applications.
- OFB, CFB — older streaming modes. Mostly historical; CTR / GCM are preferred.
For modern code: use AES-GCM or ChaCha20-Poly1305. Both provide encryption + integrity in one step. Both are well-studied, widely supported, and fast.
When to use which primitive
- Encrypting a file before storage — AES-GCM (symmetric, fast). Derive key from password with Argon2id.
- Sending a message to someone whose public key you have — hybrid: generate random AES key, encrypt message with AES, encrypt AES key with their RSA / ECDH public key.
- Verifying a download — SHA-256 hash. Compare against published checksum.
- Signing a message so the recipient can verify it is from you — Ed25519 or ECDSA signature. NOT plain encryption.
- Storing passwords on a server — Argon2id hash, not encryption. If passwords are encrypted, they can be decrypted. Hashed passwords can only be verified.
- TLS — combines symmetric (AES-GCM bulk encryption), asymmetric (ECDH for key exchange, RSA/ECDSA for cert signatures), and hashing (HMAC-SHA256 for MAC).
When to reach for this tool
- You are learning cryptography and want hands-on demonstration of how encryption transforms data.
- You are debugging a crypto library issue and want to verify your implementation against a known-correct reference.
- You are explaining encryption concepts to non-cryptographers and want concrete visual examples.
- You are preparing for a security interview / certification and want to test your understanding of the operations.
What this tool will not do
- It will not generate production keys. The playground is educational; for real keys use a cryptographic library (Web Crypto API, libsodium, OpenSSL).
- It will not protect data in transit. Encrypting in this page and pasting result elsewhere is fine as a demo; for real secure transmission, use TLS with proper certificates.
- It will not implement every algorithm. Modern ciphers (AES, ChaCha20), hashes (SHA-256), and signatures (Ed25519, ECDSA) are covered. Niche/legacy (Twofish, Serpent, Salsa20) are not.
- It will not detect your implementation's vulnerabilities. Use this for understanding, then use vetted libraries in production code — never roll your own crypto.
Frequently asked questions
Why is "rolling your own crypto" bad?
Crypto has subtle attack surfaces (timing attacks, padding oracles, side channels, weak random number generators) that experienced cryptographers have built libraries to handle correctly. Self-implementations almost always introduce vulnerabilities that look harmless to non-experts but are exploitable. Use vetted libraries — Web Crypto, libsodium, OpenSSL, Bouncy Castle.
How does AES-GCM differ from AES-CBC?
GCM provides authenticated encryption (ciphertext is tampered → decryption fails with clear error). CBC provides only confidentiality (tampered ciphertext decrypts to garbage, which an attacker can use in padding-oracle attacks against improperly-deployed systems). Always prefer GCM for new code.
Is RSA still used for encryption?
Less than it was. Modern TLS uses ECDHE for key exchange (forward secrecy); RSA is mainly for certificate signatures. Direct RSA encryption of data is rare and discouraged — slow, size-limited, and easier to misuse than alternatives.
What does "256-bit AES" mean?
The encryption key is 256 bits (32 bytes). AES key size choices: 128, 192, 256. The "depth" of the algorithm (number of rounds) differs: AES-128 has 10 rounds, AES-256 has 14. Both are unbroken in 2026; 256 has extra margin for post-quantum considerations.
How fast is AES-GCM?
On modern x86 CPUs with AES-NI instructions: 1-5 GB/s per core. ARMv8 with Crypto Extensions: similar. Hardware-accelerated AES is essentially free on modern CPUs. ChaCha20 is competitive in software (good on phones without AES instructions).
What is "perfect forward secrecy"?
Property of key-exchange protocols where compromising long-term keys does not compromise past sessions. Modern TLS uses ephemeral DHE / ECDHE keys per session — each session has its own random key, deleted after use. Even if a CA signing key leaks, encrypted traffic from years ago remains protected.
Related tools
Encrypt and decrypt text with AES-256 encryption. Secure message encryption with password protection. Free online text encryptor/decryptor
Generate MD5, SHA-1, SHA-256, SHA-512 hashes from text or files. Verify file checksums. Free online hash calculator and checksum generator
Generate SSH key pairs (RSA, Ed25519) in your browser. Export in OpenSSH or PEM format. Secure client-side key generation. Free online SSH keygen tool
Analyze X.509 SSL/TLS certificates. View issuer, validity, SANs, certificate chain. Check SSL certificate details. Free online certificate decoder
Last updated · E-Utils editorial team