Encryption, without
the abstraction.
Make the moving parts visible: keys, ciphertext, signatures, certificates and common exam traps. Begin with a safe browser demo, then follow a guided ten-activity pathway.
Security depends on the question you ask.
Encryption keeps data confidential. Signatures support authenticity and integrity. Encoding changes representation, but does not keep a secret.
Can an outsider read it?
Use encryption with a protected key to keep message contents confidential.
Was the message changed?
Authenticated encryption or a verified signature can detect modification.
Who is on the other end?
Certificates and trusted validation bind a public key to an identity in a larger protocol.
Encrypt. Inspect. Recover.
This self-contained demonstration generates a temporary AES-GCM key in your browser. It does not send your input to Sec Guy. Use made-up text only.
Educational demo only. Do not enter real secrets.
Ten concepts. One clear route.
The current page has ten separate activities. The production redesign must preserve and re-test each working exercise while introducing a better index and corrected explanations.
Public and private keys
Explore what is shareable, what stays private, and why a key pair has two different jobs.
Symmetric encryption
Encrypt a sample message and compare plaintext with authenticated ciphertext.
Unlock the vault
Decrypt with the matching key and see what happens when the key is wrong.
Digital signatures
Connect a signed message to tamper detection and signer verification.
Base64 is not encryption
Decode text without a secret key and explain why encoding provides no confidentiality.
Steganography
See how a small change can hide data without making the carrier visibly different.
Diffie-Hellman
Follow the idea of agreeing on a shared secret over a public channel.
PKI and certificates
Map a public key to an identity through a certificate and a trusted issuer.
Patterns and block modes
See why repeated patterns make ECB unsuitable for most data.
Guessing and key strength
Compare small toy search spaces with the scale of real cryptographic keys.
Technical reference: NIST SP 800-38D and MDN Web Crypto. Preview exercise only; this does not replace the ten live activities yet.
Turn practice into proof.
Continue with hashing, command-line investigations, or a portfolio-ready project.
Explore Experience BuilderPublic and private keys
Practice with fictional data in your browser. No live accounts or systems are tested.
Open this lab on its own page →Loading the first activity…
Two keys. Different jobs.
Generate a temporary RSA key pair in your browser. Share the public key to receive a message; keep the private key to recover it.
Start this lab →Public and private keys
Asymmetric encryption helps solve key distribution. A public key can encrypt for its owner; only the matching private key decrypts. A key pair does not itself prove whose key it is.
Generate keys, encrypt a made-up message, then decrypt it. The private key never leaves this browser session.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
Which key may a sender use to encrypt a message for you?
One shared secret. One protected message.
Use a passphrase-derived AES-GCM key to encrypt a harmless sample and produce a portable training packet.
Start this lab →Symmetric encryption
Symmetric encryption uses the same key for encryption and decryption. AES-GCM also detects tampering. This lab derives a key from a training passphrase with PBKDF2; production applications need a reviewed key-management design.
Change the sample text if you like, encrypt it, and copy the packet into Lab 03 to test recovery.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
Packet contains the salt, IV and ciphertext—not the passphrase.
What must the recipient have to decrypt this packet?
The wrong key stays locked.
Decrypt the packet from Lab 02, or generate a self-contained sample here. Change the passphrase to see authenticated decryption fail.
Start this lab →Unlock the vault
AES-GCM decryption needs the correct key and an unmodified packet. Failure should be handled as a failure, not displayed as plausible plaintext.
Generate a sample packet, decrypt it with the shown training passphrase, then deliberately change one character and try again.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
A modified AES-GCM ciphertext should produce what result?
Sign it. Change it. Catch it.
Create a temporary RSA-PSS signing key, sign a training approval, and test what happens when the message changes.
Start this lab →Digital signatures
A signature is produced with a private signing key and checked with the corresponding public key. Verification supports integrity and signer authentication only when that public key is reliably bound to the signer.
Generate and sign the sample, verify it, then edit the message and verify again.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
What should happen if the signed message changes?
Readable again. No key required.
Encode a sample as Base64, then decode it without a password. The visual scramble is not confidentiality.
Start this lab →Base64 is not encryption
Base64 changes how bytes are represented so they can travel through text-friendly systems. Anyone who has the text can decode it.
Encode a made-up phrase and immediately decode it. Notice that no key was requested.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
What protects a Base64 string from a reader who intercepts it?
One bit. Almost no visible change.
Change the least significant bit of a color channel and compare the pixels. Concealment is not the same as encryption.
Start this lab →Steganography
A least-significant-bit demonstration can store a bit by changing a channel value from 200 to 201. Real image formats and processing may destroy that bit; this is a concept model.
Choose a bit, hide it in a blue-channel value, then reveal the stored bit.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
Does LSB steganography encrypt the hidden data?
Agree on a secret. Never send it.
Use browser ECDH to create two temporary key pairs and derive matching shared-secret fingerprints.
Start this lab →Diffie-Hellman
Alice and Bob exchange public keys, keep private keys local, and independently derive the same secret. Unauthenticated key exchange can still be intercepted by a man-in-the-middle.
Run the exchange and compare Alice’s and Bob’s derived fingerprints.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
Which material must remain private during ECDH?
A key is not an identity.
Review a simplified certificate display. Check the hostname, validity and trusted chain before deciding whether to trust it.
Start this lab →PKI and certificates
A real browser validates a certificate chain, hostname, time validity and policy details. This is a decision simulator, not an X.509 issuer or TLS validator.
For each of three cases, choose “Trust” or “Reject” and read the specific reason.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
- Visited host
- Certificate name
- Issuer chain
- Validity
Which certificate mismatch should stop a connection?
Same input. Different exposure.
Compare the repeated-block pattern ECB would reveal with actual browser AES-CBC output for repeated sample blocks.
Start this lab →Patterns and block modes
ECB independently transforms blocks, so identical plaintext blocks under one key produce identical ciphertext blocks. CBC chaining hides that simple equality pattern, but CBC alone does not authenticate data. Modern designs often use AES-GCM.
Run the comparison. Observe repeated labels on the ECB concept side and different ciphertext block prefixes on the CBC side.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.
Does CBC alone provide integrity/authentication?
Small spaces fall quickly.
Explore a bounded three-digit PIN search to see the difference between a short guessable secret and a large search space.
Start this lab →Guessing and key strength
This toy exercise is not a real password attack. Real account security depends on rate limiting, password hashing, MFA and server design. Cryptographic keys have different strength properties from human passwords.
Try a three-digit training PIN. Run a tiny dictionary list, then a bounded exhaustive search of 000–999.
Try it yourself.
Use fictional input only. Your learning actions run locally in this browser tab.