Crypto Playground

A cryptographic hash maps any input to a fixed-size digest, one-way and deterministically. Change a single bit of input and roughly half the output bits flip — the avalanche effect. Type below and watch MD5, SHA-1, SHA-256 and SHA-512 update live. MD5 and SHA-1 are shown as broken-by-example, not for real use.

CTF challenges love to wrap a flag in layers of encoding — Base64, hex, ROT13, single-byte XOR. None of it is secret; anyone can reverse it. This bench chains transforms so you can peel layers off (or stack them on).

Session 1 Q6–Q7: a substitution cipher falls to frequency analysis given ~50 characters. A Caesar cipher is the simplest case — only 26 keys. This breaker scores all 26 shifts by χ² distance from English letter frequencies and ranks the most-likely plaintext first. No key needed.

This is the correct way (Session 1 Q11): AES-256 in GCM mode, with the key stretched from your passphrase via PBKDF2 (100k iterations, SHA-256). A random salt and IV are generated per message and shown to you — they are not secret, but must never repeat. GCM also authenticates: flip one bit of ciphertext and decryption refuses (Q12's lesson, enforced).

When you run ssh-keygen -t ed25519 -f ~/demo_key, this is the maths you get. Ed25519 is a public-key signature scheme, not encryption: the private key signs, the public key verifies. That is exactly how SSH proves who you are without ever sending a password — the server holds your public key, you prove you hold the matching private one. Generate a keypair below, sign a message, then tamper with it and watch verification fail. The public key even renders as a real SHA256: fingerprint, identical to what ssh-keygen -lf prints.

⚠️ Always pass -f with a fresh filename. Bare ssh-keygen -t ed25519 targets the default ~/.ssh/id_ed25519 — if you already have one it prompts "Overwrite (y/n)?", and a reflexive y destroys your real key with no undo. This lab never touches your disk: the keypair below is generated in your browser and vanishes on reload.

Session 1 Q10's famous example, made real. The same image is encrypted with the same AES key twice — once in ECB (each 16-byte block encrypted independently) and once in CTR (a proper keystream mode). WebCrypto refuses to expose ECB precisely because it is unsafe, so this runs a hand-rolled AES-128 (verified against the FIPS-197 vectors). In ECB, identical plaintext blocks → identical ciphertext blocks, so the penguin's flat regions survive. CTR looks like noise.

Each challenge hides a flag of the form flag{...}. Solve it using the benches above, then submit. Your answer is hashed in your browser and compared to a stored SHA-256 — the plaintext flags are not in this file's source, so no peeking in view-source. Case- and whitespace-insensitive.