About
Classical cryptography, explained and grounded
Classical Crypto Today is a reference for the cryptography actually running the internet right now — RSA, ECC, Diffie-Hellman, AES, SHA-2, TLS — the algorithms that post-quantum cryptography is set to replace. Understanding what's being replaced, and why, turns out to be the fastest way to understand what comes next.
Every claim on this site is meant to be checkable. Diagrams are computed from the real math, not hand-waved; Playground tools run your browser's actual Web Crypto API, not a simulation; and every module traces back to a real standard, RFC, or paper — listed in full in the Library.
What's here
Pick a persona — executive, GRC, developer, architect, IT ops, researcher, or curious — and get a reading path tailored to it. Nothing is hidden from anyone; a persona just reorders what you see first.
Learn →26 modules, from the history of cryptography through RSA, ECC, AES, TLS, and the post-quantum threat, each with diagrams, worked examples, and real formulas.
Use Cases →9 deep dives into how those primitives combine in production — envelope encryption, key wrapping, running a PKI, OAuth2/OIDC/SAML — each linking back to Learn instead of re-explaining the math.
Standards →5 pages on the standardization bodies themselves — NIST, the IETF, ISO/IEC, and OASIS — how each actually works, what it's published, and where the real reference document lives.
Playground →21 tools that run real cryptography in your browser via the Web Crypto API — AES-GCM, RSA-OAEP, ECDSA, X3DH, and more. Nothing is simulated, and nothing leaves your browser.
Challenges →17 CryptoHack/Cryptopals-style puzzles — recover a hidden flag by breaking a classical cipher, an XOR mistake, or a flawed RSA/Diffie-Hellman setup. Checked and tracked entirely in your browser, with no accounts or leaderboard.
Navigate →Every module, tool, and category as a single connected graph, for when you'd rather explore by clicking around than by reading a list.
Compare →Side-by-side cheat sheets — RSA vs. ECC vs. Diffie-Hellman, AES modes, hash functions — for when you already know the material and just need the numbers.
Glossary →125 terms used across the site, defined plainly and linked back to the module that covers each one in depth.
Library →78 standards, RFCs, papers, sites, and books this site draws from and points toward — searchable and filterable by type in one place.
Checklist →A practical PQC-migration inventory for GRC and architecture teams — not a compliance audit, a starting point.
Quizzes →Every knowledge check on the site in one list — 40 quizzes across every Learn module, Use Case, and Standards body, with an explanation for every answer.
Assess →Eight questions about what you actually run today, mapped to a prioritized reading list.
What this deliberately isn't
This isn't a compliance tool, a certification body, or a vendor evaluation platform — the Assess quiz and migration checklist are explicitly starting points for a conversation, not a substitute for a real cryptographic inventory or an audit.
There's no scoring or trust-rating system for the content itself, no login, no tracking of what you read, and nothing you type into a Playground tool or the checklist is ever sent to a server — the checklist saves to your browser's local storage only, and every cryptographic operation runs entirely client-side.
Disclaimer
Classical Crypto Today is an independent, single-maintainer educational project. It has not received endorsement from NIST, IETF, Signal, or any other organization, standards body, or individual referenced in its content.
All information is sourced from publicly available standards, RFCs, and papers — listed in full in the Library — and cross-checked against them during writing. Despite that effort, the content may still contain inaccuracies; where this site and the underlying specification disagree, treat the specification as authoritative.
The explanatory text was drafted with Claude (Anthropic), synthesizing those sources rather than quoting them. If you spot an error, please open an issue on GitHub — see the Changelog for how corrections get published.
Data privacy
Classical Crypto Today is a static site — there is no backend server, no database, and no user accounts.
- No personal data collection — no names, emails, or form submissions. There are no forms anywhere on this site.
- Local-only persistence — your theme preference, sidebar state, and migration-checklist progress live in your browser's localStorage only. None of it ever leaves your device.
- Client-side cryptography — every Playground operation runs entirely in your browser via the Web Crypto API. No keys, plaintexts, or ciphertexts are ever transmitted, because there's no server to send them to.
- The only third-party data flow is Vercel Web Analytics, which records anonymized, aggregated page views to show which modules people actually read. It doesn't use cookies, identifies visits with a hash that's discarded after 24 hours, and can't track you across other sites or identify you individually.
- Full transparency — the entire source code, including this policy, is public on GitHub.
Software Bill of Materials (SBOM)
0 known vulnerabilities
Across all 447 dependencies (25 production, the rest dev-only), per npm audit — verified 2026-09-24, and re-checked automatically by CI on every push via the workflow linked below.
Runtime dependencies
- Next.js 16, React 19, React DOM 19 — the application framework
- KaTeX — renders every formula on the site from hardcoded LaTeX strings
- d3-force — computes node positions for the Navigate graph
- @vercel/analytics — the cookieless page-view analytics described above
Deliberately not a dependency
No cryptography library. Every Playground tool calls the browser's own Web Crypto API directly — nothing simulated, nothing third-party standing between you and the actual algorithm.
Security posture, checked against this codebase
dangerouslySetInnerHTMLappears in exactly two places: the theme-switch script (a fixed string, no user input) and KaTeX rendering (compiled from this site's own hardcoded formulas, never from anything a visitor types) — neither is reachable by user-supplied data- No
eval()and no directinnerHTMLassignment anywhere in the codebase - No hardcoded secrets or API keys — the demo values in the HMAC and JWT Playground tools are placeholders meant to be edited by you, and never leave your browser
- Every external link uses
rel="noopener noreferrer" - A GitHub Actions workflow lints, builds, and runs
npm audit --audit-level=highon every push and pull request
License
The site's source code — everything under src/, config files, and build tooling — is released under the MIT License: free to use, copy, modify, and redistribute, with no warranty.
The written educational content — Learn module text, diagrams, glossary definitions, comparison tables, and quiz questions — is licensed separately, under Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 (CC BY-NC-ND 4.0): you can share it non-commercially with attribution, but not modify or resell it without permission.
Change control
See every dated update →Nothing on this site changes silently — the Changelog lists every published update, most recent first.