an interactive walk, no background required
Every time you see the padlock in your browser, two computers that have never met have just agreed on a secret code — while anyone on the network could be listening to every message they sent each other. That sounds impossible. How do you whisper across a crowded room?
The answer is a special kind of math operation: one that is easy to do but hopeless to undo. Think of mixing paint. Mixing blue into yellow is easy; un-mixing the green back into its two ingredients is not. If you have a mathematical version of paint-mixing, strangers can build a shared secret out in the open, and eavesdroppers are left holding a bucket of green.
Elliptic curve cryptography (ECC) is one such operation. This page builds it up from scratch: first a curve, then a strange rule for "adding" points on it, then a twist that turns that rule into a one-way street. Every picture below is live — drag things and see what happens.
Despite the name, an elliptic curve is not an ellipse. It is the set of points (x, y) that satisfy
y² = x³ + a·x + b
for some chosen numbers a and b. Move the sliders to change them. Sometimes the curve is a single sweep, sometimes it pinches off into an "egg" plus a tail.
Here is where it gets interesting. We are going to define a way to "add" two points on the curve and get a third point on the curve. The rule is geometric:
Drag P and Q anywhere along the curve.
Why the flip? Without it, the rule would not behave like addition. With it, everything works the way you'd hope: P + Q = Q + P, you can group additions however you like, and there is even a "zero".
What if the line is vertical? Drag Q to be the mirror image of P. The line shoots straight up and never comes back to the curve. We say it hits the point at infinity, and we call that point O. It behaves exactly like zero: P + O = P, and a point plus its mirror image is O.
What if P and Q are the same point? Tick the checkbox. There is no longer a unique line through "two" points, so we use the tangent line — the line that just grazes the curve at P. The result is P + P, which we write as 2P.
Once you can add, you can add repeatedly. Start at P, add P to get 2P, add P again to get 3P, and so on. Each hop is the same line-and-flip trick. We write k·P for "P added to itself k times".
Drag P to a new start. Use the slider to hop.
On a 12-hour clock, 10 + 5 is not 15 — it's 3. Numbers wrap around. Mathematicians call this arithmetic modulo 12, and you can do it with any modulus; cryptography uses a prime number, which we'll call p.
Now the twist: take the same curve equation, but only allow whole-number coordinates from 0 to p − 1, and check the equation on a clock of size p. The smooth curve shatters into a cloud of dots.
It looks like static, but it isn't random. Look for the mirror symmetry across the middle: the top half reflects the bottom half, just like the smooth curve, because −y on a clock is p − y.
Better still, the addition rule still works. There is no visible line any more, but the formula behind "draw a line, find the third point, flip" only uses adding, multiplying and dividing, and all of those work on a clock. So tap a dot to pick a starting point G, then hop.
Tap a dot to choose G.
From here on we'll fix the curve to y² = x³ + 7 over p = 97, with starting point G = (1, 28). (That's a toy cousin of the curve Bitcoin uses, which has the very same x³ + 7 but a 78-digit prime.) It has 79 points, and hopping from G visits every single one of them before wrapping back to O.
The computer has picked a secret number k and hopped that many times from G. It shows you where it landed: Q = k·G. Your job: figure out k. Move the slider to try candidates.
You found it, but only by trying values until one matched. There was no shortcut. With 79 points, that's fine; a computer would be done in a microsecond. Now scale it up.
Bitcoin's curve has this many points:
115 792 089 237 316 195 423 570 985 008 687 907 852 837 564 279 074 904 382 605 163 141 518 161 494 337
That's about 1077. The best known shortcut for this guessing game still needs roughly the square root of that many steps — around 1038. If every computer on Earth worked on it, the sun would burn out first.
But going forwards is cheap. To compute k·G you don't hop k times. You double: G, 2G, 4G, 8G… and add together the ones you need, following the binary digits of k. Your current guess would take . A 78-digit k takes about 400 hops. Trivial.
That asymmetry — hopping forward is easy, counting hops backward is impossible — is the paint-mixing trick. It's called the elliptic curve discrete logarithm problem, and everything else is built on it.
Alice and Bob want a shared secret. Eve is reading every message. Here's the protocol (it's called Elliptic Curve Diffie–Hellman, or ECDH):
Both of those are a·b·G — the same point. Eve saw G, A and B go by, but to get the shared point she'd need a or b, and that means solving the hop-counting problem from the last section.
Why curves rather than the older RSA system? Size. A 256-bit elliptic curve key is about as strong as a 3072-bit RSA key, so it's smaller, faster, and easier on phones and smart cards.
Plenty. Digital signatures (ECDSA, EdDSA) build on the same hop-counting problem. Choosing a curve is delicate: some curves have hidden shortcuts and are avoided. Real implementations must run in constant time so a spy can't measure how long the hops took. And a large quantum computer, if one is ever built, could count hops efficiently — which is why the field is quietly moving to "post-quantum" schemes. But the core idea you've now seen — easy to hop forward, impossible to count backward — is the heart of it.