Live
Password Hashing
Why hashes can't be undone
A live PBKDF2-HMAC-SHA-256 demo, an avalanche-effect visualization, and a simulated stolen-database attack — all running in-browser via the Web Crypto API. Nothing leaves your tab.
Try itSecurity · Identity · Cryptography
Security Lab.
Small demos explaining the building blocks of identity, cryptography, and digital trust.
5 concepts · 4 live demos
Live
Zero-Knowledge Proofs
Prove the threshold. Hide the number.
Generate a real range-proof flow for age verification or balance verification. Commit, compute locally, verify — the private value never leaves your device.
Try itComing soon
Passkeys & WebAuthn
Authentication without shared secrets
A visual walkthrough of the WebAuthn registration and authentication ceremonies — public-key cryptography replacing passwords entirely.
Coming soonLive
XSS Defense Lab
How a saved comment, a link, or a URL fragment becomes code
An interactive simulation of Stored, Reflected, and DOM-based XSS, and the layered defenses — escaping, sanitization, CSP, Trusted Types, cookie hardening — that stop each one.
Try itLive
Agent Authority
A simple task. How much access?
Compare broad permissions, least privilege, and just-in-time approval. Test an out-of-scope action and watch a one-time grant get consumed after use. All integrations are simulated.
Try it