Like rewriting the same address in a different alphabet. Anyone who knows the format can reverse it. No secret required.
BASE64
The fundamentals · free and interactive
Encryption is not magic.
It is a small set of ideas about messages, locks, fingerprints, and who holds the keys. Learn those ideas by changing real data and watching what happens.
01 · DEVICE APLAINTEXTkey stays here
PROTECT
VOF302 · SERVICECIPHERTEXTstore / relay only
VOF3OPEN03 · DEVICE BPLAINTEXTmatching key here
KEY Akeys exist only at readable endpointsKEY A
01 / DATA
A computer sees numbers.
You see letters, images, and sound. A computer stores all of them as bytes: small numbers from 0 to 255. A shared rule such as UTF-8 says which numbers represent which characters.
TEXThello
UTF-8 · HEX
68 65 6c 6c 6fUTF-8 · DECIMAL
104 101 108 108 111BYTE COUNT5
Think of it like sheet music.
The page is not the sound. It is a precise representation that another musician can turn back into the same sound. Bytes are the computer’s notation.
02 / THREE DIFFERENT JOBS
Same message. Different purpose.
Encoding, hashing, and encryption are often grouped together because their outputs look unfamiliar. They solve completely different problems.
Like a receipt for the exact message. Tiny changes produce a different fingerprint. The receipt does not contain the original.
SHA-256
One-way comparisonLike placing the message in a locked box. The output is unreadable until the correct key opens it.
EPHEMERAL 256-BIT KEY
Generating locally…REAL XCHACHA20-POLY1305
Encrypting locally…ENCODINGcompatibilityHASHINGcomparisonENCRYPTIONconfidentiality
03 / KEYS
The algorithm can be public. The key cannot.
Good encryption does not depend on hiding how the lock works. Everyone may inspect the lock. Security comes from the key being unpredictable and held by the right person.
ALICE
KEY A
MESSAGEOPEN
BOB
KEY A
Symmetric encryption uses the same secret key to lock and unlock. It is fast, but both sides need a safe way to get that secret.
ANY SENDER
BOB’S PUBLIC KEY
DROP SLOTEMPTY
ONLY BOB
BOB’S PRIVATE KEY
A public key is like an open padlock anyone may snap shut around a box. The matching private key is the only thing that opens it.
Public does not mean powerless.
A public key is designed to be shared. A private key is designed never to be shared. The two have different jobs.
04 / END TO END
Put the keys at the ends.
End-to-end encryption means readable data exists at the communicating endpoints, but the systems carrying or storing it do not receive the key needed to read it.
ALICE’S DEVICEREADABLEholds a key
MESSAGE
SERVICECIPHERTEXT ONLYmoves and stores the locked box
BOB’S DEVICEWAITINGholds a key
SERVER RECEIVESCIPHERTEXT
SERVER MAY STORETHE SAME CIPHERTEXT
SERVER MUST NOTREQUEST OR LOG THE KEY
Alice protects the message before it leaves her device.
E2EE does not mean “nothing can ever go wrong.”
If an endpoint is compromised while the message is readable, encryption cannot make that endpoint trustworthy. It protects the path and storage boundary between trusted ends.
05 / INTEGRITY
A locked box needs a seal.
Confidentiality hides the contents. Integrity tells you whether the protected data was changed. Modern authenticated encryption provides both.
→
VOF3 ARTIFACT · HEX
Protecting locally…No byte changed.
GENERATING SEALA broken seal is not repaired.
The safe result is failure—not a best guess at what the message might have been.
06 / HUMAN SECRETS
A password is not automatically a key.
People create memorable passwords. Cryptography wants uniformly shaped key material. A key-derivation function combines a password, a random salt, and deliberate work to bridge that gap.
PASSWORD
+correct horseRANDOM SALT
+WORK
→50,000DERIVED KEY
Deriving automatically…Salt is not another password.
It may be stored beside the derivation record. Its job is to make identical passwords take different paths and defeat precomputed lookup tables. The work factor makes each guess cost more.
07 / RECOVERY
Recover the keys, not every file.
A well-designed system separates the recovery credential from the stable root, application keys, and data keys. Changing recovery should change the wrapper—not the identity of everything underneath.
RECOVERY CREDENTIAL
derivesWRAPPER 01 · ACTIVE
unwrapsSTABLE ROOT
NOTES KEY
PHOTOS KEY
MESSAGES KEY
Ready. The stable root and application keys do not need to change.
One rootstable account continuity
Separate app keysone app does not become every app
Many data keysrotation and deletion stay narrow
08 / THE REAL BOUNDARY
Encryption protects data—not every mistake.
A strong lock does not help if someone photographs the open document, steals the key, or convinces the owner to open the door. Security is the whole path around the primitive.
Compromised endpoints
Readable data and usable keys exist somewhere. Malware at that endpoint may observe them.
Logs and analytics
Plaintext copied into telemetry is outside the protection of the encrypted artifact.
Metadata
Encryption may hide content while timing, size, participants, or access patterns remain visible.
Authorization
Cryptography can prove integrity. Your application still decides who is allowed to perform an action.
Screenshots and cameras
Once information is shown to a person, the physical environment becomes part of the threat model.
Recovery custody
A recovery secret deserves the same care as the keys it can restore.
09 / PUT IT TOGETHER
Trace the whole custody boundary.
Readable data begins at an endpoint. A local key protects it. The service receives one authenticated artifact. The matching endpoint opens it. Every stage below exposes exactly what exists there.
Protecting locally…Waiting…EPHEMERAL KEY USED BY THIS LAB
Generating locally…Running the complete local round trip…
The service column never receives the key or plaintext in the end-to-end model.
Knowledge checkFour claims.
Four claims.
What is true?
Answer all four. The trace closes only when every boundary is correct.
0 / 4
Four boundaries left to verify.
Base64 encoding keeps a secret from anyone without a key.
A tiny message change should produce a different cryptographic hash.
In E2EE, the service can carry ciphertext without holding the key that reads it.
Rotating a recovery credential should require re-encrypting every file.
BOUNDARY TRACE COMPLETEYou can now identify what is readable, what is protected, who holds the key, and what must never be stored.Apply it in the Developer Lab →