Math · numbers and secrets
Prime numbers and ciphers the atoms of arithmetic
A prime number is divisible only by 1 and by itself. Multiply such “atoms” together and you can build every whole number — in exactly one way. Run numbers through the sieve of Eratosthenes, spot the diagonal streaks in the Ulam spiral, do sums on a clock face, crack a Caesar cipher like a medieval codebreaker, and then build your own RSA key — the same idea that powers the padlock in your browser’s address bar today.
Laboratorium · sieve of Eratosthenes
Grid range
Click the smallest number not yet crossed out that is greater than 1 — the sieve will cross out all of its multiples. Or let the sieve run by itself.
Factor tree
—A molecule of prime atoms
Trial division for small divisors, the Miller–Rabin test and Pollard’s rho method for large ones (BigInt).
All divisors
Why isn’t 1 a prime? If it were, factorization wouldn’t be unique: 6 = 2 · 3 = 1 · 2 · 3 = 1 · 1 · 2 · 3… That’s why 1 is neither prime nor composite.
Laboratorium · the Ulam spiral and open puzzles
Spiral
Colors
Spiral center
Stanisław Ulam, a Polish mathematician working in the USA, supposedly drew this spiral in 1963 while bored during a long lecture. The streaks come from quadratic polynomials that often produce primes — but nobody can predict exactly where the next one will fall.
How densely do they grow?
The Goldbach conjecture
Every even number greater than 2 is the sum of two primes. Nobody has proved it — but computers have checked every even number up to 4 · 1018 (T. Oliveira e Silva, S. Herzog, S. Pardi, 2014; as of 2026).
Goldbach’s comet
Background prime counter
A segmented sieve in a separate thread (a Web Worker) counts every prime up to a billion and compares the result with the prime number theorem.
| x | π(x) | x / ln x | Li(x) | π(x) · ln x / x |
|---|
Counting pauses when you switch modes or browser tabs.
The record holder
The largest known prime (as of 2026) is 2136,279,841 − 1 — a Mersenne number with 41,024,320 digits. Luke Durant found it in October 2024 as part of GIMPS (the Great Internet Mersenne Prime Search), using graphics cards in the cloud. Printed in small type, it would fill about 14 thousand pages.
Lucas–Lehmer test for 2p − 1
Puzzles we are still scratching our heads over
Goldbach (1742)
In a letter to Euler, Christian Goldbach noticed that even numbers can be split into two primes. The bigger the number, the more ways there are (look at the comet) — and still no proof.
Twin primes
Pairs that differ by 2 (11 and 13, 41 and 43…). Are there infinitely many? Nobody knows. In 2013 Yitang Zhang proved that infinitely many pairs differ by less than 70 million; the Polymath project brought that bound down to 246.
The Riemann hypothesis (1859)
It tells us how far π(x) can stray from Li(x). It is one of the Clay Institute’s Millennium Prize Problems — a proof is worth a million dollars.
Laboratorium · modular arithmetic
Operation
Multiplication table mod 12
The clock in the calendar
Days of the week count modulo 7: every 7 days the same day comes back.
24-hour clock
Check digits — modulo catches typos
FAKE The examples are randomly generated and belong to nobody. Don’t type real data here — the page doesn’t save or send anything, but it’s a good habit. (PESEL is the Polish national ID number.)
Euclid’s algorithm — GCD
Gears — LCM
Laboratorium · Caesar, substitution and Vigenère ciphers
Alphabet
Frequency analysis attack
ciphertext intercepted from a messengerSlide until the tall bars (E, T, A, O, I, N) fall into place. In English the most common letters are E, T, A, O, I, N.
Substitution cipher — every letter has its stand-in
There are 26! ≈ 4.0 · 1026 keys, so trying them all is out of the question. But letter frequencies give the cipher away anyway. Under each ciphertext letter, type your guess for the plaintext letter hiding behind it (letters are sorted from most to least common).
The Vigenère cipher
Each letter of the key is a different Caesar shift. For about 300 years it was considered “le chiffre indéchiffrable” — the unbreakable cipher. (Latin alphabet; accented letters are converted to plain ones, e.g. ą → a.)
How Kasiski broke Vigenère
In 1863 Friedrich Kasiski noticed that identical pieces of text encrypted with the same piece of the key give identical pieces of ciphertext. The distances between the repeats are multiples of the key length — all you need is their GCD. After that, each column is just an ordinary Caesar cipher.
Enigma and three Poles
In December 1932 Marian Rejewski reconstructed the rotor wiring of the German Enigma using permutation theory. Together with Jerzy Różycki and Henryk Zygalski he went on to build “bombs” and perforated sheets. In July 1939, near Warsaw, they handed their knowledge over to the British and the French.
Encrypt something with Enigma in “Computer” →Laboratorium · public-key cryptography
1 · Two secret primes
2 · Message (A = 1 … Z = 26, space = 27)
The extended Euclidean algorithm: where does d come from?
We look for d such that e · d ≡ 1 (mod φ(n)). We divide with remainder as in Euclid’s algorithm and keep track of the coefficient t alongside.
| remainder r | quotient q | coefficient t |
|---|
Ciphertext letter by letter
| letter | m | c = me mod n | cd mod n |
|---|
A simplification: we encrypt each letter separately so you can see the arithmetic. A cipher like that could be broken by frequency analysis (same letter → same number). Real RSA encrypts large blocks with random padding (OAEP), and n is 2048 bits or more.
The race: factor n and you’ll know d
Anyone who knows p and q can compute d right away. RSA’s security rests on the fact that factoring a huge n takes absurdly long.
Digital signature
We swap the roles of the keys: Bob signs a hash of the message with his private key (s = hd mod n), and anyone can verify the signature with the public key (se mod n = h?).
Here the hash h is a toy checksum modulo n; real signatures use SHA-256 (the “Modern crypto” mode).
Diffie–Hellman: sharing a secret while Eve listens
Whitfield Diffie and Martin Hellman, 1976Paints are easy to mix but very hard to separate again — just as it is easy to compute ga mod p, but hard to recover a from the result (the discrete logarithm problem).
Alice
secret a = —sends A = ?
secret: ?
Eve is listening
sees p, g, A, B—
Bob
secret b = —sends B = ?
secret: ?
Laboratorium · the padlock in your browser
What happens when you see the padlock (TLS 1.3, simplified)
- Hello! The browser sends a list of the ciphers it supports and its half of the key exchange (like A in Diffie–Hellman).
- The server replies. The server sends back its half (B) and a certificate — proof of identity signed by a certificate authority.
- Checking the signature. The browser verifies the certificate’s digital signature and the server’s signature over the whole conversation.
- A shared key. Both sides compute the same secret — nobody ever sent it. From it they derive the key for a symmetric cipher (e.g. AES).
- Encrypted conversation. The page, passwords and forms now travel encrypted; an eavesdropper sees only noise.
Hash function — a fingerprint for text
SHA-256 turns any text into 256 bits (64 hexadecimal characters). You can’t rebuild the text from the fingerprint, and changing one letter flips roughly half the bits — that’s the avalanche effect. It’s computed locally in your browser (crypto.subtle); nothing is sent.
Passwords: hash, salt and strength
A well-run service doesn’t store your password, only its salted hash (with a random extra), computed with a deliberately slow function (bcrypt, scrypt, Argon2).
The password never leaves this page: it isn’t saved or sent. The rating works offline.
| attacker | guesses per second | time (average) |
|---|
Why salt?
Quantum computers and post-quantum cryptography
In 1994 Peter Shor described an algorithm that would let a large quantum computer factor numbers quickly — which would break RSA and Diffie–Hellman. Today’s quantum computers are far too small and too noisy for that, but ciphertexts can be recorded today and decrypted years from now.
That’s why in August 2024 the US agency NIST published the first post-quantum cryptography standards: FIPS 203 (ML-KEM, lattice-based key exchange), FIPS 204 (ML-DSA, lattice-based signatures) and FIPS 205 (SLH-DSA, hash-based signatures). In March 2025 the backup algorithm HQC was also selected for standardization. Browsers already combine classical key exchange with ML-KEM (as of 2026).
The quantum world →Symmetric vs. asymmetric ciphers
Symmetric (AES)
The same key locks and unlocks. Very fast — it carries the actual data.
Asymmetric (RSA, elliptic curves)
A key pair: the public key locks or verifies, the private key unlocks or signs. Slower — used to agree on a key and for signatures.
The padlock in your browser is both at once: an asymmetric “handshake”, then a fast symmetric cipher.
Timeline: from Euclid to the browser padlock
- c. 300 BCEuclid proves that there are infinitely many primes and describes the GCD algorithm.
- c. 240 BCEratosthenes — a sieve for finding primes (he also measured the Earth’s circumference).
- 1st c. BCJulius Caesar encrypts letters by shifting the alphabet by 3.
- 9th c.Al-Kindi describes letter frequency analysis — the first known attack on substitution ciphers.
- 1553 / 1586Bellaso and Vigenère — a polyalphabetic cipher with a key.
- 1640Fermat: ap−1 ≡ 1 (mod p). Euler (1736) proves and generalizes it.
- 1801Gauss, “Disquisitiones Arithmeticae” — congruences and clock arithmetic.
- 1863Kasiski publishes a method for breaking the Vigenère cipher.
- 1932Rejewski, Różycki, Zygalski break Enigma.
- 1963Stanisław Ulam draws the prime spiral.
- 1973 / 1976Clifford Cocks (at Britain’s GCHQ, classified until 1997) and, independently, Diffie and Hellman — public-key cryptography.
- 1977Rivest, Shamir, Adleman — RSA.
- 1994Peter Shor — a quantum factoring algorithm.
- 2001NIST publishes the SHA-2 family of hashes (including SHA-256).
- 2024NIST post-quantum cryptography standards; the record prime 2136,279,841 − 1.
MathThe atoms of arithmetic
Prime and composite numbers
A prime number is a natural number greater than 1 that has exactly two divisors: 1 and itself (2, 3, 5, 7, 11, 13…). The other numbers greater than 1 are composite numbers. The fundamental theorem of arithmetic says that every number greater than 1 can be written as a product of primes in exactly one way (up to the order of the factors) — like a molecule built from atoms.
The sieve of Eratosthenes and the square root
Write out the numbers 2…N, take the smallest one not yet crossed out, p (it is prime), and cross out its multiples, starting from p² — smaller multiples have a smaller divisor and are already gone. Once p² > N, we can stop: a composite number n ≤ N always has a prime divisor ≤ √n.
How many primes are there?
Infinitely many — as Euclid proved. The prime number theorem (Hadamard and de la Vallée Poussin, 1896) says that among numbers around x, roughly one in every ln x is prime. The logarithmic integral Li(x) approximates π(x) even better.
Clock arithmetic, GCD and LCM
Numbers that leave the same remainder when divided by m are congruent (that’s a congruence). On a dial with m positions, every nonzero number has an inverse if and only if m is prime. Fermat’s little theorem: if p is prime and p does not divide a, then ap−1 ≡ 1 (mod p). Euclid’s algorithm replaces the larger number with the remainder of the division until the remainder is 0 — the last nonzero remainder is the GCD.
RSA in five lines
The public key (n, e) is an open padlock that anyone can snap shut. The private key d opens it. Computing d requires φ(n), and that requires knowing p and q. It works thanks to Euler’s theorem: med ≡ m (mod n). A digital signature swaps the roles of the keys, and a hash function produces a short fingerprint, which is what gets signed.
Simplifications on this page
We do RSA with small numbers and letter by letter, without random padding — it’s a model for learning, not a secure cipher. Mixing paints in Diffie–Hellman is only a metaphor. The HTTPS diagram skips many steps of the TLS protocol. The password rating is an upper estimate of entropy: passwords people make up are usually much weaker. English letter frequencies are approximate (they depend on the kind of text). The RSA cracking-time chart is an order-of-magnitude extrapolation.
Did you know…?
- There are infinitely many primes. Euclid’s proof fits in a single sentence: multiply all the known primes together and add 1 — the result isn’t divisible by any of them, so it has a prime divisor that isn’t on the list.
- The Ulam spiral was supposedly invented out of boredom: in 1963 Stanisław Ulam was doodling numbers on grid paper during a long lecture and circled the primes. The diagonal streaks surprised even him.
- Polish mathematicians broke Enigma as early as 1932 — Marian Rejewski reconstructed its rotors by solving permutation equations, long before Enigma became famous during the war.
Challenges
- Sieve by handCross out every composite number up to 100 with the sieve, clicking the successive primes yourself.not completed
- Split into atomsFactor 1001 or any composite number with at least 6 digits.not completed
- Goldbach beyond a thousandFind, on your own, a prime p for which an even number greater than 1000 equals p + (another prime).not completed
- Crack CaesarIn the frequency analysis attack, line up the bars and read the puzzle.not completed
- A letter via RSAEncrypt a message with the public key and decrypt it with the private key.not completed
- A shared secretAgree on a shared secret with Bob using Diffie–Hellman, choosing your own secret numbers.not completed
Challenges check themselves. Progress is saved in this browser.
See also
The logarithm from “Functions” describes the density of primes (n / ln n), and the gears of a watch are LCM in practice.