Agent A sender
Seals a message for B’s public key
1 Recipient key
Fingerprint of the key A will encrypt to (computed by A)
2 Message
Want a draft? The optional local AI can write one. You decide whether to use it.
3 Seal
| Step | Bytes | ms |
|---|
Live demo · runs entirely in this tab
Seal a message with ML-KEM-768, then try to break it.
Agent B makes a post-quantum key pair. Agent A uses B’s public key to seal your message. Then you change one bit, or use the wrong key, and watch B refuse it. It all runs in this tab, with no server and no account.
Four checks: key fingerprint, round trip, one-bit tamper, wrong key. Every result shown is computed live. Use two tabs or two browsers instead.
Test results
The report holds the public key, envelopes, timings and event log, but never a secret key. Your message text is not included either: only its length and SHA-256 hash.
Channel
Public. Anything here could be read or changed in transit.
A packet moves only after the real operation behind it has finished. The movement itself is a fixed animation, not a measured network time.
Packets 0
- Nothing has crossed the channel yet.
Packet
Event log 0
Public records only: sizes, timings and results. Never keys, shared secrets or message text.
Agent B recipient
Holds the only secret key
1 Key pair
Fingerprint of B’s public key (SHA-256)
- Public key
- Secret key
- Generated in
The secret key exists only in this tab’s memory, inside B’s worker. Refreshing or closing the tab destroys it, and envelopes sealed to it can then never be opened.
2 Inbox
| Step | Bytes | ms |
|---|
3 Try to break it
Live local AI optional
offA small language model can draft a message for Agent A or explain the latest result. It runs on your device. It never receives keys or shared secrets, and it plays no part in deciding whether decryption succeeded: those verdicts come from ordinary code and work without the model.
- Model
- SmolLM2-360M-Instruct (Apache-2.0), pinned revision
- Download
- About 275 MB with WebGPU, or about 390 MB on the CPU path, fetched once from huggingface.co and then cached by your browser
- Runtime
- Transformers.js with ONNX Runtime Web , served from this site
- Works best
- Desktop Chrome or Edge 113+ with WebGPU and about 1.5 GB of free memory. Other browsers fall back to the CPU (WebAssembly), which is much slower. Phones may run out of memory.
Draft a message for A
Explain the latest result
Ordinary code turns the public event log into a few plain facts about the latest attempt, and only those facts are sent. The exact prompt appears below the answer.
Exact prompt sent to the model
Before you rely on what you see
The trust assumption
Encryption protects a message only for whoever holds the private key matching the public key you used. An attacker’s key has a fingerprint too. Compare all 64 hex digits with B through a channel you already trust before you seal anything that matters.
What a pass shows
That this implementation encrypts and decrypts in your browser, and that the tested changes were detected with no plaintext released. Not that the system is secure in general, that any quantum attack was tried, or who sent a message: there is no sender authentication.
Audit status
ML-KEM comes from noble-post-quantum , which has not been independently audited and does not claim constant-time execution. LatticeLink is a research preview, not an audited secure messenger. Security model →