These are free, plain-language lessons on how security works: the cryptography that protects your messages and payments, and the ideas behind it. Each lesson is a single page you read from top to bottom, with interactive demos along the way, so you can see things work rather than take them on trust.
How the lessons work
Every lesson starts from something familiar and builds up one idea at a time. Most include at least one demo or quiz, and many let you act out a protocol yourself: mixing paint colours, playing the verifier outside a magic cave, or stealing keys from a messaging app and watching the conversation heal.
Wherever possible the demos use real cryptography rather than pictures of it. Your browser has a full cryptography toolkit built in, and the lessons use it to generate genuine keys, signatures and hashes. When a demo says a signature failed to verify, it really did fail.
Difficulty levels
Every lesson is marked with one of four levels.
| Level | What to expect |
|---|---|
| Beginner | No background needed. Everyday ideas and a little simple arithmetic. |
| Intermediate | Builds on the basics. Expect some modular arithmetic and protocols with several steps. |
| Advanced | Many moving parts. Easier if you've done the earlier lessons it links to. |
| Mind-Fuck | Ideas that sound impossible until you see them work, and sometimes afterwards too. Not necessarily harder to follow, but harder to stop thinking about. |
Where to start
The lessons can be read in any order, but the cryptography ones build on each other. If you're new, this order works well:
- Public-key cryptography Key pairs, encryption and signatures: the foundation for everything else.
- Diffie–Hellman and ECDHE How two strangers agree on a secret in public, and the version behind every HTTPS connection.
- The Double Ratchet and Certificates How messaging apps keep changing their keys, and how browsers know who they're talking to.
- Then the deep end Trusting Trust, zero-knowledge proofs, the millionaires' problem and post-quantum cryptography, in any order.
If you meet an unfamiliar term, the glossary has a short definition and links to the lessons that explain it.
Accuracy
Security is a field where small mistakes matter. Lessons are checked against the original papers, standards and specifications where possible, and the demos are tested to behave the way the real protocols do. Dates, figures and recommendations change over time, so lessons favour explaining why things work over listing what's current.
Who makes it
The lessons are made by Sam Tilling. You'll find more of Sam's work at tilling.io.