🐍 Iron Serpent

Serpent-256-CTR · Argon2id · HMAC-SHA256 · encrypt-then-MAC

Encrypt and decrypt with a passphrase-derived key, then watch the block cipher's diffusion, its CTR keystream, and its security margin come apart under the hood.

Encrypt

Passphrase

Plaintext

What happens inside Encrypt (and where each output field comes from)

Passphrase the secret you type. Never stored, never sent.
Argon2id(passphrase, salt) a fresh random salt is drawn, then Argon2id (64 MiB, 3 passes) slowly stretches the passphrase into a 256-bit masterKey. The salt is saved so decryption can repeat this step.
HKDF(masterKey) splits the one masterKey into two independent keys — an encKey for the cipher and a separate macKey for the tag. Different jobs get different keys.
Serpent-256-CTR(encKey, nonce) a fresh random nonce seeds the counter; Serpent encrypts the counter to a keystream, XORed with your plaintext to make the ciphertext.
HMAC-SHA256(macKey, salt‖nonce‖ciphertext) authenticates everything above into the mac tag. Encrypt-then-MAC: the tag is computed over the ciphertext, so decryption can verify it before running Serpent.

The JSON output packs exactly these results: salt, nonce, ciphertext, and mac — everything decryption needs except your passphrase.

Why two keys? HKDF and key separation

Argon2id gives us one 256-bit masterKey. But the cipher and the MAC must never share a key — reusing one key for two different algorithms can let one leak the other. So HKDF fans that single masterKey out into two independent subkeys:

masterKey256-bit, from Argon2id encKeySerpent-256-CTR macKeyHMAC-SHA256

What if we reused one key for both? Encrypting and authenticating with the same key ties the two constructions together, and a weakness in how they interact can expose the key or forge tags. HKDF makes them cryptographically independent — the same reason you never reuse a password across accounts.

Output

Argon2id Parameters

Time cost: 3 iterations
Memory cost: 65,536 KiB (64 MiB)
Parallelism: 1
Output: 32 bytes (256-bit key)
Salt: 16 bytes (random per operation)

Decrypt

Passphrase

Encrypted Payload (JSON)

Decrypted Output

Start here: a 3-step path

This lab has one core interaction and several deeper exhibits. Do them in order and the whole scheme builds up piece by piece — no need to face it all at once.

1
Encrypt, then decrypt. Above, type a passphrase and a message, hit Encrypt, then Send this payload to Decrypt → and Decrypt. A green ✓ Authenticated badge means the round trip worked. Do this to unlock the next step.
2
Break it. The Tamper lab appears under Decrypt after the round trip. Flip one bit and watch the HMAC refuse to decrypt — this is why we verify before we decrypt.
3
See why each piece exists. The exhibits below open up the internals: inside Serpent’s 32 rounds, how a block cipher becomes a stream cipher, why a nonce must never repeat, and what "security margin" really measures.

Inside Serpent: the 32 rounds, step by step

The buttons above say "full 32 rounds," but those rounds have been a black box — until now. Serpent turns plaintext into ciphertext by repeating one recipe 32 times: mix in a round key → substitute every 4-bit group through an S-box (confusion) → shuffle the bits with a linear transform (diffusion). Step through one 128-bit block below and watch a single flipped input bit avalanche across the whole block. Every value shown is from a spec-accurate Serpent verified against the official AES test vectors.

Security Margin Visualization

How to read this — and how NOT to. The coloured prefix on each bar is the deepest round count that any published academic result has reached on a reduced-round version of the cipher. It is not a countdown to being broken. A reduced-round distinguisher on 12 of Serpent's 32 rounds does not mean the full cipher is "37% cracked" — every cipher shown here is unbroken at its full round count. The green remainder is the security margin: rounds that no public attack comes near. A wider margin is a hedge against future analysis, not a measure of how close today's cipher is to failing.

Avalanche Effect

Strict Avalanche Criterion: a single-bit change to the input of a strong block cipher should flip about half of the output bits. Encrypt one 128-bit block below, flip a single input bit, and watch how many of Serpent-256's 128 output bits change. A result near 50% is exactly what good diffusion looks like.
Why a public key here? This panel uses one fixed, published demo key — secrecy isn't the point. We're watching how the cipher scrambles bits, and that behaviour is identical no matter who knows the key. This is a single ECB block for illustration, not how you'd encrypt real data — the secure workflow is the Encrypt panel above, with a passphrase-derived key, a nonce, and a MAC.

CTR Mode: Block Cipher → Stream Cipher

How does a cipher that can only encrypt 16-byte blocks handle a message of any length? In CTR (Counter) mode, Serpent never encrypts your message at all. It encrypts a counter block — the nonce, then nonce+1, then nonce+2… — to produce a keystream, and the plaintext is simply XORed against it. Edit the message or nonce below and watch the keystream change. This is the exact construction the Encrypt panel above uses.

Performance Comparison

Note: Both ciphers execute every round of their full specification — Serpent-256-CTR runs all 32 rounds per block, AES-256-GCM runs all 14. AES-256-GCM benefits from hardware acceleration (AES-NI) via the Web Crypto API. Serpent-256-CTR runs in WebAssembly without hardware acceleration. This comparison reflects real-world browser throughput, not algorithmic speed.

Data size

Iterations

About Serpent

The Designers

Eli Biham — Technion, Israel Institute of Technology, Israel. Co-inventor of differential cryptanalysis (with Adi Shamir). Pioneer of block cipher analysis.
Ross Anderson — University of Cambridge, UK. Security engineering researcher. Contributed the overall architecture and design philosophy.
Lars Knudsen — Technical University of Denmark (DTU). Expert in integral and impossible differential cryptanalysis. Key contributor to the S-box design.

Israeli Cryptographic Lineage

Eli Biham studied under Adi Shamir (the "S" in RSA) at the Weizmann Institute. Together they developed differential cryptanalysis — the technique that broke DES and reshaped how every modern block cipher is designed. Biham brought this deep understanding of attack mechanisms to Serpent's design, building a cipher specifically resistant to the techniques he himself had pioneered.

AES Competition Outcome

In the AES competition (1997–2000), Serpent placed second to Rijndael. Rijndael received 86 votes to Serpent's 59. NIST's selection criteria weighted performance alongside security. Rijndael was faster with fewer rounds (10/12/14 vs 32), while Serpent prioritized a conservative security margin — using twice as many rounds as needed to block all known shortcut attacks at the time.