Interactive visualization of the Signal/Double Ratchet protocol. Step through key exchanges, ratchet advances, and message encryption.
This tool animates the Signal Protocol's two phases: the X3DH key agreement that seeds a shared root key, and the Double Ratchet that turns that root key into a fresh key for every message. You step through a conversation one message at a time and watch the sending and receiving chains advance, the counters that track them, and the header fields each message carries. The thing most people get wrong: messages do not each trigger a fresh Diffie-Hellman exchange. The DH ratchet rotates only when a message arrives carrying a ratchet public key you have not seen before, which happens only once traffic flows both ways.
A concrete input and expected output from the current implementation.
Input
After the X3DH key exchange completes, Bob sends message 1. Alice sends messages 2 and 3. Bob sends message 4.
Expected output
Bob's first message carries the header (ratchet key B0, Ns = 0, PN = 0) and his send counter reads 1. Alice derives her receiving chain to match Bob's sending chain and reads the message with key 0. Her two replies both carry her new ratchet key A1, with Ns = 0 then Ns = 1; on Bob's side, the first one rotates his ratchet (PN becomes 1, counters reset) and both decrypt from one chain. Bob's message 4 carries (B1, Ns = 0, PN = 1): the PN shows his previous chain advanced exactly one step, the one Alice already consumed, so nothing needs to be skipped.
These numbers follow the published algorithm: Ns counts messages sent on the current sending chain, PN is the sender's counter at its last ratchet rotation, and the receiving chain derived during a ratchet step is the same key material the peer used for sending, which is why the two sides can decrypt each other's messages.
Every message consumes one key from the sender's sending chain: a KDF turns the current chain key into a message key and also replaces the chain key itself, so each step forward is irreversible. The receiver runs the identical chain to reconstruct the message key. This is what delivers forward secrecy cheaply: a chain key leaked today cannot decrypt anything the chain produced before it.
The DH ratchet rotates the chains. When a message header carries an unfamiliar ratchet public key, you generate a fresh key pair: the new receiving chain is derived from your old private key and the peer's new public key, and the new sending chain from the fresh key. Counters reset; PN records how far the previous sending chain advanced, so the receiver can generate any keys it missed.
No. The values are placeholders chosen to make the mechanics visible, and everything runs locally in the page. The transitions follow the published algorithm faithfully, but none of it is real session material. Use the tool to learn the structure of the protocol; verify implementation details against the specification, not against what this page displays.
Because the DH ratchet advances only when you receive a header carrying a ratchet public key you have not seen. If you keep sending, your peer's key never changes, so your sending chain simply advances by one message key per message. That asymmetry is intentional: a one-way exchange stays cheap, and the keys rotate the moment traffic flows both ways.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.