CipherWeb

The ten are not variations on one theme — they fall into distinct families, and implementing them side by side is what makes the differences legible. Caesar, Vigenere and Gronsfeld are substitution: they replace characters. Rail Fence and Polybius are transposition: they keep the characters and move them. Morse and Huffman are encodings rather than ciphers at all — Huffman is compression, and including it honestly means labelling it as such.

Then there is the jump to Blowfish and RSA. One is a symmetric block cipher with a real key schedule and Feistel rounds; the other is asymmetric and rests on modular arithmetic with large numbers. Going from a Caesar shift to RSA in one project is the clearest way I have found to feel the gap between a puzzle and actual cryptography.

The point of the project was learning, and you cannot learn a key schedule by calling a function that has one. Writing Blowfish's subkey initialisation by hand, or getting RSA's modular exponentiation to behave, teaches you where the sharp edges are in a way that reading the Wikipedia article does not.

The interface uses Canvas to draw what transposition ciphers are doing, because Rail Fence in particular is far easier to understand as a picture of characters moving between rails than as a paragraph of prose.

Implementing these is exactly why I would never ship my own crypto in production. A textbook RSA implementation without proper padding is breakable, timing behaviour leaks information, and a key schedule with a subtle off-by-one still produces plausible-looking ciphertext that is simply wrong.

That is the useful outcome of the project, and the reason it belongs in this portfolio rather than in a drawer. It is where the instinct came from that shows up in everything else here — validate at the boundary, never trust the client, and be suspicious of code that looks correct because the output looks scrambled.