Getting Started and Security Fundamentals
Cryptology Monster provides cryptographic tools through a browser-based interface. This guide explains the general workflow and several important concepts.
Starting the Application
- Open Cryptology Monster in a compatible browser.
- Locate the tool selector.
- Choose the desired cryptographic operation.
- Enter the required data.
- Configure the available options.
- Execute the operation.
- Review or download the result.
Selecting a different tool replaces the controls displayed in the main tool area.
Application Requirements
The application relies primarily on JavaScript and browser APIs.
| Requirement | Purpose |
|---|---|
| JavaScript | Execute the application's functionality |
| Web Crypto API | Encryption, hashing, signatures, key generation |
| Secure Context | Access to supported cryptographic browser APIs |
| FileReader and Blob APIs | Read and download files |
| Clipboard API | Copy generated results |
| OpenPGP.js | PGP operations |
| QRCode.js | QR code generation |
| jsQR | QR code decoding |
OpenPGP.js and QR libraries are loaded dynamically when their respective tools are used.
Cryptography Fundamentals
Encryption
Encryption transforms readable information into ciphertext.
Decryption reverses the process using an appropriate cryptographic key.
Cryptology Monster uses AES-GCM for its native text and file encryption tools.
Hashing
Hashing produces a fixed-length digest representing input data.
Hashing is not reversible encryption.
For example, SHA-256 produces a 256-bit digest.
Encoding
Encoding changes the representation of information.
Base64 and Base32 are encoding formats, not encryption algorithms.
Anyone can decode correctly encoded data without a secret key.
Digital Signatures
Digital signatures allow a recipient to verify that a message was signed using the private key corresponding to a particular public key.
The trustworthiness of a signature also depends on verifying the signer's public-key identity.
Message Authentication
HMAC uses a shared secret to authenticate a message.
Unlike public-key signatures, the same secret is used by the communicating parties.
Symmetric and Asymmetric Cryptography
| Type | Examples | Key Model |
|---|---|---|
| Symmetric encryption | AES-GCM | Shared secret key |
| Asymmetric encryption | RSA-OAEP, OpenPGP encryption | Public and private keys |
| Digital signatures | Ed25519, OpenPGP signing | Private key signs; public key verifies |
| Message authentication | HMAC | Shared secret |
Encryption Key Management
When an encryption tool downloads a key file, preserve it securely.
For example:
encrypted.bin
key.binBoth files may be required to decrypt the original data.
Avoid storing private keys or secret passwords alongside protected information in publicly accessible locations.
Password-Based Encryption
Password mode derives an AES key from the supplied password.
Cryptology Monster uses PBKDF2-HMAC-SHA-256 with a randomly generated salt.
The derived key is not downloaded separately.
Instead, decryption recreates the key using the password and stored salt.
Important
The salt is not a password and does not need to be secret.
Its purpose is to make the password-derived key specific to the encrypted data.
Result Windows
Cryptology Monster presents many results in a modal dialog.
The dialog supports:
- Viewing result text
- Copying text
- Closing the result
- Dragging the dialog with mouse or touch input
Press Escape to close an open modal.
Clipboard operations may require browser permission.
Choosing the Right Tool
| Objective | Recommended Tool |
|---|---|
| Create a password | Password Generator |
| Encrypt a short message | Text Encryption |
| Encrypt an existing file | File Encryption |
| Check file integrity | Hash |
| Authenticate a message with a shared key | HMAC |
| Generate an RSA encryption keypair | RSA Keypair |
| Generate a signing keypair | Ed25519 Keypair |
| Exchange encrypted messages using public keys | PGP |
| Inspect JWT content | JWT Decoder |
| Verify an HMAC JWT signature | JWT Verification |
| Represent text in Base64 or Base32 | Encoding Tools |
| Share text through a QR code | QR Generator |
Security Recommendations
- Use strong, unique passwords.
- Preserve keys needed for future decryption.
- Verify public-key fingerprints independently.
- Avoid distributing private keys.
- Treat decoded JWT content as untrusted until verified.
- Test encryption and decryption before relying on the tools for important data.
- Confirm that downloads completed successfully.
Reminder: Cryptology Monster is a toolkit, not a replacement for a complete key-management system or a professional cryptographic security assessment.
Updated 9 days ago