Diffie-Hellman calculator
Choose a prime modulus p, a generator g and the private numbers of Alice and Bob. The calculator shows the public values they send, the shared secret each of them computes, and whether g generates all values modulo p, so you can follow or check the exchange by hand.
Runs in your browser: nothing you enter is sent anywhere.
How to use it
- Enter a prime p and a base g between 2 and p − 2. These are public.
- Enter Alice’s private key a and Bob’s private key b, each between 1 and p − 2.
- Read the public values A and B, the two computations that give the same shared secret, and the order of g.
- Alice: A = gᵃ mod p, Bob: B = gᵇ mod p.
- Alice computes s = Bᵃ mod p, Bob computes s = Aᵇ mod p; both are gᵃᵇ mod p.
- The order of g is the smallest k > 0 with gᵏ ≡ 1 (mod p). It always divides p − 1 and is found from the prime factors of p − 1.
Worked example
p = 23, g = 5, a = 6, b = 15.
- A = 5⁶ mod 23 = 15,625 mod 23 = 8.
- B = 5¹⁵ mod 23 = 19.
- Alice: 19^6 mod 23 = 2. Bob: 8^15 mod 23 = 2. The shared secret is 2.
- The order of 5 modulo 23 is 22 = p − 1, so 5 is a primitive root.
With a = 4 and b = 3 instead, A = 4, B = 10 and the secret is 18, the example often used in textbooks.
Tips
- Choose g as a primitive root so the secret can be any of p − 1 values. Change g and watch the order row.
- Private keys stay private. Only p, g, A and B are sent; if a or b leaks, the secret is exposed.
- Check homework quickly: if Alice’s and Bob’s lines ever differ, one of the inputs is wrong, but with valid inputs they always match.
Frequently asked questions
How does the Diffie-Hellman key exchange work?
Both sides agree on a prime p and a base g in public. Alice picks a secret a and sends A = gᵃ mod p; Bob picks b and sends B = gᵇ mod p. Alice computes Bᵃ mod p and Bob computes Aᵇ mod p, and both equal gᵃᵇ mod p, the shared secret, which never crossed the network.
Why can't an eavesdropper find the secret?
They see p, g, A and B but not a or b. Recovering a from A = gᵃ mod p is the discrete logarithm problem, which has no known fast solution for large well-chosen primes. With the small numbers in this calculator it can be solved by trying every value.
What is a primitive root and why does it matter?
g is a primitive root modulo p when its powers produce every value from 1 to p − 1, that is, when its order is p − 1. For p = 23, g = 5 is a primitive root (order 22), while g = 2 has order 11 and only reaches half of the values, shrinking the space of possible secrets.
Does Diffie-Hellman authenticate the other side?
No. On its own it only agrees on a key. A man in the middle could run one exchange with each side. Protocols such as TLS sign the exchanged values with certificates to prevent this.