GlassBox Dev

CryptoKit hands you a final hash or ciphertext and hides everything in between. GLASSBOX rebuilds each algorithm by hand so every intermediate value is visible, tappable, and provably correct against Apple's real implementation — then lets an on-device AI try to crack it, winning on the weak and drowning on the strong.

Honesty is a hard requirement. No screen ever fakes progress against strong crypto. Where AI or brute force cannot win, the app shows it failing and explains why. The hand-written teaching engine is checked byte-for-byte against Apple's real CryptoKit/Security output — if they ever disagree, a test fails.

WHAT YOU CAN DO
• Classical ciphers — Caesar, ROT13, Vigenère, XOR — with an on-device AI cracker that breaks them from ciphertext alone using real statistical cryptanalysis.
• Modern families rebuilt by hand and verified against the real thing: AES-128, ChaCha20, DES; SHA-256/512, SHA-1, MD5; RSA, ECC, X25519. Scrub AES through its 10 rounds, step RSA one exponent bit at a time, watch SHA-256 churn its state.
• The avalanche on camera: flip one input bit and about half the digest flips.
• Crack, Tamper, and Breach labs — a dictionary attack cracks weak passwords instantly while a real, device-timed Argon2id shows why strong hashing takes centuries.
• Labs of physics and math: a thermodynamic crack lab, a quantum threat layer (Shor/Grover verdicts + post-quantum survivors), an entropy forge that harvests real sensor noise, and Rosetta panels showing the same cipher in Swift, Python, and C++.
• The AI, honestly: a hand-written deep net genuinely learns a reduced-round distinguisher — then genuinely fails at full strength, forever. The flat line is the exhibit.
• Hermes — a persistent learner whose brain grows across sessions and syncs across your devices via iCloud.

PRIVACY
All cryptographic computation runs on your device; your inputs never leave it. The only network traffic is optional iCloud sync of the app's own learning data (in your private iCloud database) and anonymous crash/diagnostic reporting. No accounts, no ads, no tracking.