Signal Double Ratchet: Messenger Encryption

Send a Message

Auto-send messages

Auto-send speed 1.0×

Ratchet Actions

Session State

DH ratchet epoch

Msgs this epoch

Total messages

Root key gen

RK₀

✅ Forward-secret — every key is derived one-way and destroyed after use.

session started · RK₀

How it works

Signal-style messengers (Signal, WhatsApp, and others built on the protocol) protect each message with a fresh, unique key produced by the Double Ratchet algorithm — two interlocking key-derivation chains:

Symmetric-key ratchet (per message):
  CK_(i+1) = HMAC(CK_i, 0x01)   // next chain key
  MK_i     = HMAC(CK_i, 0x02)   // this message's key
  CK_i is deleted immediately after — a one-way hash
  cannot be run backward to recover MK_i or CK_(i-1)

DH ratchet (roughly every reply):
  dh_out       = DH(my_new_keypair, their_public_key)
  RK, CK_send  = HKDF(RK, dh_out)

Alice → Bob / Bob → Alice — advances that direction's symmetric-key chain and derives one new per-message key, shown as a node sliding around the helix.
New DH Ratchet Step — mimics both sides exchanging a fresh Diffie-Hellman public key (this happens roughly every reply in the real protocol) and mixes the shared secret into the root key, minting a brand-new chain key — shown as a gold marker.
Simulate Key Compromise — leaks the current chain key to an attacker. Because the hash chain is one-way, past message keys stay safe (forward secrecy) — but every future key in the same epoch can now be derived too (orange nodes), until the next DH step folds in fresh, attacker-unknown randomness and the session heals (post-compromise security).

This is why a stolen phone or a single leaked key window in a real messenger cannot decrypt your entire chat history, and why the conversation automatically recovers its secrecy after the next exchange.

Alice → Bob key Bob → Alice key DH ratchet step At risk (post-leak) Leaked key

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.