Home▸Cybersecurity▸Timing Attack Lab: Cracking a Secret Through Response-Time Leaks

Timing Attack Lab

Interactive timing-attack simulator: watch a naive string comparison leak a secret byte-by-byte through response-time differences, and see how a constant-time comparison closes the side channel.

Cybersecurity3DModerate60 FPS

Details

CategoryCybersecurity

RenderingThree.js · WebGL

DifficultyModerate

Target FPS60

ControlsVulnerable / Constant-time comparison mode toggle switches the server's comparison algorithm; Start timing attack button runs the byte-by-byte crack automatically; Reset regenerates the secret and clears all measurements; attack-speed slider (1x-5x) controls how fast probes are sent.

Three.jsCybersecurityTiming AttackSide-ChannelCryptography

Related simulations

Digital Certificates: Chain of Trust3D PKI chain-of-trust simulator: click a certificate to animate signature validation from a…

Public-Key Exchange NetworkNodes exchange public keys and establish secure channels across the network — watch how key…

Adversarial ML Attacks: Evasion & Poisoning3D nearest-centroid classifier over a feature-space cube: run an evasion attack that… ⊞ All 217 in Cybersecurity →

A byte-by-byte visualization of a real cryptographic side-channel: a naive string comparison stops the instant it finds a mismatch, so guesses that share more correct leading bytes with the secret take a fraction longer to reject. The 3D bar chart measures a simulated round trip for every possible byte value at the current position — in vulnerable mode one bar consistently stands out and the attack locks it in; switch to constant-time comparison and the signal disappears into noise. Toggle between the two modes to see exactly why secret == guess is unsafe for anything security-sensitive, and why libraries ship a dedicated constant-time compare instead.

⚙ Under the hood

Watch a byte-by-byte timing side-channel attack unfold: a naive string comparison stops at the first mismatch, so a 3D bar chart of measured response times exposes one candidate byte at a time. Toggle constant-time comparison to see the timing signal collapse into noise and the attack fail.

Three.jsCybersecurityTiming AttackSide-ChannelCryptography

3D · Three.js / WebGL renderer · 60 FPS target · runs fully client-side, no install