椭圆曲线可视化演示
每个 ECDSA 密钥都可以归结为一个标量和一次不断重复的点加。这里，同样的运算在一个小到可以画出来的域上进行：选择曲线，做点加，拖动 k，看 kG 四处跳跃——然后了解为什么反向计算才是难点。
100% 本地运行——所有操作都在你的浏览器中完成，不会向任何服务器发送数据
足够大，点云不再像某种图案；又足够小，完整搜索只需几十步。它的 100 个点并不构成单个循环——这里任何生成元能产生的最长循环是 50。
F₉₇ 上的 y² = x³ + 2x + 3——全部点的分布图
点击任意一点，把它设为生成元 G。虚线是 y = p/2：每个点都有一个关于这条线镜像对称的伙伴点，这个伙伴点就是它的负元 −P。y = 0 的点位于最下面一行，没有伙伴点：每个这样的点都是自身的负元。
生成元与标量
1G = 1 × (0, 10)
(0, 10)
正向计算很容易：倍点-点加
没有人会把 G 自加 0 次来计算 1G。把 k 写成二进制，每一位只需一次倍点，每个值为 1 的位再做一次点加——这是所有 ECDSA 实现的基本思路，它们还会在此之上加入窗口法和常量时间处理。
反向计算才是难点
反向问题——已知 G 和 1G，求 k——就是椭圆曲线离散对数问题。在这么小的曲线上，它根本不成问题：沿着序列走一遍就行。
最后这个数字才是关键所在。一台每秒执行 10⁹ 次曲线运算的机器，即使有 10⁹ 台并行运行，也仍然需要大约 10¹³ 年——是当前宇宙年龄的几百倍。对于选择得当的曲线，目前还没有公开已知的更快的通用算法；ECDSA 密钥所依赖的正是这一假设，而不是公式本身有什么保密之处。
From the playground to a real key
Nothing changes between this page and a production key except the size of the numbers. secp256k1 — the curve behind Bitcoin and Ethereum — is y² = x³ + 7, the same equation as the mini-curve above, over a prime just under 2²⁵⁶ instead of 127. P-256, the curve in most TLS certificates and passkeys, is y² = x³ − 3x + b over a different 256-bit prime. Both have a published generator point G and a group order n of about 2²⁵⁶.
A key pair is exactly the two things the Scalar multiplication tab shows. The private key is the scalar k: a random integer in 1 … n − 1. The public key is the point kG: the generator added to itself k times, computed by the same double-and-add ladder, about 256 doublings and a couple of hundred additions. Publishing kG reveals nothing usable about k for the same reason the slider does not — the only known way back is to search, and the search space is the size of the group.
Signing adds one more scalar: a per-signature nonce, multiplied by G to produce r, with s tying the message hash and the private key together. That is why nonce handling is the sharp edge of ECDSA — the arithmetic on this page is unforgiving of a repeated random value. Generate real key pairs and signatures with the Test Vector Generator, or read how this compares with the factoring problem in ECDSA vs RSA.
How it works
The playground enumerates every solution of y² = x³ + ax + b modulo a small prime p by squaring each field element once and matching the results against the right-hand side — a few thousand operations, which is why the plot appears instantly and why the same approach is hopeless for a 256-bit prime. Point addition uses the standard chord-and-tangent formulas with a modular inverse computed by the extended Euclidean algorithm, and kG uses double-and-add, the same ladder a real signing routine walks.
Two sanity checks run on the arithmetic itself: the number of points found always lands inside the interval Hasse's theorem allows around p + 1, and the order of every point divides the group order, as Lagrange requires. The real-number tab draws the identical formulas with ordinary floating-point math, which is only ever a teaching aid — cryptography needs the exactness of integers modulo a prime. Everything is computed locally in your browser; the page makes no network requests and has no inputs worth keeping.