Interactive demos
Both demos on this page run the exact construction from how it works — real SHA-256 keystreams and XOR, computed live via the browser’s Web Crypto API. Nothing here is precomputed or mocked.
Garble and evaluate an AND gate
- Garble the gate — generates six fresh random 128-bit wire labels and builds the 4-row garbled table, then shuffles it.
- Pick input bits and evaluate — the Evaluator XORs its keystream against all 4 shuffled rows and keeps the one whose last 128 bits are zero.
Ready.
Wire labels (128-bit, random — nothing about the bits reveals 0 vs 1)
Garbled table (4 rows garbled, then shuffled)
This is what the Garbler builds — the row order the Evaluator receives (below) has been randomly shuffled, so position leaks nothing.
Pick input bits
In a real protocol these labels would reach the Evaluator via Oblivious Transfer, not be picked from a dropdown — see why that's skipped here.
Evaluator tries all 4 rows, keeping the one with a zero tail
Try different input combinations and re-garble to see the labels and table contents change completely each time — nothing about a label or a ciphertext’s position reveals what it corresponds to.
Compare two 2-bit numbers
A single AND gate proves the construction — this shows it scales. Alice and Bob each pick a number from 0–3; the circuit below computes a > b using eleven chained AND/XOR/NOT gates (the “two millionaires” idea from what garbled circuits are, just very small numbers), without either input ever appearing anywhere except as an opaque wire label.
Ready.
11 garbled gates built — gt = (a₁ AND NOT b₁) OR (NOT(a₁ XOR b₁) AND (a₀ AND NOT b₀)), with each OR built from AND + NOT (De Morgan's law), so only AND/XOR/NOT gates are used, same as how it works. Each gate is an independent garbled table, exactly like the single AND-gate demo above — just eleven of them, chained so one gate's output label becomes the next gate's input label.
Evaluator works through the circuit gate by gate
Sources: implements the constructions derived on how it works.