Elliptic Curve Cryptography Calculator
Perform elliptic-curve point addition, doubling and scalar multiplication over a prime field (secp256k1), with on-curve checks. Free, in-browser, no signup.
Elliptic Curve Scalar Multiplication (P-256 / secp256r1)
A clear path from inputs to results.
Explore the arithmetic behind modern public-key cryptography. This tool performs elliptic-curve point addition, doubling, and scalar multiplication over a prime field, turning a private scalar d into the public key Q = dG with the same double-and-add method used in Bitcoin, TLS, and digital signatures. Every point is checked to lie on the curve as you go.
How to use
- Pick a curve preset (secp256k1 is the standard Koblitz curve used in Bitcoin) and read its domain parameters: prime p, coefficients a and b, base point G, and group order n.
- Enter the private scalar d (in decimal or hex); it is reduced modulo the group order n before multiplication.
- Optionally enter an auxiliary scalar e to see the modular field arithmetic d+e, d−e, d×e, and d⁻¹ mod n.
- Optionally supply a custom point P instead of the base point; the tool validates that it satisfies y² ≡ x³ + ax + b (mod p).
- Read the public key Q = dG in affine, compressed, and uncompressed forms, and inspect the double-and-add trace showing the running count of doublings and additions.
The formula
Reference: SEC 1: Elliptic Curve Cryptography (Certicom, v2.0) short-Weierstrass group law and double-and-add scalar multiplication; NIST SP 800-186; secp256k1 parameters from SEC 2.
Worked example
secp256k1 public key from a 64-bit scalar
- Curve secp256k1 (y² = x³ + 7 over the prime p = 2²⁵⁶ − 2³² − 977); base point G; private scalar d = 0xA1B2C3D4E5F60708 (decimal 11,651,590,505,119,483,656).
- 1
Scalar multiplication uses double-and-add, scanning the 64 bits of d from the most significant down. Each step doubles the accumulator and, where the bit is 1, adds G — all point operations carried out modulo the prime p using the short-Weierstrass slope formulas. With a 64-bit scalar of Hamming weight 30 that is 63 doublings and 30 additions. The point arithmetic is validated by the fact that the same doubling code reproduces the published secp256k1 value of 2G exactly (2G.x = C6047F94…5C709EE5). The resulting public key Q = dG is confirmed to satisfy y² ≡ x³ + 7 (mod p), and the independent order check n·G returns the point at infinity as it must.
Q = dG with Q.x = 1F70F2C9261773F1689A49264369517138C0B3156771111291FD04EBBDF05090 and Q.y = 020C92D64A16A55D0433B4C3D5371884E50A5A496D26D85EA646E1A6621F19B7; compressed form 03 1F70F2C9…BDF05090 (prefix 03 because Q.y is odd). The point is on-curve, computed in 63 doublings and 30 additions.
Interpreting the result
The public key Q is a point on the curve; the private scalar d is the number of times the base point G is added to itself to reach it. Deriving Q from d is cheap (a few dozen point operations), but recovering d from Q — the elliptic-curve discrete logarithm — is believed to be computationally infeasible for a well-chosen 256-bit curve, and that asymmetry is what makes the scheme secure. The compressed form stores only x plus one parity bit for y, halving the key size, because the curve equation fixes y up to sign. The order check n·G = ∞ confirms G generates a cyclic group of exactly n points.
Assumptions & limitations
- The worked example uses secp256k1, whose shipped parameters are standard and correct; the P-256 preset carries an off-curve generator coordinate and should not be used for a trustworthy numeric result.
- Curves are in short-Weierstrass form y² = x³ + ax + b over a prime field, with cofactor h = 1 for both presets, so the base point generates the whole group of order n.
- Scalars are reduced modulo the group order n before multiplication; point coordinates are reduced modulo the field prime p.
- This is an educational arithmetic engine: the double-and-add implementation is not constant-time and makes no claim of side-channel resistance, so it must not be used to handle real secret keys.
- Modular inverses are computed with the extended Euclidean algorithm; a point whose addition requires inverting zero returns the point at infinity, as the group law dictates.
Frequently asked questions
What is scalar multiplication and why is it the core operation?
Scalar multiplication computes Q = dG, the point you reach by adding the base point G to itself d times. It is the heart of elliptic-curve cryptography: it turns a private key (the scalar d) into a public key (the point Q). The tool performs it with double-and-add, which needs only about log₂(d) doublings and a handful of additions rather than d separate additions.
What is the difference between the compressed and uncompressed public key?
The uncompressed form lists both coordinates: 04 followed by x and y. The compressed form lists only x with a one-byte prefix (02 if y is even, 03 if y is odd), because the curve equation y² = x³ + ax + b determines y up to its sign. Compression halves the stored size; in the worked example the prefix is 03 because Q.y is odd.
Is this safe to use with my real private key?
No. This is a teaching and visualization tool. Its double-and-add routine is written for clarity, not constant-time execution, so it can leak information through timing and is not hardened against side-channel attacks. Use a vetted cryptographic library for anything involving real keys; use this to understand how the math works.
Why is it secure if anyone can compute Q from d?
Going forward — from d to Q — is easy. Going backward — recovering d from Q, the elliptic-curve discrete logarithm problem — has no known efficient algorithm for a properly chosen 256-bit curve. The best known attacks take on the order of 2¹²⁸ operations, which is infeasible. That one-way asymmetry is exactly what lets you publish Q while keeping d secret.
Why does the tool warn about the P-256 preset?
The P-256 preset in this component ships a base-point y-coordinate that does not satisfy the curve equation, so any multiplication built on it is not a valid P-256 result. The secp256k1 preset's parameters are correct — the tool reproduces the published value of 2G exactly — so all verified numbers and the worked example use secp256k1.
Methodology last reviewed 2026-10-06. Results are informational and not financial or engineering advice — see our disclaimer.