Salsa20

Salsa20 is a stream cipher designed by Daniel Bernstein, built on ARX operations with 20 rounds; it is an eSTREAM-recommended algorithm and the predecessor of ChaCha20.

Purpose

It provides fast, constant-time-secure stream encryption, avoiding the padding and mode complexity of block ciphers.

Mechanism

The state is a 4×4 matrix (constant σ, key, nonce, counter). Each round applies the quarter-round (add-rotate-XOR) to every column and every row. After 20 rounds the state is added to the initial state to produce the keystream.

Use cases

eSTREAM recommended algorithm
The NaCl crypto library
Cryptography research
Teaching examples

Examples

Input
```
key=256bit, nonce=64bit
```
Output
```
keystream
```
ChaCha20 is its improved successor

Common errors

Using Salsa20 instead of the safer ChaCha20: Prefer ChaCha20-Poly1305

Related terms

ChaCha20 is a stream cipher designed by Daniel Bernstein, built on ARX (add-rotate-XOR) operations, and is commonly paired with Poly1305 as an AEAD — a high-performance alternative to AES-GCM.

The Advanced Encryption Standard (AES) is the symmetric block cipher NIST standardized in 2001, supporting 128/192/256-bit keys, and is the de facto standard of modern encryption.

A stream cipher encrypts byte by byte or bit by bit, XORing a keystream with the plaintext; it needs no padding and suits real-time and streaming data.

Related tools

Encrypt text or binary data with AES (CBC/GCM/ECB) using Web Crypto API. Free, private, and 100% client-side.

Salsa20 Encryptor

Encrypt text with the Salsa20 stream cipher (D. J. Bernstein's original design, eSTREAM portfolio) — a real algorithm verified against official eSTREAM test vectors and Salsa20 core specification vectors. 128/256-bit key (16 or 32 bytes), 64-bit nonce (8 bytes), 64-bit block counter. Free, private, and 100% client-side. Never reuse a nonce with the same key.

Salsa20 Decryptor

Decrypt Salsa20 ciphertext (Bernstein original design, eSTREAM portfolio) — a real algorithm verified against official eSTREAM test vectors. Key must be 16 or 32 bytes, nonce exactly 8 bytes, and the block counter must match the value used for encryption. Ciphertext input format follows the output format option (hex or base64). Free, private, and 100% client-side.

References