Pedersen Foundation

Interactive demos

Everything on this page computes real Pedersen commitments in your browser — the classic demos use the same 2048-bit safe-prime group as the homepage, and the binding sandbox uses a tiny toy group specifically so you can brute-force it yourself. Nothing here is a mock; open the page source if you want to check.

Commitment calculator

Commit to a message under either the classic multiplicative-group scheme or the modern elliptic-curve one (see Pedersen commitments for both formulas), then reveal and verify.

Deriving generators…

Hiding, visualized

The hiding proof says C’s distribution doesn’t depend on m at all. Here’s what that looks like in practice: eight commitments to the same message next to eight commitments to different messages. Each swatch’s color is taken directly from the low-order bits of the real commitment value — there is no separate “visualization” hash, just a slice of the actual number.

Deriving generators…

Row A — same message, m = 7, eight different random r

Row B — eight different messages (m = 0…7), fresh random r each

Each swatch's color comes directly from the low-order bits of a real commitment. If you can't tell Row A from Row B by eye, that's the point: the distribution of C doesn't depend on m at all.

Homomorphic addition

Commit to two messages separately, multiply the commitments together, then reveal the sum and check it against the product — without ever revealing either input on its own.

Deriving generators…

Binding sandbox

The binding proof shows that finding two different openings of the same commitment is exactly as hard as computing the discrete log of h base g. This sandbox uses a toy group small enough (p = 23, q = 11) to brute-force in your browser, so you can watch that reduction happen on real numbers instead of taking it on faith.

Deriving toy generators…

This uses a deliberately tiny group — p = 23, q = 11 — so a full brute-force search is instant. The real site uses a 2048-bit group where the identical search is intractable; only the size changes, not the math.

Sources: all demos on this page implement the formulas derived on the Pedersen commitments page; the classic group is the RFC 3526 2048-bit MODP Group 14 safe prime, and the elliptic-curve demo uses secp256k1 via the audited @noble/curves library.