Introduction
Want to see exactly how a Feistel network splits a block into left and right halves, applies a round function, and swaps them at each round? This tool visualizes a Feistel cipher on an 8-byte (64-bit) block with 1 to 16 rounds, three round function modes (XOR, S-box substitution, rotation), and a round-by-round SVG diagram showing L, R, F(R,K), and the XOR output. Encrypt and decrypt with reversed key order to confirm the structure is invertible. Everything runs in your browser.
What this tool does
- Encrypt and decrypt 8-byte (64-bit) blocks using a Feistel network with 1 to 16 rounds, accepting input as hex or text
- Visualize each round with an SVG diagram showing the left half (L), right half (R), the round function F(R, K) output, the XOR operation, and the new L and R values
- Offer three round function modes: XOR with key, S-box substitution (using the AES S-box), and rotation combined with XOR
- Accept space-separated round keys in hex (one per round), with the last key repeating if fewer keys than rounds are provided
- Support encryption and decryption with automatic key order reversal in decrypt mode, demonstrating that the Feistel structure is its own inverse
- Display a summary of all rounds showing L and R at each step, plus the final ciphertext after the final swap
How this tool works
The tool implements a textbook Feistel network. It takes an 8-byte input block and splits it into two 4-byte halves: L (left) and R (right). For each round, it computes the round function F on the right half with the round key, XORs the result with the left half to produce the new right half, and moves the old right half to become the new left half. After all rounds, it swaps L and R one final time (the standard Feistel final swap) and concatenates them into the output block.
The round function F has three modes. XOR mode computes F(R, K) = R XOR K, the simplest possible function. S-box mode computes F(R, K) = S-box[R XOR K] using the AES S-box (a fixed 256-entry permutation table). Rotation mode rotates the bytes of R left by one position and XORs with K. These are educational functions, not the real DES or Blowfish F functions, which involve expansion permutations, multiple S-boxes, and key schedules.
Decryption uses the same Feistel structure with the round keys reversed. This is the key property of the Feistel network: the same algorithm decrypts, just with the key order flipped. The tool handles this automatically when you switch to decrypt mode.
The SVG visualization shows one round at a time. You can step through rounds with Previous Round and Next Round buttons. Each round shows L and R as hex byte strings, the F(R, K) computation, the XOR circle, and the resulting new L and R. The all-rounds summary below the SVG shows the state after every round in a compact format.
How the Feistel network works (Feistel 1973, DES FIPS 46)
The Feistel network is a symmetric cipher structure named after Horst Feistel, who developed it at IBM in the early 1970s. Feistel described the structure in his 1973 work on the Lucifer cipher, which was a precursor to DES. The core idea is that any round function F, no matter how complex, can be used in an invertible cipher as long as the structure alternates between modifying one half and swapping.
The Feistel structure works as follows. Split the input block into L and R. For each round i with key K_i: compute new_R = L XOR F(R, K_i), then set new_L = R. This is equivalent to: (L, R) becomes (R, L XOR F(R, K_i)). After n rounds, swap L and R one final time. Decryption applies the same rounds with keys in reverse order, because each round is its own inverse when the key is known.
The advantage of the Feistel structure is that F does not need to be invertible. The cipher is invertible regardless of F, because decryption only requires evaluating F (not its inverse). This means F can include S-boxes, permutations, and non-linear operations without worrying about reversibility. The cipher designer focuses on making F good at diffusion and confusion, and the Feistel structure handles invertibility.
DES (Data Encryption Standard) is the most famous Feistel cipher, specified in FIPS 46 (originally FIPS PUB 46 in 1977, last revised as FIPS 46-3 in 1999). DES uses a 64-bit block with 16 rounds and a 56-bit key. Its round function F expands the 32-bit right half to 48 bits, XORs with a 48-bit round key, passes through 8 S-boxes (6 bits to 4 bits each), and applies a permutation. DES was officially withdrawn in 2005 because its 56-bit key is too short for modern security, but its structure remains influential.
Blowfish, designed by Bruce Schneier in 1993 and described in Applied Cryptography, is a 16-round Feistel cipher with a 64-bit block and variable key length (32 to 448 bits). It uses four large S-boxes (each 256 entries of 32 bits) and a key-dependent S-box setup. Twofish, Schneier's AES submission, is also a 16-round Feistel cipher with a 128-bit block.
AES (Rijndael) is not a Feistel cipher. It uses a substitution-permutation network (SPN) structure where the entire block is processed in each round, not split into halves. The AES Encrypt / Decrypt tool shows the SPN structure with SubBytes, ShiftRows, MixColumns, and AddRoundKey. The S-Box/P-Box Visualizer shows the internal AES operations in detail.
How to use this tool
- Select a direction: Encrypt or Decrypt. In decrypt mode, the round key order is automatically reversed
- Choose an input format: Hex (16 hex characters for 8 bytes) or Text (up to 8 ASCII characters)
- Enter your input in the main input field. The tool requires exactly 8 bytes (64-bit block)
- Set the number of rounds (1 to 16). DES uses 16 rounds, Blowfish uses 16, this tool allows you to experiment
- Select a round function F: XOR with key (simplest), S-box substitution (uses the AES S-box), or Rotation + XOR
- Enter round keys as space-separated hex bytes (e.g. `aa bb cc dd`). If fewer keys than rounds are provided, the last key repeats
- Read the output: the ciphertext (or plaintext in decrypt mode) appears as hex in the output panel
- Use the Previous Round and Next Round buttons to step through the SVG visualization and see L, R, F output, and the XOR at each round
Real-world examples
Encrypting an 8-byte block with 4 rounds
Set direction to Encrypt, input format to Hex, and enter `0123456789abcdef`. Set rounds to 4, round function to XOR with key, and round keys `aa bb cc dd`. The tool splits the block into L = `01 23 45 67` and R = `89 ab cd ef`. Round 1 computes F(R, aa) = 89 ab cd ef XOR aa = 23 01 67 45, then new_R = L XOR F = 01 23 45 67 XOR 23 01 67 45 = 22 22 22 22. The output after 4 rounds and the final swap is the ciphertext. The all-rounds summary shows L and R at each step.
Decrypting with reversed key order
Take the ciphertext from the previous example. Switch direction to Decrypt (the tool automatically reverses the key order to dd cc bb aa). Paste the ciphertext as hex input. The output should be the original plaintext `0123456789abcdef`. This demonstrates the Feistel property: the same structure with reversed keys inverts the cipher. No separate decryption algorithm is needed.
S-box substitution round function
Switch the round function to S-box substitution. Encrypt `0123456789abcdef` with 4 rounds and keys `aa bb cc dd`. The round function now computes S-box[R XOR K] for each byte, using the AES S-box. This introduces non-linearity: small changes in R or K produce large, unpredictable changes in F output. Compare the ciphertext to the XOR-only version to see the diffusion effect of the S-box. The S-box mode is closer to how real Feistel ciphers (DES, Blowfish) work.
Observing diffusion across rounds
Encrypt `0123456789abcdef` with 1 round and keys `aa`. Note the ciphertext. Now change the input to `023456789abcdef0` (shifted by one byte) and encrypt again with 1 round. The ciphertexts are similar because one round provides minimal diffusion. Now set rounds to 8 and repeat. The ciphertexts are completely different, showing how diffusion accumulates across rounds. This is why DES uses 16 rounds: fewer rounds leave too much structure visible.
Why the final swap matters
The Feistel structure swaps L and R after each round, plus one final swap after all rounds. Without the final swap, decryption would not work correctly with reversed keys. The tool includes the final swap (as specified in the standard Feistel description). You can verify this by encrypting and then decrypting: the round-trip always recovers the original plaintext. If the final swap were omitted, you would need to swap the output halves before decryption, which is error-prone.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| DES (Feistel) | 64-bit block, 16 rounds, 56-bit key | Legacy systems, withdrawn in 2005 |
| 3DES (Feistel) | 64-bit block, 48 rounds, 112/168-bit key | Banking, payment systems (being phased out) |
| Blowfish (Feistel) | 64-bit block, 16 rounds, 32-448 bit key | Legacy applications, password hashing (bcrypt) |
| Twofish (Feistel) | 128-bit block, 16 rounds, 128-256 bit key | AES finalist, used in some VPNs and disk encryption |
| AES (SPN, not Feistel) | 128-bit block, 10-14 rounds, 128-256 bit key | TLS, VPNs, modern encryption (see AES tool) |
Limitations or considerations
This tool uses a simplified educational round function, not the real DES or Blowfish F. The real DES F expands 32 bits to 48 bits, XORs with a 48-bit round key, passes through 8 S-boxes, and applies a permutation. The real Blowfish F uses four key-dependent S-boxes. The tool's three modes (XOR, S-box, rotation) illustrate the concept but do not match any real cipher's F function.
The tool operates on a fixed 64-bit (8-byte) block, matching DES and Blowfish. It does not support 128-bit blocks (Twofish, AES). For 128-bit block ciphers, use the AES Encrypt / Decrypt tool, which implements the full AES with 128, 192, or 256-bit keys.
The tool does not implement a key schedule. You provide round keys directly as hex bytes. Real Feistel ciphers derive round keys from a master key using a key schedule (DES has a complex permutation-based schedule, Blowfish encrypts all-zero blocks with the key to initialize S-boxes). Without a key schedule, the tool cannot demonstrate how weak keys or related keys affect security.
DES itself is broken. Its 56-bit key space (2^56 possible keys) can be brute-forced in hours on modern hardware. The Electronic Frontier Foundation built the DES Cracker machine in 1998 that found a DES key in 22 hours. 3DES (triple DES) extends the key to 112 or 168 bits but is slow and has a 64-bit block (vulnerable to birthday attacks at high data volumes). NIST deprecated 3DES in 2023 and disallows it after 2023 for most applications.
The tool does not provide authenticated encryption. Feistel ciphers in ECB mode (which is what this tool simulates) leak patterns in repeated blocks. For real encryption, use AES-GCM via the Block Cipher tool, which provides both confidentiality and integrity.
Frequently asked questions
Why is the Feistel structure invertible regardless of the round function?
Each Feistel round computes new_R = L XOR F(R, K) and new_L = R. To reverse this, you have old_R = new_L and old_L = new_R XOR F(new_L, K). You only need to evaluate F (not invert it) to recover the previous state. This means F can be any function, including non-invertible ones like S-boxes or hash functions. The Feistel structure guarantees invertibility, so the cipher designer focuses on making F good at diffusion and confusion.
What is the difference between a Feistel cipher and a substitution-permutation network (SPN)?
A Feistel cipher splits the block into two halves and only modifies one half per round (the other half is swapped in). An SPN processes the entire block in each round through substitution (S-boxes) and permutation (P-boxes). AES is an SPN, while DES and Blowfish are Feistel ciphers. Feistel ciphers are easier to analyze because the round function does not need to be invertible. SPN ciphers can be faster because they process the full block each round.
Is DES still secure?
No. DES has a 56-bit key, which is brute-forceable in hours on modern hardware. The EFF DES Cracker (1998) broke a DES key in 22 hours for $250,000. Today, a single GPU can check billions of DES keys per second. 3DES (triple DES) extends the effective key length but is slow and has a 64-bit block size, which is vulnerable to birthday attacks (Sweet32 attack, 2016). NIST deprecated 3DES in 2023. Use AES-128 or AES-256 for any new encryption.
Why does the tool use the AES S-box in the S-box round function mode?
The AES S-box is a well-studied 256-entry permutation table with strong cryptographic properties (non-linearity, low differential uniformity). Using it as the educational round function gives a realistic example of how S-boxes introduce non-linearity in Feistel ciphers. Real Feistel ciphers use their own S-boxes (DES has 8 different 6-to-4 S-boxes, Blowfish has four 256-entry 32-bit S-boxes), but the AES S-box is a good stand-in for demonstrating the concept.
How many rounds does a Feistel cipher need?
It depends on the round function and block size. DES uses 16 rounds, which was shown to be sufficient against differential cryptanalysis (Biham and Shamir, 1991). Blowfish uses 16 rounds. Twofish uses 16 rounds. Fewer rounds may not provide enough diffusion: with 4 rounds, small changes in the plaintext can leave detectable patterns in the ciphertext. The tool lets you experiment with 1 to 16 rounds to see how diffusion accumulates.
What is the final swap and why is it needed?
After the last round, the Feistel structure produces (L_n, R_n) where L_n is the old R and R_n is the modified value. Without a final swap, the output would be (L_n, R_n), but decryption with reversed keys expects (R_n, L_n). The final swap makes the output (R_n, L_n), so decryption works by applying the same rounds with reversed keys. The tool includes this final swap automatically.
Conclusion
The Feistel network is the structure behind DES, Blowfish, and Twofish, and it remains a teaching tool for how symmetric ciphers achieve invertibility without requiring the round function to be invertible. This tool visualizes each round with an SVG diagram and lets you experiment with different round functions and key counts. For the AES S-box internals used in the S-box mode, see the S-Box/P-Box Visualizer. For modern encryption with AES, see the AES Encrypt / Decrypt tool. For hardware-accelerated AES-GCM, see the Block Cipher tool.