An interactive exploration of the first quantum cryptography protocol — provably secure key exchange
Alice and Bob want to establish a shared secret key over a public channel, even if an eavesdropper (Eve) is listening. Classical key exchange relies on computational assumptions. BB84 achieves information-theoretic security using the laws of quantum mechanics: the no-cloning theorem and measurement collapse guarantee that any interception is detectable.
Two measurement bases that are mutually unbiased — measuring in the wrong basis yields a uniformly random outcome.
Photons are sent one at a time. Each is polarized in one of 4 states across 2 bases.
It is impossible to create a perfect copy of an arbitrary unknown quantum state. Eve cannot clone and forward.
Measuring in the wrong basis irreversibly disturbs the state, introducing detectable errors.
The Two Bases
Try It: Measure a Quantum State
A photon is prepared in one of the four states. Choose a measurement basis and see what happens.
Configure the parameters above and click Run Protocol to see the BB84 simulation in action. Toggle Eve to see how eavesdropping introduces detectable errors.
The shared key from BB84 enables information-theoretically secure encryption. The one-time pad XORs each message bit with a key bit — without the key, the ciphertext is perfectly random, giving zero information about the plaintext. Try it: type a message and encrypt it with the sifted key from the simulation above.
You encrypted two different messages with the same key. This is catastrophically insecure! An attacker who XORs the two ciphertexts gets:
This equals plaintext1 ⊕ plaintext2 — the key cancels out completely! From this, an attacker can use frequency analysis to recover both messages. A one-time pad key must never be reused.
Experience the protocol first-hand! Alice is sending you polarized photons. For each one, choose a measurement basis (+ rectilinear or × diagonal). You won't know which basis Alice used until afterwards — can you extract a shared key?
Trace a Single Photon
Run the BB84 protocol hundreds of times to see how the error rate distributes with and without an eavesdropper. This demonstrates why Alice and Bob can statistically detect Eve's presence with overwhelming confidence.
Each check bit has a 3/4 chance of hiding Eve (she might have guessed the right basis). But as we check more bits, the probability of all of them passing drops exponentially. With n check bits, the probability that Eve goes undetected is (3/4)n.
| Confidence Level | Check Bits Needed | Eve's Escape Prob. |
|---|---|---|
| 90% | 8 | ~10% |
| 95% | 11 | ~4.2% |
| 99% | 16 | ~1.0% |
| 99.9% | 24 | ~0.1% |
| 99.99% | 32 | ~0.01% |
| 99.9999% | 48 | < 0.0001% |
n = ⌈log(1−p) / log(3/4)⌉ — only logarithmic growth needed for exponential confidence
Not all transmitted qubits contribute to the final key. Between basis sifting, error checking sacrifices, and privacy amplification, the usable key rate is a fraction of the raw transmission rate. Adjust the parameters below to see how they affect the final key.
BB84 is not just a theoretical curiosity — it has been implemented in real systems. Quantum key distribution networks are operational today, with commercial products and government-scale deployments pushing the boundaries of secure communication.
QKD over telecom fiber works up to ~100 km with direct detection. Beyond that, photon loss becomes prohibitive without quantum repeaters.
Free-space channels via satellites avoid fiber loss. Enables QKD over thousands of kilometers, connecting distant ground stations.
Future networks will use entanglement-based repeaters to extend fiber QKD range without trusted relay nodes.
A compact reference for the complete BB84 quantum key distribution protocol.
For each bit, Alice randomly picks a basis (+ or ×) and encodes the bit as a polarized photon.
Alice sends each photon over the quantum channel. Any interception disturbs the state.
Bob randomly picks a basis and measures each photon. If his basis matches Alice's, the bit is correct.
Over a public channel, they compare bases (not bits). Mismatched-basis bits are discarded (~50%).
They sacrifice a random subset of sifted bits to check for errors. Error rate >11% ⇒ abort (Eve detected).
Remaining bits are compressed via hashing to eliminate any partial information Eve may have. Result: secure key.
1. What happens when Bob measures a photon using a different basis than Alice?
2. What error rate among sifted bits signals an intercept-resend eavesdropper?
3. Why can't Eve perfectly clone each photon she intercepts?
4. During basis reconciliation, what do Alice and Bob share publicly?
5. What fraction of qubits survive basis reconciliation on average?
6. Why must a one-time pad key never be reused?
7. With 20 check bits, what is approximately the probability of detecting an eavesdropper?
8. In the key rate formula, what does the binary entropy term H(e) represent?