History & Technology

The Secret Life of Codes: From Caesar's Cipher to the QR Code in Your Pocket

Think about your morning, just in the last few hours. You probably tapped a loyalty card barcode at the coffee shop. A delivery driver scanned the label on your parcel. Your password manager auto-filled a 32-character string into a login form. Your phone unlocked because it recognised your face, which is itself just a numerical code for the geometry of your features. You live, whether you think about it or not, inside a dense web of codes — identifiers, ciphers, tokens, and symbols that quietly hold the modern world together.

And yet none of this is new. The human urge to encode information — to keep a message private, to uniquely identify an object, to verify that something is genuine — is ancient. Julius Caesar was doing it on the battlefields of Gaul two thousand years ago. Medieval Jewish scholars were doing it with the Hebrew alphabet. Nineteenth-century treasure hunters were convinced a code was the only thing standing between them and a fortune buried somewhere in the Blue Ridge Mountains.

What has changed is not the instinct, but the scale and the stakes. Where Caesar needed to protect a message sent by a runner to one general, a modern session token needs to protect the bank details of a hundred million people, generated fresh every time they log in. The mathematics has grown ferociously complex. The elegance of the underlying idea has not.

This is the story of that idea — where it came from, how it evolved, and why it matters more now than it ever has. We will travel from a Roman emperor dragging his stylus across a wax tablet, through two world wars, into a Toyota car factory in Aichi Prefecture, and end up at the QR code on the menu of a restaurant that was forced to go paperless during a global pandemic. Along the way we will meet mathematicians, engineers, soldiers, and at least one passionate amateur treasure hunter who almost certainly died without finding what he was looking for.

Julius Caesar and the Art of the Secret Message

In 58 BC, Julius Caesar was fighting a war in Gaul — the territory that is now roughly France — and he had a problem that every military commander throughout history has faced: he needed to send messages to his officers, but he could not guarantee that those messages wouldn't be intercepted. A captured runner, a bribed courier, a letter opened at the wrong border post — any of these could hand his strategy to the enemy.

His solution was simple, elegant, and would be recognised immediately by any student of cryptography today. He shifted every letter in his message three places forward through the alphabet. A became D. B became E. C became F. And so on, wrapping around so that X became A, Y became B, and Z became C. The word VALE (farewell) became YDOH. A spy intercepting the message would see nonsense. A general who knew the key would shift every letter back three places and read it perfectly.

This is the Caesar cipher, or more specifically a ROT-3 substitution cipher. It was documented by the historian Suetonius in The Twelve Caesars, written around AD 121: "If he had anything confidential to say, he wrote it in cipher, that is, by so changing the order of the letters of the alphabet, that not a word could be made out." By modern cryptographic standards it is almost laughably weak — there are only 25 possible shifts of the Latin alphabet, meaning an attacker needs at most 25 attempts to break it. But for a Roman soldier who couldn't read, it was entirely effective.

ROT+3ABCDEFGHIJKLMNOPQRSTUVWXYZDEFGHIJKLMNOPQRSTUVWXYZABCOUTER: plaintext · INNER: ciphertext (shift +3)
The Caesar cipher rotates every plaintext letter (outer ring) to a ciphertext letter (inner ring) three positions forward. A→D, B→E, C→F, and so on.

Caesar was not even the first. The Atbash cipher, used by Hebrew scholars to encrypt sacred texts, predates him by several centuries. It works by a simple mirror: A maps to Z, B maps to Y, C maps to X — the last letter of the alphabet becomes the first, and vice versa. The name "Atbash" is itself a cipher: Aleph-Tav-Beth-Shin, the first, last, second, and second-to-last letters of the Hebrew alphabet. It appears in the Book of Jeremiah, where the word Sheshach is believed to be an Atbash encoding of Babel (Babylon). The scribe who wrote it was hiding a political insult in plain sight.

Both the Caesar and Atbash ciphers are monoalphabetic substitution ciphers — every instance of the letter A in a message is always encoded the same way. This makes them vulnerable to frequency analysis, a technique documented in detail by the ninth-century Arab polymath Al-Kindi in his Manuscript on Deciphering Cryptographic Messages. The letter E appears most often in English text; T, A, and O follow closely. If you look at a substituted ciphertext and find that one symbol appears far more often than the others, there is a very good chance that symbol represents E. With enough text, you can reverse-engineer the entire substitution.

The response to frequency analysis was the Vigenère cipher, developed in the sixteenth century and attributed primarily to the Italian cryptologist Giovan Battista Bellaso, though it was later misattributed to the French diplomat Blaise de Vigenère (a common historical injustice). The Vigenère cipher uses not one shift but a repeating keyword. If your keyword is KEY, you shift the first letter by 10 (K), the second by 4 (E), the third by 24 (Y), and then repeat. The same plaintext letter is now encoded differently each time it appears, depending on its position. This defeats simple frequency analysis because the frequency signal is smeared across multiple ciphertext symbols. For nearly three centuries it was known as le chiffre indéchiffrable — the unbreakable cipher. It was eventually broken by the British mathematician Charles Babbage in the 1840s, though he never published his method, and the credit went to the Prussian officer Friedrich Kasiski, who independently rediscovered the attack in 1863.

Then there are the Beale Ciphers — three documents that surfaced in Virginia in 1885, purportedly left by a man named Thomas J. Beale, describing a buried treasure of gold and silver somewhere in the Blue Ridge Mountains worth several million dollars in today's money. The first document describes the location. The second lists the treasure's contents. The third names the recipients. Only the second has ever been decoded, using the Declaration of Independence as a key text — the numbers in the cipher correspond to the first letter of that word in the Declaration. The first and third remain unsolved. Thousands of people have spent decades trying to crack them. Some scholars believe the ciphers are a hoax. Some believe there is treasure waiting. Nobody knows. The Beale Ciphers are a reminder that codes are not just tools of power — they are magnets for obsession.

War, Machines, and Unbreakable Codes

On the morning of 16 January 1917, a British signals intelligence team at Room 40 in the Admiralty building in London intercepted a telegram from the German Foreign Secretary, Arthur Zimmermann, to the German Ambassador in Mexico. The telegram, encrypted in the German diplomatic code 0075, proposed a military alliance: if the United States entered the war against Germany, Mexico should be offered financial support and help in recovering Texas, New Mexico, and Arizona. It was a catastrophic diplomatic blunder. Room 40 decoded it. President Woodrow Wilson, who had won re-election on the slogan "he kept us out of war", was shown the decoded text in February. Two months later, the United States declared war on Germany. The Zimmermann Telegram did not cause the First World War, but it shaped its ending.

The lesson of the Zimmermann Telegram — that poor cryptography costs more than poor strategy — was not lost on the military planners of the following generation. By the time the Second World War began, Germany had deployed what they believed was an unbreakable cipher machine: the Enigma.

Arthur Scherbius, a German electrical engineer, had patented the Enigma machine in 1918, originally intending it for commercial use. The German military adopted a modified version in the late 1920s. At its heart, Enigma used a set of rotating wheels — rotors — each of which substituted one letter for another. Every time a key was pressed, at least one rotor advanced, changing the substitution. The operator also plugged cables between letter pairs on the front panel, the Steckerbrett, adding a further layer of permutation. The total number of possible starting configurations: 158,962,555,217,826,360,000 — approximately 158 quintillion. It seemed impossible to brute-force.

And yet it was broken. The work began with the Polish Cipher Bureau in the 1930s, where mathematicians Marian Rejewski, Jerzy Różycki, and Henryk Zygalski reverse-engineered the Enigma rotor wiring using nothing but captured message keys and pure mathematical reasoning. When Poland was invaded in 1939, they passed their knowledge to France and Britain. At Bletchley Park in Buckinghamshire, a team of codebreakers — mathematicians, linguists, crossword enthusiasts, chess players — took up the work. Among them was a 27-year-old mathematician named Alan Turing.

Turing's contribution was the Bombe, an electromechanical device that automated the search for Enigma settings by exploiting cribs — known plaintext fragments. A message might always begin with a standard weather report. A naval operator might sign off the same way every day. These predictable fragments gave the codebreakers a foothold. The Bombe, running dozens of possible configurations simultaneously, could find the day's Enigma settings in hours rather than years. Historians estimate that the intelligence produced at Bletchley Park — codenamed Ultra — shortened the war in Europe by at least two years and saved millions of lives.

While Turing was fighting Enigma in England, the Pacific theatre produced a code that was never broken: the Navajo Code Talkers. The United States Marine Corps recruited approximately 400 Navajo men who developed a military code based on their native language. Navajo was ideal — it had no written form at the time, it was spoken by fewer than 30 people outside the Navajo Nation who weren't Navajo themselves, and its tonal qualities and complex syntax made it virtually impossible to learn without childhood immersion. The Japanese, whose own code-breaking operations were formidable, never cracked it. Major Howard Connor, who served at Iwo Jima, reportedly said: "Were it not for the Navajos, the Marines would never have taken Iwo Jima."

A Line in the Sand — The Birth of the Barcode

In 1948, a food industry executive named Bernard Silver was walking through the corridors of Drexel Institute of Technology in Philadelphia when he overheard the dean of the local Food Fair supermarket chain making a request to a Drexel professor: could the university develop a system to automatically read product information at checkout? The professor declined. Silver did not forget the conversation.

He mentioned it to a fellow graduate student, Norman Woodland, who became immediately fascinated. Woodland was the kind of person who, when confronted with a problem, could not stop thinking about it. He withdrew from his studies, moved to his grandfather's apartment in Miami Beach, and spent months sitting on the sand thinking about the problem of encoding product information in a form a machine could read.

The breakthrough came one morning on that same beach. Woodland extended his fingers and dragged them through the sand, watching the parallel lines they left behind. He was, at that moment, thinking about Morse code — dots and dashes that he had learned as a Boy Scout. What if those dots and dashes were stretched into bars — lines of varying widths, arranged in a pattern that could be read by a beam of light? He had the shape of the idea in a handful of sand.

Woodland and Silver filed their patent in October 1949. It was granted on 7 October 1952 as US Patent 2,612,994, titled "Classifying Apparatus and Method." The original design was not the familiar striped rectangle we know today — it was a bullseye, a set of concentric circles, which had the advantage of being readable from any direction. The patent was eventually sold, passed through several hands, and sat largely dormant for two decades. The technology to read barcodes accurately and cheaply simply did not exist yet.

By the early 1970s, the supermarket industry was in crisis. Checkout queues were slow, pricing errors were rampant, and inventory management was a clerical nightmare. The grocery trade associations knew they needed a standardised system. IBM sent an engineer named George Laurer to solve the problem. Laurer, working from the Woodland-Silver foundation, redesigned the bullseye into a rectangle. The concentric circles, he had determined, were impractical to print reliably — ink tended to bleed radially. Parallel lines, by contrast, could tolerate significant imperfections in printing and still scan reliably. He created what we now call the Universal Product Code, the UPC.

The moment the UPC became real — the moment it left the world of engineering and entered history — was 8.01 in the morning on 26 June 1974. At Marsh's Supermarket in Troy, Ohio, a cashier named Sharon Buchanan ran a 10-pack of Wrigley's Juicy Fruit chewing gum across the first commercial barcode scanner. The pack cost 67 cents. That pack of gum is now in the Smithsonian Institution's National Museum of American History. Norman Woodland, by then 55 years old and working for IBM, watched the event. He had been waiting 26 years.

How Barcodes Actually Work

A barcode is, at its core, a method of encoding numbers as patterns of light and dark — a visual representation of binary. When a laser scanner passes over a barcode, it measures how much light is reflected back. Dark bars absorb light; white spaces reflect it. The rapid alternation between reflection and absorption produces a pattern of electrical pulses that the scanner's decoder translates into a sequence of bits, and then into digits.

Take the UPC-A code, the standard on most retail products sold in North America. It encodes 12 digits. The first digit identifies the product category. The next five identify the manufacturer. The following five identify the specific product. And the final digit — the check digit — is calculated from the previous eleven using a weighted sum formula. If you scan the barcode and the computed check digit doesn't match the stored one, the scanner knows immediately that something has gone wrong in the reading or printing. It rejects the scan and asks you to try again. Check digits are the error detection mechanism baked into every barcode.

quietzonestart marker◄ data bars ►check digitquietzone0 12345 67890 5
Anatomy of a UPC-A barcode. The quiet zones on either side give the scanner a reference for "no signal." Start and end markers tell the decoder where the data begins and ends. The final digit is a mathematically derived check digit.

The UPC-A works well in North America, but the rest of the world needed one more digit. The European Article Number, EAN-13, extends the format to thirteen digits, with the first two or three identifying the country or region of the issuing organisation. The barcode on a book in a French bookshop, a German pharmacy, and an Australian supermarket all use EAN-13. It is the same underlying technology, just slightly wider.

Retail barcodes are the visible surface of a much larger ecosystem of one-dimensional codes. Code 128 is the workhorse of logistics — you will find it on postal labels and shipping documents because it can encode not just numbers but the full ASCII character set, including letters. ITF-14 (Interleaved 2 of 5, 14 digits) is designed for corrugated cardboard shipping cartons, where the coarser printing surface demands a more robust format. Code 39, developed in 1974, was one of the first alphanumeric barcodes and remains common in industrial and military applications because it is self-checking and requires no external check digit.

But one-dimensional barcodes have a fundamental limitation: they can only hold a modest amount of data. A UPC-A holds 12 digits. Even Code 128, which is among the densest 1D formats, struggles to encode a paragraph of text into a scannable mark. Enter the two-dimensional barcode. PDF417, developed by Symbol Technologies in 1991, looks like a rectangular grid of tiny bars and spaces stacked in rows — essentially a series of 1D barcodes on top of each other. It holds enough data to encode a full driving licence, which is why you will find it on the back of a driver's licence in the United States, or on an airline boarding pass. Data Matrix, developed around the same time, encodes information in a tiny square of black and white cells — small enough to mark individual pharmaceutical pills, electronic components, and surgical instruments. If you want to try generating your own barcode in any of these formats, you can do so instantly here.

QR Codes — Japan's Quiet Revolution

In 1992, a young engineer at Denso Wave — a subsidiary of the Toyota group — was given a problem. Toyota's assembly lines were among the most sophisticated manufacturing operations in the world, but they had an information bottleneck. Every component on the line was tracked with a barcode, and the volume of components was so vast that barcode scanners were falling behind. Workers were spending too much time ensuring the scanner captured each code. The system needed to be faster. Much faster.

The engineer's name was Masahiro Hara, and he would spend the next two years solving the problem with a tool he spent most of his lunch breaks playing: the board game Go. The black and white stones of a Go board, he noticed, formed patterns that could encode information far more densely than the parallel lines of a barcode. Information encoded in two dimensions — across and down, not just across — could hold orders of magnitude more data in the same physical space.

The result, completed in 1994, was the Quick Response code — the QR code. The name was not accidental. The specification required the code to be decoded in less than 0.3 seconds. Speed was the entire point.

finder patternorientationdata +errorcorrection3rd corner(no 4th!)Three finder squares — never four.Absence of fourth corner = orientation lock.
QR code structure. The three identical finder patterns in the corners (never four — the absence of the fourth corner is itself orientation data) allow a scanner to detect the code's position, size, and angle in under 0.3 seconds.

Look closely at any QR code and you will see three identical squares — one in the top-left corner, one in the top-right, one in the bottom-left. These are the finder patterns. When a scanner sees three squares in that arrangement, it knows immediately: that is a QR code. It also knows which way up it is, and how large each module — each individual cell — is. The absence of the fourth corner is itself information. It tells the scanner which edge is the bottom.

The genius of the QR code, beyond its density, is its error correction. Using an algorithm called Reed-Solomon error correction — the same mathematics that makes audio CDs readable even when scratched — a QR code can survive significant physical damage. At the highest error correction level (called Level H), up to 30% of the code's data modules can be destroyed, obscured, or overprinted, and the code will still scan correctly. This is why you see so many QR codes with logos printed directly on top of them: the logo is deliberately destroying a portion of the code, but the error correction absorbs the loss.

The most remarkable part of the QR code story, however, is what Denso Wave did with the patent. They held it. And then, in a decision almost without precedent in corporate history, they publicly announced that they would never enforce it. Any company, individual, or government could use the QR code format without paying a licence fee, without asking permission, without any restriction at all. Denso Wave gave it to the world. This single decision — essentially gifting the commercial value of a widely-adopted technology — is almost certainly why QR codes became a global standard rather than one format among many competing proprietary systems. The contrast with other technology patent stories, where standards were weaponised or held hostage, could hardly be more stark.

How QR Codes Conquered the World

In Japan, QR codes were mainstream by 2002. You would find them on magazine advertisements, on medicine packaging, on train station posters, on business cards. Japanese mobile phones in the early 2000s had QR readers built into their cameras as a standard feature. It was simply part of daily life.

The West was bewilderingly slow to follow. Part of the problem was hardware: scanning a QR code required a phone camera capable of reading the code quickly and a processor fast enough to decode it, and most Western phones in the mid-2000s struggled. Part of the problem was software: you needed a dedicated app, which meant an extra step that many people simply wouldn't bother with. Marketing campaigns would print QR codes on billboards and posters — visible on a motorway at 70 miles per hour to someone with a phone that needed three taps to open a scanning app — and wonder why no one was scanning them. The codes were technically present. The user experience was not.

China took a different path entirely. When WeChat Pay and Alipay launched QR-code-based payment systems in the early 2010s, Chinese consumers didn't need to be convinced — the utility was immediate and obvious. Within a few years, street vendors, restaurants, and market stalls across Chinese cities had stopped accepting cash almost entirely. A QR code taped to the counter was all you needed. This happened before Apple had native QR code support in its camera. China effectively built a cashless economy on Masahiro Hara's invention.

The tipping point in the West came on 19 September 2017, when Apple released iOS 11 with native QR code reading built directly into the Camera app. No third-party app required. Point your camera at a code, a notification appears, tap it. The friction was gone. Google had quietly added similar functionality to Android around the same time. The two dominant mobile platforms had, in effect, voted for QR codes as the standard.

Then came March 2020. Within weeks of COVID-19 lockdowns lifting in many countries, restaurants discovered that paper menus were a hygiene risk. Printing new menus was expensive. The solution — a QR code on the table that opened a web page — required almost no investment and was immediately understood by a customer base that now had native QR reading in their pockets. Millions of people who had never knowingly scanned a QR code did it for the first time in a restaurant or pub, and the mental model clicked. Vaccine passports, event tickets, contact tracing apps, take-away ordering systems — QR codes were suddenly everywhere.

Today, WhatsApp uses QR codes to link desktop sessions to phones. Instagram and LinkedIn generate QR profile codes. Bitcoin wallet addresses are routinely shared as QR codes. The specification that Masahiro Hara wrote in 1994 to track car parts on a Toyota assembly line now moves money, verifies identities, and opens doors across the entire world. If you want to generate a QR code for free, you can do so instantly — any text, URL, or contact information, in seconds.

The Digital Code Economy

The physical codes we have discussed — ciphers, barcodes, QR codes — are all ways of encoding information for physical transmission or physical reading. But in the last thirty years, a parallel economy of purely digital codes has grown to a size that dwarfs anything that came before. You interact with these codes constantly, largely without knowing it.

Voucher Codes and the Psychology of Earning

The voucher code is a deceptively powerful retail invention. Behavioural economists have studied it extensively and found something counterintuitive: a discount code is more effective at driving purchase than an equivalent automatic discount, even when the end price is identical. The reason is the psychology of effort. A code that you find, copy, and paste into a checkout form feels earned. The satisfaction of the discount is partly the satisfaction of having been clever enough to find it. Retailers figured this out before the academics did, which is why coupon codes — a format invented by Coca-Cola in 1887 (handwritten slips for a free glass of Coke) — never went away. They just moved online.

OTP: The 30-Second Window

When your banking app or authenticator generates a six-digit code that expires in 30 seconds, it is using TOTP — Time-based One-Time Password, standardised in RFC 6238. The algorithm takes a shared secret (agreed between your bank and your authenticator app when you first set up two-factor authentication) and combines it with the current Unix timestamp divided into 30-second windows. Both your device and the bank's server independently perform the same computation. Because they share the same secret and the same clock, they arrive at the same six-digit code. Nobody transmits the code over the network — it is simultaneously derived on both sides. Even if an attacker intercepts one code, it is worthless 30 seconds later. HOTP (HMAC-based OTP) works similarly but advances on each use rather than on time — you will find it in hardware security keys and some bank card readers. If you need to test an OTP generator, you can do it here.

API Keys: The Secret Handshake of the Internet

Every developer working with third-party services has a drawer — metaphorically — full of API keys. These long random strings authenticate software to other software. When your weather app requests the current temperature from a weather service, it includes an API key in the request. The weather service checks the key, confirms it belongs to a legitimate registered application, and responds. Without the key, the request is rejected. An API key is essentially a password that a program uses instead of a human. The difference from a traditional password is entropy: a well-generated API key is typically 256 bits of randomness, compared to a human-chosen password that might have 30. There is no vocabulary list, no birthday, no significant other's name. Just randomness.

Session Tokens: How Websites Remember You

HTTP, the protocol of the web, is stateless — each request is technically independent, with no built-in memory of previous requests. When you log into a website, the server generates a session token: a long random string that it stores on its end and sends to your browser as a cookie. On every subsequent request, your browser includes the token in the request header. The server sees the token, looks it up in its session store, and knows who you are. The token is not your password — it is a temporary, disposable representative of your authentication state. When you log out, the server deletes the token from its store. The cookie in your browser becomes meaningless. This is why you can be logged into the same account on multiple devices simultaneously (each device has its own token) and why logging out of one device does not log out the others unless the server explicitly invalidates all tokens.

Software License Keys and the CD-Key Era

In the 1990s and early 2000s, software piracy was a genuine crisis for software companies. Their solution was the CD key: a long alphanumeric code printed inside the box that you had to enter during installation. The codes were not random — they were generated using an algorithm that produced only certain valid patterns, so the installer could check the key without calling home to a server. Microsoft Windows XP, for example, used a complex validation algorithm that checked digit sums and specific bit patterns. The result was a cat-and-mouse game: crackers would reverse-engineer the validation algorithm and publish key generators. The companies would add online activation requirements. The crackers would write offline activators. The war has not ended — it has simply moved to different battlegrounds.

UUID: The Address Space Large Enough for Everything

The UUID — Universally Unique Identifier — is a 128-bit number, typically written as 32 hexadecimal digits arranged in a pattern like 550e8400-e29b-41d4-a716-446655440000. The version 4 UUID (the most common) is generated almost entirely from randomness. The total number of possible version 4 UUIDs is 5.3 × 1036. To put that in perspective: if every person who has ever lived had generated a billion UUIDs per second for their entire lifetime, the probability of any two UUIDs colliding would still be negligibly small — less than one in a trillion. In practice, UUID collisions are so unlikely that they are ignored. Every database row, every user account, every uploaded file in a modern web application probably has one. They are the ZIP codes of the digital world, allocating unique addresses across an address space so vast it will never be exhausted.

What Makes a Code Truly Secure?

There is a difference between a code that looks random and a code that is random. The difference matters enormously, and confusing the two has caused some of the most embarrassing security failures in the history of the internet.

In 2012, LinkedIn suffered a breach in which 6.5 million password hashes were stolen and posted to a Russian forum. The hashes were SHA-1 — fast and inadequate by modern standards — but the truly damning detail was that LinkedIn had not salted them properly. A salt is a random string added to a password before hashing, so that two users with the same password produce different hashes. LinkedIn had used sequential, predictable salts. Attackers who cracked one hash often found they had accidentally cracked thousands of others. The predictability in the salt — the appearance of randomness without the substance — multiplied the damage catastrophically.

The formal measure of randomness in a code is entropy, measured in bits. A coin flip has 1 bit of entropy — two equally likely outcomes. A six-sided die has approximately 2.58 bits. A four-character code drawn from a pool of 62 alphanumeric characters has log₂(62⁴) ≈ 23.8 bits. An eight-character code from the same pool has 47.6 bits. This is not just a bigger number — each additional bit doubles the number of possible codes, doubling the work an attacker must do. Entropy scales exponentially. A password of 60+ bits is considered strong; below 30 bits, any determined attacker with modest hardware will crack it quickly.

0000~13 bits1234low entropyA3k9moderateXm7#K2pQstrongX7#mK2$pQ9very strongPredictableVery Strong ▶entropy (bits of randomness)
Entropy scale showing approximate code strength. Each additional character of a random code roughly doubles the search space. Adding symbols alongside letters and digits multiplies it further.

There is one more critical distinction: client-side generation versus server-side generation. When a tool generates codes entirely in your browser — using the browser's own cryptographic random number generator, with no data sent to any server — the codes never travel across the network. They cannot be logged, intercepted, or stored in a database you don't control. This is not a minor privacy detail. For sensitive codes — passwords, recovery codes, API keys — the question of where generation happens is as important as the question of how. The home generator on this site works entirely client-side and includes an entropy strength meter that shows in real time exactly how much randomness each pattern configuration produces.

The Thread That Runs Through Everything

Julius Caesar would not recognise a QR code. Alan Turing never saw a JWT token. Norman Woodland, dragging his fingers through the sand on that Miami beach, could not have imagined that his extended Morse dashes would one day guide a trillion-dollar logistics infrastructure. And yet there is a thread that runs through all of it — the same impulse, expressed across two thousand years of human ingenuity.

Keep this private. Prove this is genuine. Find this object again. Identify who I am.

These four needs have driven cryptography, barcode technology, QR standards, and the entire apparatus of digital identity. The tools change — rotors give way to elliptic curves, bullseyes give way to data matrices — but the needs don't. Wars have been won or prolonged by the quality of codes. Markets have been created or destroyed. A global pandemic was navigated partly through the QR code that a Japanese engineer invented to track car doors.

The next chapter is already being written. Quantum computers, if they reach sufficient scale, will be able to break most of the asymmetric cryptography that protects the internet today — including RSA and elliptic curve Diffie-Hellman. The National Institute of Standards and Technology finalised the first post-quantum cryptographic standards in 2024, after a selection process that ran for eight years. The mathematics being deployed to defend against quantum attacks would be entirely unrecognisable to Vigenère, probably impenetrable to Turing, and almost certainly baffling to Masahiro Hara. But the problem it is solving — keep this private — is exactly the one Caesar scratched into his wax tablets two thousand years ago.

The secret life of codes has never been more alive. And if you need to generate a strong random password, a batch of voucher codes for a promotion, an API key for your next project, or simply want to explore what makes a code secure — the tools are right here, free, private, and client-side.

← Back to Generator