☰
Three cryptographic protection layers. No cloud. No server. Fully offline. Your messages belong only to you.
The original Enigma machine, developed in the 1920s, was considered the most secure communication system of its time. The Wehrmacht used it millions of times in World War II – convinced the encryption was impenetrable. They were wrong.
26 letters, rotating rotors, mechanical-electrical encryption. Initially rejected by the military, adopted by the German Navy from 1926. Scherbius did not live to see its success – he died in 1929 in an accident with his horse-drawn carriage.
The German cipher bureau employee handed secret documents to French intelligence: an operating manual and key material. The French passed the information on to British and Polish services.
At the Polish Biuro Szyfrów (Cipher Bureau), Rejewski reconstructed the internal logic of Enigma through mathematical analysis – without ever having seen the machine. Together with Jerzy Różycki and Henryk Zygalski, he laid the groundwork for everything that followed.
The Poles developed the Cyclometer for systematic key determination. Zygalski invented perforated paper sheets that made certain code properties visible when overlaid. When the Wehrmacht started changing keys daily from 1936, new methods were needed.
The world's first electromechanical decryption machine. It systematically tested possible keys – a revolutionary approach. But when the Germans introduced additional rotors, the Poles reached the limits of their resources.
Shortly before the war began, representatives of Poland, Britain and France met south of Warsaw. The Poles handed over machines, methods and all their findings. Without this step, Bletchley Park would have been impossible.
As part of Operation Ultra, top secret at Bletchley Park under the codename Government Code and Cypher School, Turing and Welchman developed a far more powerful version of the Polish Bomba. The Bombe could not decrypt messages directly – but it drastically reduced possible keys. Women played a significant role: Margaret Rock, Mavis Lever and others. Dilly Knox also contributed to the analysis.
The Allies read German radio messages almost in real time. U-boat attacks were intercepted, convoys warned. On 6 June 1944, the Normandy landings directly benefited from deciphered troop movements and orders. Historians estimate: Ultra shortened the war by at least one year.
Unicode-capable with up to 50 rotors, 65,536 characters, fully randomized plugboards, reflectors and rotor positions – every message unique.
The Enigma ciphertext is encrypted with AES-256 in Galois/Counter Mode. GCM provides encryption and authentication – any tampering is detected and rejected.
Fresh keys are derived for every message using HKDF with SHA3-256. Keys rotate after each message (Perfect Forward Secrecy).
Password hardening with 64 MB RAM, 3 iterations, 4 threads. A 12-character password means computationally over 1,000 years of brute-force time. GPU and ASIC attacks are structurally neutralized.
When establishing a connection, each side generates a unique 256-bit random ID. Only when both IDs come together is the shared key created — combined with ECDH (Curve25519). Neither side alone can calculate it.
After the key exchange, the contact ID is irreversibly deleted. Even if all files and source code are later known — past messages remain protected forever.
Grover's algorithm effectively halves the key length. With 768 bits, 384 effective bits remain after quantum attack – 10107 times the age of the universe.
| Methode | Zeit | Ergebnis |
|---|---|---|
| Brute-Force (10¹⁸/sec) | 10²¹³ years | ✔ Secure |
| Grover's algorithm | 10¹⁰⁷ years | ✔ Quantum-resistant |
| Age of the universe | 1,4 × 10¹⁰ years | Reference |
Create a contact, key file is created automatically.
Exchange securely with partner once.
Green banner: full security active.
Encrypt, send, done.
RotorCrypt X is free encryption software that protects your communication with a combination of historical Enigma logic and state-of-the-art cryptography. Developed for people who take privacy seriously.
The complete desktop application as a portable ZIP file. Simply download, extract and start directly – also from USB drive. No installation required.
⬇ Windows – DownloadNo — and for three reasons that together form a wall even state-level actors cannot penetrate.
First: there is nothing to request. No server, no cloud, no database. Whoever issues a court order — there is simply no entity that could hand over any data.
Second: the mathematics do not allow it. The key space contains more combinations than there are atoms in the observable universe — and that is not a metaphor. Even a quantum computer halving the search space via Grover's algorithm faces a computational task that is unsolvable with any physically conceivable means. On top of that: quantum attacks require long-lived keys sitting in memory as a target — those simply do not exist in RotorCrypt X, because they are destroyed immediately after the connection is established.
Third: even with full device access there is nothing to extract. If someone had access to all encrypted files, the device, and the entire source code — past messages would still be gone forever. The key IDs required for decryption were irreversibly deleted the moment the connection was set up. The mathematical path cannot be reconstructed retroactively.
Nothing. A thief sees only encrypted garbage — and gets no further. The password is hardened with a technique that brings even GPU clusters to their knees: millions of attempts per second are still useless. After 10 wrong attempts the software automatically wipes all keys to military standard — the device becomes permanently unusable for the attacker.
If the device has not been used for 5 minutes, all keys have already vanished from RAM. No contact name, no plain text, no message is visible on the device — everything is encrypted with no recognizable pattern.
Even if someone had access to all files and the entire source code of the software: past messages cannot be mathematically reconstructed, because the key IDs were irreversibly deleted after the connection was established.
No USB stick needed. Both sides open the app and each generate a one-time random ID. These IDs can be exchanged over any channel — even a messenger or email is sufficient, since the ID alone is useless.
The app derives a shared key from these two IDs that neither side alone knows or can pre-compute. The software then deletes the IDs irreversibly — past messages remain protected even if someone later gains access to the device.
Fully documented and mathematically verifiable. All security mechanisms are described in the technical documents.
Yes. Identical key file format (13,600 bytes). PC-encrypted → Android-decrypted – and vice versa.
The shareware version includes all core functions and is free. However, only 3 rotors are available. For context: during World War II, the original Enigma machine also operated with 3 rotors – and was famously cracked. RotorCrypt X with just 3 rotors is far more secure than the original thanks to modern additional layers (AES-256-GCM, HKDF-SHA3-256) – but for maximum security we strongly recommend the full version with up to 50 rotors. Each additional rotor multiplies the key space and makes decryption without knowing the rotor count virtually impossible.
EAR99 is a US export classification for many common commercial goods without special cryptographic restrictions. RotorCrypt X uses only standardized, publicly available algorithms and may fall under this classification. EAR99 is not a global clearance, however — other countries have their own rules. Users are responsible for complying with the applicable national regulations in each case.
In most countries yes — but not everywhere. Sanctioned or restricted jurisdictions are excluded. The list changes; please check official government sources (e.g. OFAC, EU sanctions lists) or contact us at compliance@bagdadi.de before using the software in regions with an unclear legal situation.
Contact a lawyer specialising in export control or write to us at compliance@bagdadi.de. When in doubt: refrain from exporting until the situation is clear. Also check whether the recipient appears on any sanctions or embargo lists (e.g. OFAC, EU lists).
Your messages and settings are not lost — there are two ways, depending on how you proceed.
Setting up a new phone with device transfer: If you use Android's (Google) data transfer when setting up your new phone, the system automatically transfers the app along with its data to the new device. In this case no further action is needed.
Reinstalling via Google Play: If you reinstall the app fresh from the Play Store, all local data — contacts, keys and message histories — will be permanently lost, because RotorCrypt X deliberately creates no cloud backup. Your privacy remains fully protected this way. If you purchased your licence through Google Play, the software automatically recognises your purchase — you do not need to pay again.
Licence key manually: If you purchased your licence key through this website (outside Google Play), you will need to enter it yourself once after reinstalling. Keep your licence key stored safely.
We have created our website to the best of our knowledge and with the greatest care. However, we cannot guarantee the accuracy, completeness and up-to-dateness of our content. As a service provider, we are responsible for our own content on these pages in accordance with § 7 para. 1 TMG under general law. According to §§ 8 to 10 TMG, we are not obliged as a service provider to monitor transmitted or stored third-party information or to investigate circumstances indicating illegal activity. Obligations to remove or block the use of information in accordance with general law remain unaffected.
Liability in this regard is only possible from the point in time at which a specific legal infringement becomes known. Upon becoming aware of such violations, we will remove the content immediately and comply with the law.
Our website may contain links to external third-party websites. We have no influence over the content of these directly or indirectly linked websites and therefore cannot guarantee the accuracy of external linked content. The respective providers or operators of those pages are responsible for their content.
External links were checked at the time of linking for possible legal violations and were free of illegal content at the time of linking. A constant review of external links without concrete evidence of a legal violation is not possible. Upon becoming aware of legal violations, we will immediately remove such external links.
This disclaimer also applies to links and references set within our own website bagdadi.de. Liability for illegal, incorrect or incomplete content rests solely with the provider of the page to which reference was made, not with the one who merely links to that publication.
The content and works published on our website are subject to German copyright law. Reproduction, editing, distribution and any kind of exploitation outside the limits of copyright law require the prior written consent of the respective author. Downloads and copies of this site are only permitted for private and non-commercial use. Where content on our website was not created by us, the copyrights of third parties are respected. Should you become aware of a copyright infringement, please notify us accordingly. Upon becoming aware of violations, we will remove such content immediately.
Terms of Use for the Encryption Software RotorCrypt X
This software is intended for encrypting files and data. By using the software, you agree to these Terms of Use.
— The use of this software is entirely at your own risk.
— The developer does not guarantee that the software will function without errors or be available at all times.
— No assurances are given regarding the security, integrity, or long-term functionality of the software.
The user is solely responsible for:
— Storing encrypted files securely, whether on a USB stick, external hard drive, or local PC.
— Note: It is strongly recommended not to store encrypted files in cloud services, as third parties (e.g., service providers or government authorities under legal powers) may gain access or have potential access.
— Creating backups to avoid data loss.
— Keeping passwords, keys, or recovery information safe.
— Ensuring that the use of the software is legally permitted in their country.
The developer assumes no liability, especially not for:
— Data loss, data corruption, or unauthorized access
— Damage caused by improper use
— Damage caused by security vulnerabilities, software errors, or incompatibilities
— Indirect damages, consequential damages, or loss of profit
All liability — regardless of the legal basis — is excluded to the extent permitted by law.
— There is no guarantee that the encryption is unbreakable under all circumstances.
— New technologies, attacks, or errors may compromise security.
— The developer may modify, extend, or discontinue the software at any time.
— There is no entitlement to updates, support, or further development.
The software must not be used for:
— Illegal activities
— Concealing or hiding illegal content
— Actions that violate applicable data protection or security laws
The software only processes data that the user encrypts themselves. No personal data is transmitted to the developer unless explicitly stated otherwise.
If any provision of these Terms of Use is invalid, the validity of the remaining provisions shall remain unaffected.
The law of the country in which the developer is based applies, unless mandatory legal provisions state otherwise.
Legal Notice
Tarek Bagdadi
Am Funkturm 10
44309 Dortmund
Deutschland
Contact
Phone: 0231 / 13471548
E-Mail: [email protected]
RotorCrypt X is a self-developed encryption software offered as shareware. A free version (shareware) and a full version (available for purchase through authorised resellers) are available. No VAT identification number exists.
Disclaimer, copyright and privacy information: see respective tabs.
As of: May 2026
RotorCrypt X is a research and privacy tool. The software uses standardised cryptographic algorithms (AES-256, SHA3-256, HKDF). The distribution, transfer or export of this software may be subject to national and international export controls. Users are responsible for complying with the applicable laws.
To the best of our knowledge, RotorCrypt X uses only standardised, publicly available algorithms and may fall under the EAR99 classification. EAR99 does not, however, exempt users from the obligation to review and comply with applicable national or international export and sanctions regulations.
The user confirms that they are aware of and comply with the applicable national and international export, sanctions and foreign trade regulations. The user undertakes not to deliver the software, directly or indirectly, to persons, organisations or countries subject to sanctions or embargoes under applicable law.
The provider declares that the software uses standardised, publicly available cryptographic algorithms and may, to the best of its knowledge, fall under the EAR99 classification. This declaration does not replace the user's obligation to carry out their own checks.
The user undertakes to carry out appropriate end-user and end-use verification before delivering or making the software available. Upon request by the provider, the user must submit written evidence regarding identity, registered office, intended use and any applicable licences.
The user shall notify the provider without delay if they become aware that an export, transfer or use of the software could violate applicable export or sanctions regulations.
The user shall indemnify the provider against all claims, damages, costs and expenses (including reasonable legal fees) arising from a breach of the above obligations.
If the user breaches this clause, the provider is entitled to immediately cease providing the software and to terminate existing licences.
The software may not be used for unlawful purposes, to circumvent sanctions, or to support terrorist or criminal activities.
For questions regarding export compliance or use in your jurisdiction, please contact us:
— E-Mail: compliance@bagdadi.de
— Subject: Compliance Request – RotorCryptX
— Required information: name of organisation; country of registered office; intended use; contact person; project description if applicable.
We typically respond within 5 business days. This contact option does not replace legal advice.
As of: March 2026
These Terms and Conditions apply to all purchases of the full version of RotorCrypt X. The contracting party is the operator of this website (see Imprint), hereinafter referred to as “Provider”.
Payment processing is handled by an authorised payment service provider acting as Merchant of Record, who concludes the purchase contract with the buyer as part of the technical processing.
The subject of the purchase is a non-exclusive, non-transferable single-device licence to use the full version of RotorCrypt X.
The shareware version (3 rotors) is available free of charge. The purchase unlocks the full version (up to 50 rotors).
The licence permits installation and use on one device. Simultaneous use on multiple devices is not permitted.
Not permitted: resale, sublicensing, decompilation, reverse engineering, and commercial use without a separate agreement.
The price displayed at the time of order is binding. All prices include the applicable VAT of the buyer’s country.
Payment is made through the offered payment methods. Billing occurs immediately upon order.
The licence key is delivered by e-mail after successful payment.
Consumers are generally entitled to a 14-day right of withdrawal.
The right of withdrawal expires early for digital content once execution of the contract has begun and the consumer has expressly agreed that they lose their right of withdrawal once the licence key has been provided.
If the right of withdrawal has not yet expired, it may be exercised by e-mail to [email protected]. In such case, the purchase price will be refunded within 14 days and the licence key deactivated.
It is warranted that the software substantially corresponds to the product description upon delivery.
Defects will be remedied by providing an update or corrected version. If remedy fails, statutory rights (price reduction, withdrawal) apply.
The warranty period is two years from delivery of the licence key.
Liability is unlimited for damages arising from injury to life, body or health, and for intentional or grossly negligent conduct.
Otherwise, liability is limited to foreseeable, contract-typical damage.
RotorCrypt X is a local data encryption tool. No liability is accepted for the loss of key files or encrypted data. It is the user’s responsibility to make backups of key files.
The buyer is solely responsible for complying with applicable export and import regulations of their country. Encryption software is subject to special restrictions in some countries.
Personal data (name, e-mail, payment data) processed during the purchase is used solely for contract processing. The separate Privacy Policy of this website applies. Data required for payment processing is passed on to the payment service provider. Questions: [email protected]
The law of the Federal Republic of Germany applies, excluding the UN Convention on Contracts for the International Sale of Goods (CISG).
The place of jurisdiction for merchants and persons without a general place of jurisdiction in Germany is Dortmund.
Should individual provisions of these Terms be invalid, the validity of the remaining provisions shall remain unaffected.