Share the Prime, Protect the Key

Every a3.0 prime comes in two pieces: the prime itself, and a small key. They’re meant to be handled differently — and the difference is the whole point of how the puzzle stays fun without becoming reckless.

What each piece reveals

The prime alone reveals nothing useful. It’s a 20-to-39 digit number. To anyone who doesn’t know the algorithm and doesn’t have the key, it’s an extremely long, extremely prime number. Mathematically interesting, personally anonymous.

The key alone is even less. Three characters from a friendly alphabet — without the matching prime, it’s just three characters.

Together, they tell a story. Hand someone both pieces and they can recover the original name in milliseconds. The puzzle isn’t cryptographically hard (we explained why we made the key intentionally short), but it does require both halves. One is useless without the other.

This gives you a comfortable in-between mode of ownership: your prime can sit on your wall, in the public registry, on your business card — and unless you also publish the key, your name is hidden inside it like a riddle.

The decode link, by design

If you want a friend to take a crack at the puzzle, you can share a decode link that looks like this:

/decode?prime=<your-prime-number>&algorithm=a3.0

You’ll notice what’s not in there: the key. That’s deliberate. The key is meant to be entered manually on the decode page, by the person doing the decoding, with their hands, into a form field.

Why all the fuss about a three-character secret?

Why URLs are the wrong place for keys

URLs are strangely public things. Even when you mean to share a link with one specific person, the URL itself can leak in surprising ways:

• It gets stored in browser history — yours and the recipient’s, and anyone who borrows either device.
• It travels in the HTTP Referer header — meaning if the recipient clicks any link on the destination page, the URL (key included) is sent to that next site.
• It shows up in server access logs, both ours and any CDN or proxy in between, where it can sit for weeks or months.
• It often passes through analytics tools, link shorteners, password manager scanners, and browser extensions that quietly collect every URL you visit.
• It survives in chat-app previews and email clients that fetch the URL to generate a thumbnail before you’ve even sent the message.

None of those leaks are catastrophic — the key is, after all, intentionally puzzle-grade, not Fort Knox. But each of them quietly chips away at the “private until you decide otherwise” property we wanted to give you. Keeping keys out of URLs costs us nothing and protects you from a lot of small accidents.

So the design rule is simple: the prime can ride in the URL, the key cannot.

A practical sharing guide

Three modes you might use:

• Show off the prime. Send the prime by itself (or a decode link that includes only the prime). The recipient can admire the number, run primality checks, look it up in the registry. Without the key, that’s where the story stops.
• Share the puzzle. Send the prime and tell the recipient a key is needed. Let them know there’s a decode page where they can try keys until something works. (If they’re determined and have a script, 27,000 keys isn’t a long brute-force. If they’re a human in a hurry, it’s a fun puzzle.)
• Share the answer. Send the prime, then send the key separately — different message, different channel. SMS the prime, then read the key over the phone. Email the prime, then put the key on a sticky note inside the gift card. Two channels, no single point of leakage.

The simple rule

Share the prime if you want to share the puzzle. Share the key only when you want someone to solve it. And if you’re not sure — keep the key. You can always send it later. Once it’s out, it’s out.

The prime is yours to display. The key is yours to give.