Elliptic Curve Visualizer

How to Use: Set a, b, and Prime p, Click Draw, and Select Points on the Plot

The elliptic curve visualizer shows the set of points that satisfy the equation y² = x³ + ax + b (mod p), meaning arithmetic with remainders after division by p. Everything you need is on one screen: three fields and a Draw button.

1. Set the coefficients a and b. The defaults are 2 and 3.
2. Enter a prime number p from 3 to 199. The default is 97.
3. Click Draw. When the page loads, the tool runs the same command automatically, so you immediately see the plot for the default values.
4. Click points on the plot. The first click selects point P, and the second selects point Q.
5. Read the result from the table: the sum P + Q appears, and if both clicks are the same point, you get 2P.

Each click selects a point. After two clicks, the next click starts a new selection, so you can immediately test another pair of points. The calculations run in your browser and are never sent anywhere.

How to Read the Formula y² = x³ + ax + b (mod p) and the Results Table

The notation “(mod p)” means we work with remainders after division by p. A point (x, y) belongs to the curve when the remainder of y² divided by p equals the remainder of x³ + ax + b divided by p. The coordinates x and y are numbers from 0 to p − 1.

The square of y and the square of p − y give the same remainder, so the points are symmetric about the horizontal axis. For each x, you check whether the right side of the equation is a square of some residue modulo p. If it is not, there is no point at that x.

The results table shows two rows: “Curve: y² = x³ + ax + b (mod p)” with the current values of a, b, and p, and “Number of points (including the point at infinity).” That number also includes the point O, so it is one greater than the number of dots visible on the plot.

For the default values: a = 2, b = 3, and p = 97. The curve is y² = x³ + 2x + 3 (mod 97), and the number of points is 100 including the point at infinity.

Adding Points on the Curve: Chord, Doubling 2P, and the Point at Infinity O

On the points of the curve, an addition operation is defined — it is not ordinary addition of coordinates.

Geometrically, for two different points P and Q, you draw a line through them. The line intersects the curve at a third point, and the result P + Q is the reflection of that point across the horizontal axis of symmetry. When P = Q, you use the tangent at P instead of a chord; that result is denoted 2P.

Algebraically, everything is modulo p. For P = (x₁, y₁) and Q = (x₂, y₂), where P ≠ Q, the slope is λ = (y₂ − y₁) ÷ (x₂ − x₁). For doubling, λ = (3x₁² + a) ÷ (2y₁). Then x₃ = λ² − x₁ − x₂ (mod p) and y₃ = λ·(x₁ − x₃) − y₁ (mod p), and the result is the point (x₃, y₃).

The point at infinity O acts as zero: O + Q = Q, P + O = P. The sum of two points with the same x-coordinate for which y₁ + y₂ ≡ 0 (mod p), meaning points symmetric about the horizontal axis, gives O — the table then shows the point at infinity instead of a pair of numbers.

Example for the default values (a = 2, b = 3, p = 97). On the curve y² = x³ + 2x + 3 (mod 97), the points P = (0, 10) and Q = (3, 6) lie on the curve. The slope is λ = (−4) · 65 ≡ 31 (mod 97), because 3 · 65 ≡ 1. Then x₃ = 31² − 0 − 3 ≡ 85 and y₃ = 31 · (0 − 85) − 10 ≡ 71, so P + Q = (85, 71). For the same P, doubling gives 2P = (65, 32).

Why p Must Be Prime and the Curve Must Be Nonsingular (4a³ + 27b² ≠ 0 mod p)

The formulas for point addition require division: by x₂ − x₁ or by 2y₁. Division modulo p is multiplication by the inverse, meaning the number that, when multiplied by the divisor, gives remainder 1. When p is prime, every nonzero remainder has an inverse, so division always works. For composite p, some numbers have no inverse and the arithmetic does not close.

The condition 4a³ + 27b² ≢ 0 (mod p) says that the curve is nonsingular. When this expression gives remainder 0, the equation describes a curve with a cusp or a self-intersection. At such a point the tangent is not unique, the formula for 2P stops working, and the set of points does not form a proper group.

The range p from 3 to 199 follows from how points are counted: all pairs x, y from 0 to p − 1 are checked. This keeps the picture of the curve complete and fits it on one plot.

Limitations and What the Tool Does Not Compute

The tool is a demonstrator of arithmetic on small curves. It is limited to prime numbers p no greater than 199, because only then can it show all points on one plot and let you click them one by one. Cryptographic curves have p hundreds of digits long — such sets cannot be drawn or inspected visually.

What you will not find here:

• a smooth curve line — you see the set of points, not the continuous path of the equation;
• the order of the group, the order of a single point, or the order of a subgroup; the table gives only the total number of points including O;
• a group generator and a check of whether a given point is one;
• scalar multiplication, meaning multiples such as kP — you add two points at a time;
• cryptographic applications: key agreement, digital signatures, encryption;
• an assessment of whether the curve is suitable for a specific use — that requires knowledge of the group structure.

A third click on the plot starts a new selection, so you cannot sum three points in one step. Want to follow a longer calculation? Save the intermediate result and use it as the next point.

Frequently Asked Questions

This tool runs entirely locally in your browser on very small prime fields and is for educational purposes only — it is not suitable for verifying cryptographic parameters, and no fees apply (the $ currency is not used).