Broken Nonce

Paste a Bitcoin address (or a transaction ID) to extract each input's ECDSA signature components — R, S, Z — then test every signature on its own for a broken or guessable nonce: a small fixed constant, a value copied from the message (k = z, r, s…), or a simple affine pattern k = a·z + b. When the nonce is weak, the private key is recovered in closed form from that single signature and verified against the on-chain public key. Everything runs in your browser.

bitcoin
Enter a Bitcoin address or a 64-character transaction ID (TXID). Balance and stats load for every chain; the transaction graph loads where a keyless explorer is available.
newest for the address (exactly this many are scanned; a single TXID fetches just that one transaction)
Each signature is tested on its own for a broken / guessable nonce — no parameters needed.
Balance 0 BTC
Received 0 BTC
TX 0 
Instructions:
1. Enter a Bitcoin address (recommended) or a 64-character TXID.
2. Every signature is tested on its own for a broken or guessable nonce — a small constant, a value copied from the message (k = z, r, s, ...), or a simple affine pattern k = a·z + b.
3. A private key is shown only when it regenerates the on-chain public key, so there are no false positives. A single weak signature is enough — no nonce reuse required.
4. An internet connection is required to fetch transaction data from public block explorers.
Educational / read-only tool. Transaction data is fetched live from public block-explorer APIs (blockstream.info, with blockchain.info as a fallback). Key recovery only succeeds on wallets whose signer used a weak, low-entropy or guessable nonce — it demonstrates why a broken RNG in ECDSA is catastrophic. Every result is verified against the on-chain public key; nothing is guessed. Never enter keys for wallets you use.