Security
Practical guides on cryptography, authentication, and secure coding. Covers JWT, hashing algorithms, HMAC, Base64 encoding, and password security - with code examples and common pitfalls to avoid.
What Actually Leaks When You Paste a JWT Into an Online Decoder
Decoding a JWT is trivial - the real risk is that the token is a live credential, and pasting the HS256 secret is far worse. How to check any decoder.
What Actually Happens Inside a Password Generator
Inside a secure password generator: CSPRNG vs PRNG, modulo bias and rejection sampling, and guaranteeing character classes without leaking entropy.
Password Generator or Passphrase? How I Choose in 2026
When to use a random password generator versus a diceware passphrase, how passkeys change the picture, and a use-case matrix for every secret.
Diceware Passphrases: Why I Stopped Memorising Random Strings
The EFF Large word list, the entropy maths, separator and capitalisation trade-offs, and where passphrases beat random strings - with code examples.
RSA Key Pair Generation: Fifteen Years of `genpkey` and the Decisions Tutorials Skip
Generating RSA keys with OpenSSL and Web Crypto: key sizes, PEM vs JWK, PKCS standards, storage and rotation - and when to use elliptic curves.
HMAC Explained: Data Signing, JWT, and Protection Against Tampering
How HMAC works with inner and outer padding, why it beats plain hashing, JWT signing, API request signatures and timing attacks - with examples.
URL Encoding Explained: Percent-Encoding, Reserved Characters, and Common Mistakes
RFC 3986 in practice: reserved vs unreserved characters, query string and form encoding, double encoding, and the mistakes that corrupt parameters.
MD5, SHA-1, SHA-256, SHA-512: Which Hashing Algorithm to Choose
Hash functions compared: MD5, SHA-1, SHA-2 and SHA-3, real collision attacks, password hashing with bcrypt and Argon2, and what to use today.
Password Security and Entropy: Why Length Beats Complexity
How password entropy is calculated, character sets versus length, passphrases vs random strings, and what brute force really costs an attacker.
Base64 Encoding Explained: How It Works and When to Use It
How Base64 works: the encoding algorithm, standard vs URL-safe vs MIME variants, real use cases and common mistakes, with code in PHP and Python.
JWT Deep Dive: Structure, Algorithms, and Security Pitfalls
JSON Web Tokens in depth: the three-part structure, HS256 vs RS256 vs ES256, standard claims, and the security mistakes that keep showing up.
Hashing, Signing, and the Difference Nobody Explains
The most common mistake in this area is treating encoding, hashing and signing as points on one scale of "security". They are three unrelated operations. Base64 is a transport format with no secrecy at all - Base64 encoding explained covers why "it's base64'd" never means "it's safe". Percent-encoding solves a different problem again, and gets its own set of traps in URL encoding explained, where double-encoding quietly corrupts parameters.
Hashing is one-way and unkeyed; the algorithm comparison goes through MD5, SHA-1, SHA-2 and SHA-3 with the collision attacks that broke the first two, and explains why password storage needs bcrypt or Argon2 rather than any of them. Add a key and you get HMAC, which is what actually protects webhooks and API requests from tampering - HMAC explained walks through the inner and outer padding and why timing-safe comparison matters. Tokens combine several of these at once, unpacked in the JWT deep dive.
On the secrets side, the practical question is passwords or passphrases. Entropy explains why length beats punctuation, Diceware covers the EFF word list, and the decision guide maps each to the secrets you actually handle. If you want to know what a generator is doing internally - CSPRNG choice, modulo bias, rejection sampling - that is here too. Key generation is covered separately in the RSA guide.
The matching tools all run client-side via the Web Crypto API: hash, HMAC, JWT decoder, password, passphrase and RSA key pair.