Category: Security

HMAC combines a hash function with a shared secret key to prove a message is authentic and unaltered. Here is how it works and where you meet it.

A cryptographic hash turns any input into a fixed-size fingerprint that is one-way and collision-resistant. The properties that matter and what they enable.

The alg:none attack tricks a JWT verifier into accepting an unsigned token by trusting the header. Learn how it works and how to shut it down.

Password entropy measures unpredictability in bits. Learn how pool size and length set it, and why it only counts for truly random passwords.

JWTs are stateless and self-contained; session cookies are stateful and server-tracked. Learn the trade-offs in revocation, storage, and size.

A strong password is long, random, and unique to one account. Here is why those three properties matter more than symbols and clever substitutions.

SHA-256 pads a message, splits it into 512-bit blocks, and mixes each into a 256-bit state through 64 rounds. A plain walkthrough of every stage.

Both turn data into a short fixed value, but a checksum catches accidents while a cryptographic hash resists attackers. Here is when to use each.

How JWT expiry claims (exp, nbf, iat) work, why access and refresh tokens are split, and the security mistakes that keep breaking auth.

MD5 is 128-bit and broken for security; SHA-256 is 256-bit and sound for integrity. When each is fine, when it is dangerous, and what to use instead.