Category: Security

A strong password is long, random, and unique to one account. Here is why those three properties matter more than symbols and clever substitutions.

SHA-256 pads a message, splits it into 512-bit blocks, and mixes each into a 256-bit state through 64 rounds. A plain walkthrough of every stage.

Both turn data into a short fixed value, but a checksum catches accidents while a cryptographic hash resists attackers. Here is when to use each.

How JWT expiry claims (exp, nbf, iat) work, why access and refresh tokens are split, and the security mistakes that keep breaking auth.

MD5 is 128-bit and broken for security; SHA-256 is 256-bit and sound for integrity. When each is fine, when it is dangerous, and what to use instead.

Why committed API keys and tokens are dangerous, regex patterns to hunt them down, why you must rotate first, and how to purge them from Git history.

Why you never store plaintext, why fast hashes like MD5 are wrong for passwords, and how salts and slow KDFs (bcrypt, scrypt, Argon2) protect them.

Pasting a live JWT or API key into a random online decoder can leak it to a server. How to tell if a tool is client-side, and why it matters.

What “runs in the browser” really means, how to verify no data leaves your machine with the DevTools Network tab and CSP, and why client-side tools are safer for sensitive input.