Field guides to applied cryptography
Answer-first explanations of the decisions developers actually face — which AES mode, which password hash, which SSH key — with every example reproduced in OpenSSL or the reference implementation, and a working tool for each concept.
Encoding vs Encryption vs Hashing: The Difference, With Examples
Encoding, encryption and hashing all turn data into gibberish, but only one keeps secrets. Learn the difference with real Base64, AES and SHA-256 examples and when to use each.
6 MIN READSYMMETRIC · AESAES-GCM vs CBC vs CTR vs ECB: Which AES Mode Should You Use?
AES is only as safe as its mode. Compare ECB, CBC, CTR and GCM — how each works, how each fails, and why AES-GCM (or ChaCha20-Poly1305) is the right default in 2026.
7 MIN READKDF · PASSWORDSArgon2id vs bcrypt vs scrypt vs PBKDF2: Password Hashing in 2026
Which password hashing algorithm should you use? A practical comparison of Argon2id, bcrypt, scrypt and PBKDF2 with OWASP-recommended parameters, hash formats, pitfalls and migration steps.
6 MIN READHASHING · HOW-TOHow to Verify a SHA-256 Checksum on Windows, macOS and Linux
Step-by-step commands to check a file's SHA-256 hash on Windows (PowerShell, certutil), macOS and Linux — plus how to verify the checksum file itself with GPG, and what a mismatch means.
5 MIN READHASHING · SECURITYIs MD5 Still Safe? When MD5 and SHA-1 Are (and Aren't) OK to Use
MD5 and SHA-1 are broken — but not for everything. Learn exactly which attacks exist, where MD5 and SHA-1 are still acceptable, where they are dangerous, and what to use instead.
5 MIN READJWT · WEB SECURITYHow to Decode a JWT — and 7 Security Mistakes That Get Tokens Forged
What's inside a JSON Web Token, how to decode and verify one safely, and the real-world JWT vulnerabilities — alg:none, key confusion, weak secrets — with the fix for each.
6 MIN READPUBLIC-KEY · SSHEd25519 vs RSA for SSH Keys: Which Should You Generate in 2026?
Ed25519 or RSA? Compare SSH key types on security, size, speed and compatibility, see the exact ssh-keygen commands, and learn what post-quantum SSH changes (and doesn't).
6 MIN READRANDOMNESS · PASSWORDSPassword Entropy Explained: How Strong Is Your Password, Really?
How password strength is actually measured: the entropy formula, a crack-time table for random passwords and passphrases, why human-chosen passwords score far lower, and current NIST rules.
6 MIN READPOST-QUANTUM · STANDARDSPost-Quantum Cryptography in 2026: What ML-KEM and ML-DSA Mean for You
A practical guide to post-quantum cryptography: what quantum computers break (and don't), the NIST standards ML-KEM, ML-DSA and SLH-DSA, where PQC is already deployed, and what to do now.
6 MIN READIDENTIFIERS · RFC 9562UUID v4 vs UUID v7: Which Should You Use for Database Keys?
UUIDv7 sorts by time and keeps database indexes fast; UUIDv4 is fully random. Compare their structure, collision odds, performance and privacy trade-offs, with code for Postgres, JavaScript and Python.
5 MIN READCLASSICAL · CRYPTANALYSISHow to Break a Vigenère Cipher Without the Key: A Worked Example
Step-by-step cryptanalysis of a real Vigenère ciphertext: find the key length with Kasiski examination and the index of coincidence, then recover each key letter with chi-squared frequency analysis.
8 MIN READ