Security
- How I check a file hash before trusting a download
When I download an installer, ISO image, backup, or release archive, I sometimes see a checksum published next to it: SHA256: 4a1f... That checksum is there so I can check whether my downloaded file is exactly the same …
- How I check a JWT when an API login looks broken
A JWT is one of those strings that looks scary the first time you see it. It often appears in a login response, browser storage, or an API request header:
- How I check a PDF digital signature without confusing it with a drawn signature
A PDF digital signature is cryptographic metadata. It is not the same thing as an image of a handwritten signature placed on a page. The PDF Signature Checker tool gives me a safe place to test the idea before I put it …
- How I check password strength without fooling myself
Password strength is easy to misunderstand. A password can look complicated but still be weak if it is short or predictable. The Password Strength tool estimates how hard a password may be to guess under stated …
- How I check whether an RSA public key and private key belong together
RSA uses a pair of keys. The private key signs or decrypts. The public key verifies or encrypts. The two keys are related, but the public key should not reveal the private key.
- How I create and check HMAC signatures for API requests
HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed. The HMAC Generator tool gives me a safe place to test the idea before I put it into a script, …
- How I generate SSH keys without losing track of what each file is
An SSH key pair has two parts: a private key that stays with you, and a public key that you can place on servers in authorized_keys. The SSH Key Generator tool gives me a safe place to test the idea before I put it into …
- How I read email headers when a message looks suspicious
An email header is the technical history of a message. It can show where the message claimed to come from, which servers handled it, and whether authentication checks passed. The visible email body can be misleading.
- How I test webhooks before trusting them
A webhook is a simple idea: one system sends an HTTP request to another system when something happens. For example: Stripe sends a webhook when a payment succeeds; GitHub sends a webhook when someone pushes code; Shopify …
- How I think about bcrypt when storing passwords
Passwords should not be stored as plain text. If a database leaks, plain text passwords immediately become everyone else’s problem too. For password storage, I want a password hashing function such as bcrypt.