https://ilham.dev/tags/security/Recent content in Security on ilham.devHugo -- gohugo.ioenSun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-build-an-http-header-block/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-build-an-http-header-block/Building headers from key/value rows helps avoid typo-heavy manual header blocks. I use HTTP Header Builder for the quick version of this task, then I review the output before relying on it.https://ilham.dev/posts/how-to-check-a-file-hash-before-trusting-a-download/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-check-a-file-hash-before-trusting-a-download/When I download an installer, ISO image, backup, or release archive, I sometimes see a checksum published next to it: SHA256: 4a1f... That checksum is there so I can check whether my downloaded file is exactly the same file the publisher intended to provide.https://ilham.dev/posts/how-to-read-and-verify-jwt/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-read-and-verify-jwt/A JWT is one of those strings that looks scary the first time you see it. It often appears in a login response, browser storage, or an API request header:https://ilham.dev/posts/how-to-check-digital-signatures-in-pdfs/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-check-digital-signatures-in-pdfs/A PDF digital signature is cryptographic metadata. It is not the same thing as an image of a handwritten signature placed on a page. The PDF Signature Checker tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.https://ilham.dev/posts/how-to-check-password-strength-without-fooling-yourself/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-check-password-strength-without-fooling-yourself/Password strength is easy to misunderstand. A password can look complicated but still be weak if it is short or predictable. The Password Strength tool estimates how hard a password may be to guess under stated assumptions.https://ilham.dev/posts/how-to-check-whether-rsa-keys-match/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-check-whether-rsa-keys-match/RSA uses a pair of keys. The private key signs or decrypts. The public key verifies or encrypts. The two keys are related, but the public key should not reveal the private key.https://ilham.dev/posts/how-to-create-and-check-hmac-signatures/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-create-and-check-hmac-signatures/HMAC proves that a message was created by someone who knows the shared secret, and that the signed message has not changed. The HMAC Generator tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.https://ilham.dev/posts/how-to-decode-outlook-safelinks-before-clicking/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-decode-outlook-safelinks-before-clicking/Outlook SafeLinks wrap a destination URL inside a Microsoft protection URL. Decoding helps reveal where the link wants to go. The SafeLink Decoder tool helps with the mechanical part, but I still check the result before using it somewhere real.https://ilham.dev/posts/how-to-escape-html-entities-before-showing-text/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-escape-html-entities-before-showing-text/HTML entities let text contain characters like <, >, and & without the browser treating them as markup. The HTML Entities tool helps with the mechanical part, but I still check the result before using it somewhere real.https://ilham.dev/posts/how-to-generate-random-tokens-with-enough-entropy/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-generate-random-tokens-with-enough-entropy/A good token should be random enough that guessing it is unrealistic. The Token Generator tool helps with the mechanical part, but I still check the result before using it somewhere real.https://ilham.dev/posts/how-to-generate-ssh-keys-safely/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-generate-ssh-keys-safely/An SSH key pair has two parts: a private key that stays with you, and a public key that you can place on servers in authorized_keys. The SSH Key Generator tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.https://ilham.dev/posts/how-to-read-email-headers/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-read-email-headers/An email header is the technical history of a message. It can show where the message claimed to come from, which servers handled it, and whether authentication checks passed. The visible email body can be misleading.https://ilham.dev/posts/how-to-test-webhooks-safely/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-test-webhooks-safely/A webhook is a simple idea: one system sends an HTTP request to another system when something happens. For example: Stripe sends a webhook when a payment succeeds; GitHub sends a webhook when someone pushes code; Shopify sends a webhook when an order is created.https://ilham.dev/posts/how-to-hash-passwords-with-bcrypt/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-hash-passwords-with-bcrypt/Passwords should not be stored as plain text. If a database leaks, plain text passwords immediately become everyone else’s problem too. For password storage, I want a password hashing function such as bcrypt.https://ilham.dev/posts/how-to-understand-bip39-seed-phrases/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-understand-bip39-seed-phrases/A BIP39 mnemonic is a human-readable backup for wallet seed material. Anyone who has the words can often control the wallet. The BIP39 Mnemonic tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.https://ilham.dev/posts/how-to-use-otp-codes-without-mystery/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-use-otp-codes-without-mystery/Most authenticator apps use TOTP: a short code generated from a shared secret and the current time. The OTP Generator tool gives me a safe place to test the idea before I put it into a script, server, or production workflow.https://ilham.dev/posts/how-to-understand-snap-bi-asymmetric-signature/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-understand-snap-bi-asymmetric-signature/SNAP BI signatures can feel confusing because they combine several ideas at once: HTTP method; URL path; request body hash; timestamp; RSA private and public keys; a signature header. When all of those appear together, it is easy to get lost.https://ilham.dev/posts/how-to-use-aes-encryption-for-text/Sun, 27 Sep 2026 00:00:00 +0700https://ilham.dev/posts/how-to-use-aes-encryption-for-text/AES is for keeping text confidential. It is different from hashing: encrypted text is meant to be decrypted later with the right key, while a hash is not meant to be reversed.