Encryption & Security

Three steps to verify the SHA-256 checksum of a downloaded file, plus the most common comparison mistakes.

Adding symbols is not always stronger. Password strength is about entropy, and length matters most. Practical rules and myths.

Encoding your password with Base64 does not make it safe. The real difference between encoding, encryption and hashing.

A JWT is not encrypted: anyone holding it can read the payload. Its three segments, signing vs encryption, and what never to put inside.

Three kinds of crypto work together in every HTTPS connection: asymmetric key exchange, symmetric encryption, hashing. Step by step.

Asymmetric crypto is not for bulk data. Key-size equivalents, RSA vs ECC trade-offs, and the split between encryption and signing.

AES is just a block cipher: the wrong mode or a reused IV breaks it. How GCM and CBC differ, and how to use them correctly.

Why SHA-256 is not enough for password storage: what salting fixes, what slow hashing fixes, and how to size bcrypt/Argon2.

Collect minimally, don't store secrets in plaintext, support erasure. Compliance is not just legal's job; it starts at data modeling.

String-built SQL is the most common breach entry. How injection works, why parameterized queries win, and the limits of ORMs and escaping.

MD5 / SHA are wrong for password storage. Salting and slow hashes like bcrypt / Argon2, plus what to do on a leak.

Why a 6-digit code helps, and what it does not. TOTP internals, three tiers of 2FA strength, and how to use them well.

One server certificate is not enough: the browser must follow the chain to a root it trusts. Chains, intermediate certs, trust anchors and common mistakes.

Why "log in with WeChat" never gives your password to the app. The authorization-code flow, access vs refresh tokens, and what PKCE adds.

Cookies live in the browser, sessions on the server. How login state relies on both, why JWT is mistaken for a session, and the security flags.