Encryption & Security

Three steps to verify the SHA-256 checksum of a downloaded file, plus the most common comparison mistakes.

Adding symbols is not always stronger. Password strength is about entropy — and length matters most. Practical rules and myths.

Encoding your password with Base64 does not make it safe. The real difference between encoding, encryption and hashing.

A JWT is not encrypted: anyone holding it can read the payload. Its three segments, signing vs encryption, and what never to put inside.

Three kinds of crypto work together in every HTTPS connection: asymmetric key exchange, symmetric encryption, hashing. Step by step.

Asymmetric crypto is not for bulk data. Key-size equivalents, RSA vs ECC trade-offs, and the split between encryption and signing.

AES is just a block cipher: the wrong mode or a reused IV breaks it. How GCM and CBC differ, and how to use them correctly.

Why SHA-256 is not enough for password storage: what salting fixes, what slow hashing fixes, and how to size bcrypt/Argon2.

Collect minimally, don't store secrets in plaintext, support erasure. Compliance is not just legal's job; it starts at data modeling.

String-built SQL is the most common breach entry. How injection works, why parameterized queries win, and the limits of ORMs and escaping.

MD5 / SHA are wrong for password storage. Salting and slow hashes like bcrypt / Argon2, plus what to do on a leak.

Why a 6-digit code helps, and what it does not. TOTP internals, three tiers of 2FA strength, and how to use them well.

One server certificate is not enough: the browser must follow the chain to a root it trusts. Chains, intermediate certs, trust anchors and common mistakes.

Why "log in with WeChat" never gives your password to the app. The authorization-code flow, access vs refresh tokens, and what PKCE adds.

Cookies live in the browser, sessions on the server. How login state relies on both, why JWT is mistaken for a session, and the security flags.