A useful place to start
Encryption vs Encoding vs Hashing: What Each One Does
A clear decision guide to choosing encryption, encoding, or hashing so you use the right tool for the job.
Encrypt Online field notes
Security and data, explained plainly.
Short, practical guides for the moments when a token fails, a certificate looks wrong, or two formats that seem alike behave very differently.
115 maintained guides
Browse the library
Find the note you need
115 guides, ordered by most recently updated.
Certificate Chain Basics for Beginners
A beginner-friendly explanation of leaf certificates, intermediates, and why chain issues break trust.
Converting certificate formats without losing the private key or chain
A safe conversion workflow for certificate containers so you preserve the exact material you need instead of discovering too late that the key or intermediate was dropped.
CSP hashes and nonces for small static sites that still want strict script rules
Use CSP hashes and nonces intentionally by matching them to static or dynamic site architectures instead of treating them as interchangeable syntax.
How to Inspect an X.509 Certificate in Plain English
A practical way to read issuer, subject, SANs, validity, fingerprints, and signature details without getting lost in certificate jargon.
HTTPS Migration Basics for Small Sites
A practical migration guide for moving a small website from HTTP to HTTPS with fewer surprises.
OAuth Callback URL Mismatch Debugging
Redirect URI mismatch errors usually come from small string differences. Compare the callback value, environment, path, port, and encoding before changing provider or application settings.
OIDC Discovery URL and Metadata Explained
Understand what the OIDC discovery document is, which metadata fields matter first, and how to debug auth setup when issuer, jwks_uri, or authorization endpoints do not line up.
PKCS#12 / PFX vs PEM vs JKS: choosing the right certificate container for deployment
Choose the right certificate container by understanding what each format holds, what platforms expect, and where conversion mistakes usually happen.
Subresource Integrity for CDN assets: when a hash helps and when it breaks deploys
Use SRI deliberately for external scripts and stylesheets by understanding when fixed hashes improve trust and when mutable assets make them painful.
What Is Inside a PEM File?
Understand PEM boundary lines, Base64 content, and the block types that tell you whether you are looking at a certificate, a key, or a CSR.
Why certificate chain order matters and how to fix broken bundles
Understand leaf and intermediate ordering so your certificate bundle can actually be validated by clients instead of looking correct in a text editor.
A Let’s Encrypt Renewal Checklist That Prevents Expiry Surprises
A practical renewal checklist covering challenge continuity, automation, notifications, and post-renewal deploy steps.
ACME in plain English: account keys, challenges, orders, and renewal state
A plain-language ACME guide that explains what your Let’s Encrypt tooling is actually doing during issuance and renewal.
AES-CBC vs AES-GCM: what changed and why modern libraries default differently
Compare AES-CBC and AES-GCM, including integrity, IVs, authentication tags, AAD, and common decryption failures.
Authenticated encryption explained: why confidentiality without integrity is not enough
A practical guide to authenticated encryption and why “encrypted” does not automatically mean “safe from tampering.”
AWS Signature Version 4 canonical requests: every byte that changes the signature
A practical SigV4 guide that explains canonical requests, signed headers, and the normalization details behind SignatureDoesNotMatch.
Base32 vs Base64 when humans, QR codes, or secrets are involved
Choose between Base32 and Base64 by looking at readability, transcription risk, and the workflows where each encoding is a better fit.
Base64 Is Not Encryption: What It Actually Does
A direct explanation of why Base64 is for representation and transport, not secrecy, plus the right moments to use it.
Base64URL padding mistakes that break tokens, PKCE, and signed URLs
Learn how omitted padding and alphabet differences create subtle failures in tokens, PKCE code challenges, and signed URL workflows.
Base64URL vs Base64: What Changes on the Web
A practical guide to the differences between standard Base64 and URL-safe Base64 so you stop breaking tokens and query values.
Bcrypt Cost Factor Explained in Plain English
How bcrypt cost works, why slower can be safer, and how to think about tuning without turning your login flow into a support issue.
Binary-to-text encodings: Base16, Base32, Base64, and how to choose under pressure
A decision guide for Base16, Base32, and Base64 that starts from the job to be done instead of treating every encoding as interchangeable.
Blowfish vs Modern Encryption for Legacy Data Workflows
When Blowfish still shows up, how to use it carefully for compatibility, and why modern workflows usually point elsewhere.
Browser-Side Cryptography: What It Protects and What It Does Not
A plain-English explanation of the strengths and limits of browser-side protection so you can use local tools with realistic expectations.
Building a privacy-first debugging workflow in the browser for tokens, keys, and payloads
A capstone guide to using browser-first tools responsibly for sensitive debugging without turning random paste bins into part of your security workflow.
Building Simple Checksum Workflows with SHA-256
A clean workflow for generating, comparing, and documenting SHA-256 fingerprints for files, strings, and deployment handoffs.
Canonical JSON for signing and hashing: why whitespace and key order are not enough
Use canonical JSON when signatures or hashes must survive formatting differences instead of relying on pretty-printing conventions.
Capturing Raw Request Bodies for Webhook Verification in Node, Express, and Next.js
Preserve the exact request bytes before parsing JSON so Stripe, GitHub, and other webhook signatures stop failing for boring reasons.
Certificate File Types Explained: CRT, PEM, DER, KEY, and More
Understand the file extensions and encodings that appear in certificate and key workflows.
Certificate fingerprints, serial numbers, and what each one is good for
Stop mixing up certificate fingerprints, serial numbers, subjects, and issuers by learning what each identifier is actually for.
Choosing the Right Encrypt Online Tool for Text, Files, Links, PDFs, and More
A practical selector guide so visitors land on the right tool first instead of bouncing between similar-looking workflows.
Clean Copy-Paste Workflows for JSON, YAML, and XML
Reduce broken payloads and formatting mistakes when moving structured text between tools, docs, and tickets.
Common JWT Claim Validation Mistakes That Break Trust
A valid JWT signature is not enough. These are the claim checks teams skip when issuer, audience, timing, and token type actually decide whether a token should be accepted.
Common Mistakes When Sharing Encrypted Secrets
The most common ways good encryption workflows fail in practice, and the fixes that make them dependable for real handoffs.
Common RS256 and ES256 JWT verification failures and how to isolate each one
A failure-led guide to diagnosing JWT verification issues in RS256 and ES256 workflows without guessing at keys or claims.
Comparing secrets safely: why constant-time comparison exists and when it matters
A practical guide to timing-safe comparison so secret verification code does not leak more information than intended.
Cron and daylight saving time: what really runs twice, once, or not at all
Understand how daylight saving transitions affect cron schedules so recurring jobs stop surprising you every spring and fall.
CSV and JSON Conversion for Data Workflows
Move data between rows and structured objects without losing track of where each format works best.
CSV import traps: quotes, delimiters, embedded newlines, encoding, and BOMs
A practical CSV guide that explains why simple-looking files still fail once they move between spreadsheets, databases, APIs, and shell scripts.
Encrypted Links and Passphrases: A Better Way to Share Sensitive URLs
How to share internal docs, staging URLs, and one-off destinations more safely by encrypting the link and sending the passphrase separately.
Encryption vs Encoding vs Hashing: What Each One Does
A clear decision guide to choosing encryption, encoding, or hashing so you use the right tool for the job.
Expiration math for tokens, signed URLs, and cache TTLs
A practical guide to expiry windows so tokens, signed URLs, and cached content stay valid for exactly as long as you intended.
File Encryption Before Sharing: A Simple Workflow That Works
How to encrypt a file, verify the output, share it safely, and avoid the handoff mistakes that break real-world file sharing.
File integrity vs file secrecy: checksum, signature, or encryption?
Pick the right primitive for files by separating integrity checks, origin verification, and confidentiality instead of reaching for one tool for every job.
First-Response Outage Triage for Small Websites
A calm, ordered checklist for the first few minutes of a website incident.
Hex and ASCII Conversion Basics for Debugging and Inspection
How to move between Hex and ASCII when reading payloads, logs, and low-level outputs without losing track of what the data represents.
HMAC vs digital signatures for APIs and webhooks
Choose between shared-secret HMAC and public-key signatures by comparing trust model, rotation, verification scope, and operational overhead.
How JWKS Key Rotation Works Without Breaking JWT Verification
A practical guide to `kid`, JWKS caching, and key rollover so JWT verification failures make sense when the signing key changes.
How to choose the right JWKS key by kid and what to do when it is missing
Learn how to match a JWT to the correct key in a JWKS document and how to handle tokens that arrive without a usable kid.
How to Decode Base64 JSON and XML Payloads Without Losing Context
A clean workflow for inspecting Base64-wrapped API payloads and immediately turning them back into readable JSON or XML.
How to Decrypt Text with OpenSSL
Decrypt OpenSSL enc output by matching its cipher, PBKDF2, digest, salt, and Base64 settings, then verify the recovered bytes.
How to Diff Structured Data and Config Files Without Missing the Real Change
A step-by-step workflow for comparing JSON, YAML, XML, and text with fewer false positives.
How to Encrypt Text in Your Browser Safely
A practical workflow for encrypting short text in the browser, testing decryption, and sharing the passphrase the right way.
How to Encrypt Text with OpenSSL
Encrypt text with OpenSSL using a salted PBKDF2 recipe, preserve the settings needed for decryption, and verify the exact result.
How to inspect a UUID or GUID and tell what version it is saying about itself
Learn how to read UUID version and variant bits so existing identifiers stop being opaque strings in logs and payloads.
How to Password-Protect a PDF Online Safely
A practical guide to protecting PDFs with a password, checking the result, and choosing the right sharing flow afterward.
How to read a CSR: SANs, common name, and what actually ends up in the certificate
A practical CSR guide that explains what you are really requesting, what CAs use, and why SANs matter more than the old common-name habit.
How to Remove Secrets From Logs Before Sharing
A practical guide to redacting tokens, cookies, API keys, and .env values before you paste logs into tickets, chat, or incident docs.
How to split emergency recovery secrets without creating new failure modes
A practical operational guide to recovery secret splitting that focuses on custody, labeling, rehearsal, and survivable recovery.
How to Use a Let’s Encrypt Certbot Command Generator Safely
Use a command generator to speed up certificate setup while still understanding what the flags and challenge choices mean.
How to Verify a Bcrypt Hash Without Guessing What the System Did
A clean workflow for checking plaintext against a bcrypt hash and understanding what successful verification really proves.
How to verify a downloaded artifact with SHA-256, signatures, or SRI
Choose the right verification method for a downloaded artifact by comparing local checksums, public signatures, and browser-side integrity checks.
How to Verify a Webhook Signature
Verify webhook signatures with the exact raw request body, the correct secret, and constant-time comparison so replay and tampering bugs are easier to spot.
HTML Formatter and PHP Beautifier: A Faster Review Workflow
Use formatting to review markup and PHP templates faster before publishing or comparing changes.
HTML, Markdown, and Text Conversion Workflows That Preserve Meaning
How to move content between HTML, Markdown, and plain text without turning a small cleanup task into formatting chaos.
HTTP-01 vs DNS-01: Picking the Right Let’s Encrypt Challenge
Choose the right validation method for issuance and renewal based on your hosting, DNS control, and certificate scope.
ID Token vs Access Token vs Refresh Token in Plain English
These token types are not interchangeable. Know which token proves login, which one authorizes APIs, and which one should stay out of front-end logs and requests.
JavaScript Object vs JSON: The Difference That Breaks Quick Fixes
Understand why JavaScript object literals and JSON look similar but are not interchangeable.
JSON Lint vs Format vs Minify: Which Tool to Use and When
Use the right JSON workflow by knowing when to validate, pretty-print, compress, or restore JSON.
JSON Patch for partial updates: add, replace, remove, move, copy, and test
Learn how JSON Patch operations behave in practice so partial updates feel predictable instead of risky.
JSON Pointer explained with real escaping examples: ~0, ~1, arrays, and root
A practical JSON Pointer guide that makes escaping, arrays, and root paths readable instead of magical.
JSON Schema validation: stop guessing what shape an API accepts
Use JSON Schema as a contract, not just a lint check, so payload validation becomes predictable and explainable.
JSON to Base64 for Transport and Storage: A Practical Workflow
How to encode JSON for text-only transport, inspect it later, and avoid turning encoding into accidental confusion.
JSON vs YAML for Config Files: How to Choose
Choose the right config format by balancing readability, tooling, strictness, and conversion needs.
JSONPath vs JSON Pointer: selecting values vs addressing exact locations
Understand when you need a query language like JSONPath and when you need an exact address like JSON Pointer.
JWK thumbprints and key identifiers: stable IDs for rotating keys
Use JWK thumbprints to create stable cryptographic key identifiers and understand how they differ from free-form kid values.
JWK vs JWKS vs PEM: Which key format your JWT verifier actually needs
A practical guide to JWK, JWKS, and PEM so you can feed the right key material into JWT verification and conversion workflows.
JWS vs JWE: Why some JWTs can be read and others cannot
Understand the difference between signed and encrypted JOSE objects so you know when decode is possible and when it is not.
JWT claim debugging in practice: exp, nbf, iat, iss, aud, and clock skew
A practical walkthrough of the JWT claims that break most often in staging and production, especially around time and audience validation.
JWT Decode vs JWT Verify: What Each Step Actually Proves
Decode tells you what a token says. Verify tells you whether you should trust it. Use both in the right order when auth debugging gets noisy.
Migrating from MD5 to Bcrypt Without Breaking Logins
A practical migration pattern for teams moving away from legacy MD5 password storage toward a safer password-hash workflow.
Milliseconds vs seconds vs microseconds: finding the one-unit bug in logs
A practical timestamp debugging guide for spotting unit mistakes quickly when values in logs or APIs look almost right.
Nested JSON to CSV: when flattening helps and when it destroys meaning
A practical guide to flattening nested JSON into CSV without pretending every tree-shaped structure belongs in rows and columns.
PEM vs DER for Certificates and Keys: What the Difference Really Is
A practical explanation of PEM and DER formats so certificate and key conversions stop feeling mysterious.
Percent-Encoded URLs: A Debugging Guide for Real Requests
How to read encoded URLs from logs and network traces, isolate the broken layer, and repair the value without guessing.
PGP Encryption Guide: OpenPGP Keys, Encryption, and Signatures
Learn the practical OpenPGP workflow with GnuPG: verify a key fingerprint, encrypt and decrypt a message, and check signatures correctly.
Ping Basics for Site Owners: What Ping Can and Cannot Tell You
Use ping as a quick network signal without confusing it for full application monitoring.
PKCE code verifier vs code challenge: exact bytes, exact encoding, common errors
A practical PKCE guide that shows the relationship between the verifier and challenge and the exact encoding steps that usually go wrong.
PKCS#1 vs PKCS#8 vs SPKI: decoding private and public key labels without guessing
Understand common PEM labels and the structures they represent so you can stop renaming files and start importing the right thing.
Pre-Launch Security and Data Handling Checklist for Small Tools and Websites
A practical pre-launch checklist for teams publishing small web tools, forms, and content experiences.
Replay windows, timestamp drift, and why signed requests sometimes fail at the edge
Connect signed-request freshness checks to clock drift and replay windows so HMAC and SigV4 failures stop feeling random.
RFC 3339, ISO 8601, and Unix time: the timestamp formats every API team confuses
A practical guide to the timestamp formats that show up in APIs, logs, and tokens, with clear rules for units, offsets, and normalization.
RSA-OAEP vs RSA signatures: two workflows, two threat models, two failure patterns
Learn why RSA encryption and RSA signatures solve different problems and how to keep padding, purpose, and tooling straight.
Salts, Peppers, and Password Storage Basics
A practical explanation of salts and peppers, what problem each one solves, and where teams often misunderstand the difference.
Secure Password Reset Design Basics for Small Teams
A plain-language guide to reset flows that respect password hashing, avoid recoverability traps, and reduce support pain.
SHA-256 vs MD5 vs Bcrypt: When to Use Each One
A practical chooser for checksums, integrity fingerprints, and password storage so you pick the right hash workflow the first time.
Storing API Secrets and Passphrases Safely: Quick Rules That Prevent Bigger Problems
Where quick browser tools help, where they stop helping, and the rules teams should follow for secret material that must remain recoverable.
Text Normalization Before Publishing or Encrypting
Clean up case, spacing, counts, and formatting before you encrypt, convert, or publish text-based content.
Threshold sharing for real teams: when Shamir helps and when it is overkill
A practical Shamir guide that shows where threshold sharing reduces real risk and where simpler backup or access-control patterns are the better answer.
ULID vs UUID v7: sortability, timestamps, and operational tradeoffs
Compare ULID and UUID v7 by looking at sort order, timestamp visibility, text form, and ecosystem fit instead of treating one as universally better.
URL Encoding and Decoding Guide for Query Strings and Form Values
How to encode and decode query values correctly so spaces, symbols, and special characters survive web transport.
Using cron expressions to model business schedules without waking up at 2 AM
Use cron expressions for weekday and business-hour schedules without forgetting the time-zone and DST realities behind the expression.
UTC offsets are not time zones: why -05:00 is not America/New_York
Learn why a numeric UTC offset cannot replace a real time zone when future local-time behavior matters.
UUID v1 vs v4 vs v7: picking an identifier you can live with later
A practical UUID guide that compares privacy, sortability, and operational behavior before your identifier choice gets baked into logs, databases, and APIs.
Webhook signature verification: why the raw body matters more than your parsed JSON
Learn why webhook verification often fails after a framework parses the body and how to keep the exact bytes required for HMAC checks.
What Token Introspection Is and When to Use It
Token introspection answers whether a token is active right now, but it is not the right tool for every JWT. Use it when revocation, opaque tokens, or central policy checks matter.
When MD5 Is Still Okay — and When It Definitely Is Not
A realistic guide to the remaining checksum-style uses of MD5 and the places where modern workflows should move elsewhere.
When to use Ed25519 instead of RSA for signatures and tooling
Compare Ed25519 and RSA for signing workflows by looking at compatibility, key size, signature size, and developer ergonomics.
Why Passwords Need Hashing, Not Encryption
The difference that matters most in authentication design: passwords should be verified, not recoverable.
Why You Should Always Run a Decrypt Test Before You Send
A small step that prevents a disproportionate number of support requests, broken handoffs, and lost time in encrypted workflows.
Wildcard vs Single-Domain Certificates: Which One Fits Your Site
Choose the right certificate scope by balancing simplicity, DNS requirements, and operational risk.
XML Format, Minify, and Convert: A Practical XML Workflow
Handle XML safely by formatting for review, minifying for transport, and converting only when another format is required.
XML namespaces explained for people who just need the payload to parse
A practical XML namespace guide that explains prefixes, URIs, and default namespaces without turning into a theory lecture.
XML to Base64 for Transport and Legacy Integrations
How to wrap XML in Base64 for transport, decode it again cleanly, and keep old integration workflows readable.
YAML Lint, Format, and Convert: A Safe Workflow for Config Files
A practical guide to validating, formatting, and converting YAML without breaking indentation-sensitive configs.