A useful place to start
Encryption vs Encoding vs Hashing
A clear decision guide to choosing encryption, encoding, or hashing so you use the right tool for the job.
Encrypt Online guides
Security and data, explained plainly.
Short, practical guides for the moments when a token fails, a certificate looks wrong, or two formats that seem alike behave very differently.
Browse the library
Find the guide you need
116 guides, ordered by most recently updated.
A Let’s Encrypt Renewal Checklist That Prevents Expiry Surprises
A practical renewal checklist covering challenge continuity, automation, notifications, and post-renewal deploy steps.
ACME Explained
A plain-language ACME guide that explains what your Let’s Encrypt tooling is actually doing during issuance and renewal.
AES-CBC vs AES-GCM in Modern Libraries
Compare AES-CBC and AES-GCM, including integrity, IVs, authentication tags, AAD, and common decryption failures.
Authenticated Encryption Explained
A practical guide to authenticated encryption and why “encrypted” does not automatically mean “safe from tampering.”
AWS SigV4 Canonical Request Byte Matching
A practical SigV4 guide that explains canonical requests, signed headers, and the normalization details behind SignatureDoesNotMatch.
Base32 vs Base64 when humans, QR codes, or secrets are involved
Choose between Base32 and Base64 by looking at readability, transcription risk, and the workflows where each encoding is a better fit.
Base64 Is Not Encryption
A direct explanation of why Base64 is for representation and transport, not secrecy, plus the right moments to use it.
Base64URL vs Base64 on the Web
A practical guide to the differences between standard Base64 and URL-safe Base64 so you stop breaking tokens and query values.
Blowfish vs Modern Encryption for Legacy Data Workflows
When Blowfish still shows up, how to use it carefully for compatibility, and why modern workflows usually point elsewhere.
Browser-Side Cryptography Explained
A plain-English explanation of the strengths and limits of browser-side protection so you can use local tools with realistic expectations.
Building a privacy-first debugging workflow in the browser for tokens, keys, and payloads
A capstone guide to using browser-first tools responsibly for sensitive debugging without turning random paste bins into part of your security workflow.
Building Simple Checksum Workflows with SHA-256
A clean workflow for generating, comparing, and documenting SHA-256 fingerprints for files, strings, and deployment handoffs.
Canonical JSON for Signing and Hashing
Use canonical JSON when signatures or hashes must survive formatting differences instead of relying on pretty-printing conventions.
Capturing Raw Request Bodies for Webhook Verification in Node, Express, and Next.js
Preserve the exact request bytes before parsing JSON so Stripe, GitHub, and other webhook signatures stop failing for boring reasons.
Certificate Chain Basics for Beginners
A beginner-friendly explanation of leaf certificates, intermediates, and why chain issues break trust.
Certificate File Types Explained
Learn how CRT, CER, PEM, DER, KEY, P7B, and P12 files differ by encoding and container, then choose the correct format for certificate deployment tasks.
Checksum, Signature, or Encryption for File Integrity and Secrecy
Pick the right primitive for files by separating integrity checks, origin verification, and confidentiality instead of reaching for one tool for every job.
Choosing Base16, Base32, or Base64 for Binary-to-Text Encoding
A decision guide for Base16, Base32, and Base64 that starts from the job to be done instead of treating every encoding as interchangeable.
Clean Copy-Paste Workflows for JSON, YAML, and XML
Reduce broken payloads and formatting mistakes when moving structured text between tools, docs, and tickets.
Common JWT Claim Validation Mistakes That Break Trust
A valid JWT signature is not enough. These are the claim checks teams skip when issuer, audience, timing, and token type actually decide whether a token should be accepted.
Common Mistakes When Sharing Encrypted Secrets
The most common ways good encryption workflows fail in practice, and the fixes that make them dependable for real handoffs.
Common RS256 and ES256 JWT verification failures and how to isolate each one
A failure-led guide to diagnosing JWT verification issues in RS256 and ES256 workflows without guessing at keys or claims.
Constant-Time Comparison Explained
A practical guide to timing-safe comparison so secret verification code does not leak more information than intended.
Converting certificate formats without losing the private key or chain
A safe conversion workflow for certificate containers so you preserve the exact material you need instead of discovering too late that the key or intermediate was dropped.
Cron and Daylight Saving Time
Understand how daylight saving transitions affect cron schedules so recurring jobs stop surprising you every spring and fall.
CSV Import Traps With Delimiters, Newlines, Encoding, and BOMs
A practical CSV guide that explains why simple-looking files still fail once they move between spreadsheets, databases, APIs, and shell scripts.
Encrypt Files Before Sharing
How to encrypt a file, verify the output, and avoid the handoff mistakes that break real-world file sharing.
Encrypt URLs Before Sharing and Send the Passphrase Separately
How to encrypt URL strings, test the decrypt path, and send the ciphertext and passphrase through separate channels.
Encryption vs Encoding vs Hashing
A clear decision guide to choosing encryption, encoding, or hashing so you use the right tool for the job.
Hex and ASCII Conversion Basics for Debugging and Inspection
How to move between Hex and ASCII when reading payloads, logs, and low-level outputs without losing track of what the data represents.
HMAC vs digital signatures for APIs and webhooks
Choose between shared-secret HMAC and public-key signatures by comparing trust model, rotation, verification scope, and operational overhead.
How to choose the right JWKS key by kid and what to do when it is missing
Learn how to match a JWT to the correct key in a JWKS document and how to handle tokens that arrive without a usable kid.
How to Diff Structured Data and Config Files Without Missing the Real Change
Compare JSON, YAML, XML, and configuration files with a workflow that normalizes formatting noise first, so meaningful value and structure changes stand out.
How to Encrypt Text in Your Browser Safely
A practical workflow for encrypting short text in the browser, testing decryption, and sharing the passphrase the right way.
How to inspect a UUID or GUID and tell what version it is saying about itself
Learn how to read UUID version and variant bits so existing identifiers stop being opaque strings in logs and payloads.
How to Inspect an X.509 Certificate in Plain English
A practical way to read issuer, subject, SANs, validity, fingerprints, and signature details without getting lost in certificate jargon.
How to Read a CSR and Compare the Issued Certificate
A practical CSR guide that explains what you are really requesting, what CAs use, and why SANs matter more than the old common-name habit.
How to split emergency recovery secrets without creating new failure modes
A practical operational guide to recovery secret splitting that focuses on custody, labeling, rehearsal, and survivable recovery.
How to Store API Secrets Safely
Where quick browser tools help, where they stop helping, and the rules teams should follow for secret material that must remain recoverable.
How to Verify a Bcrypt Hash Without Guessing What the System Did
A clean workflow for checking plaintext against a bcrypt hash and understanding what successful verification really proves.
How to Verify a Webhook Signature
Verify webhook signatures with the exact raw request body, the correct secret, and constant-time comparison so replay and tampering bugs are easier to spot.
HTML Formatter and PHP Beautifier Workflow
Format HTML and PHP templates before review to expose structure, reduce noisy diffs, and separate readable source from correctness and runtime testing.
HTTP-01 vs DNS-01 for Let's Encrypt
Choose the right validation method for issuance and renewal based on your hosting, DNS control, and certificate scope.
JavaScript Object vs JSON
Understand how JavaScript object literals differ from strict JSON text, including quotes, comments, functions, undefined values, parsing, and API interchange.
JSON Lint vs Format vs Minify
Learn when to lint, validate, format, minify, or unminify JSON, and use each step in the right order to diagnose syntax, readability, and payload issues.
JSON Patch Explained
Learn how JSON Patch operations behave in practice so partial updates feel predictable instead of risky.
JSON Pointer Explained
A practical JSON Pointer guide that makes escaping, arrays, and root paths readable instead of magical.
JSON Schema Validation for API Payloads
Use JSON Schema to define a predictable, explainable contract for payload validation.
JSON to Base64 Workflow for Transport and Storage
How to encode JSON for text-only transport, inspect it later, and avoid turning encoding into accidental confusion.
JSON vs YAML for Config Files
Compare JSON and YAML for configuration files across readability, parser strictness, comments, tooling, and team ownership before choosing a source format.
JSONPath vs JSON Pointer for Selection and Addressing
Understand when you need a query language like JSONPath and when you need an exact address like JSON Pointer.
JWK vs JWKS vs PEM for JWT Verification
A practical guide to JWK, JWKS, and PEM so you can feed the right key material into JWT verification and conversion workflows.
JWS vs JWE for Readable and Encrypted JWTs
Understand the difference between signed and encrypted JOSE objects so you know when decode is possible and when it is not.
JWT Claim Debugging for exp, nbf, iat, iss, aud, and Clock Skew
A practical walkthrough of the JWT claims that break most often in staging and production, especially around time and audience validation.
JWT Decode vs JWT Verify
Decode tells you what a token says. Verify tells you whether you should trust it. Use both in the right order when auth debugging gets noisy.
Migrating from MD5 to Bcrypt Without Breaking Logins
A practical migration pattern for teams moving away from legacy MD5 password storage toward a safer password-hash workflow.
Milliseconds vs Seconds vs Microseconds in Logs
A practical timestamp debugging guide for spotting unit mistakes quickly when values in logs or APIs look almost right.
PEM vs DER for Certificates and Keys
A practical explanation of PEM and DER formats so certificate and key conversions stop feeling mysterious.
Percent-Encoded URL Debugging for Real Requests
How to read encoded URLs from logs and network traces, isolate the broken layer, and repair the value without guessing.
PGP Encryption Guide With OpenPGP Keys and Signatures
Learn to verify OpenPGP key fingerprints, encrypt and decrypt messages with GnuPG, and validate signatures.
Ping Basics for Site Owners
Learn what ping can reveal about network reachability, what blocked ICMP means, and why a successful response does not prove a website or TLS is healthy.
PKCE Code Verifier vs Code Challenge
A practical PKCE guide that shows the relationship between the verifier and challenge and the exact encoding steps that usually go wrong.
PKCS#1 vs PKCS#8 vs SPKI Key Labels
Understand common PEM labels and the structures they represent so you can stop renaming files and start importing the right thing.
PKCS#12 / PFX vs PEM vs JKS for Certificate Deployment
Choose the right certificate container by understanding what each format holds, what platforms expect, and where conversion mistakes usually happen.
Pre-Launch Security and Data Handling Checklist for Small Tools and Websites
A practical pre-launch checklist for teams publishing small web tools, forms, and content experiences.
Raw Request Bodies for Webhook Verification
Learn why webhook verification often fails after a framework parses the body and how to keep the exact bytes required for HMAC checks.
RFC 3339, ISO 8601, and Unix Time
A practical guide to the timestamp formats that show up in APIs, logs, and tokens, with clear rules for units, offsets, and normalization.
RSA-OAEP vs RSA Signatures
Learn why RSA encryption and RSA signatures solve different problems and how to keep padding, purpose, and tooling straight.
SHA-256 vs MD5 vs Bcrypt
A practical chooser for checksums, integrity fingerprints, and password storage so you pick the right hash workflow the first time.
Stable JWK Thumbprints and Key Identifiers for Rotation
Use JWK thumbprints to create stable cryptographic key identifiers and understand how they differ from free-form kid values.
Subresource Integrity for CDN Assets
Use SRI deliberately for external scripts and stylesheets by understanding when fixed hashes improve trust and when mutable assets make them painful.
ULID vs UUID v7 for Sortability and Timestamps
Compare ULID and UUID v7 by looking at sort order, timestamp visibility, text form, and ecosystem fit instead of treating one as universally better.
Using cron expressions to model business schedules without waking up at 2 AM
Use cron expressions for weekday and business-hour schedules without forgetting the time-zone and DST realities behind the expression.
UTC Offset vs Time Zone
Learn why a numeric UTC offset cannot replace a real time zone when future local-time behavior matters.
UUID v1 vs v4 vs v7
A practical UUID guide that compares privacy, sortability, and operational behavior before your identifier choice gets baked into logs, databases, and APIs.
What Is Inside a PEM File?
Understand PEM boundary lines, Base64 content, and the block types that tell you whether you are looking at a certificate, a key, or a CSR.
What Token Introspection Is and When to Use It
Token introspection answers whether a token is active right now, but it is not the right tool for every JWT. Use it when revocation, opaque tokens, or central policy checks matter.
When Flattening Nested JSON to CSV Loses Meaning
A practical guide to flattening nested JSON into CSV without pretending every tree-shaped structure belongs in rows and columns.
When to use Ed25519 instead of RSA for signatures and tooling
Compare Ed25519 and RSA for signing workflows by looking at compatibility, key size, signature size, and developer ergonomics.
When to Use Shamir Secret Sharing
A practical Shamir guide that shows where threshold sharing reduces real risk and where simpler backup or access-control patterns are the better answer.
Why Passwords Need Hashing, Not Encryption
Learn why authentication systems should verify password hashes without storing recoverable passwords.
Why You Should Always Run a Decrypt Test Before You Send
A small step that prevents a disproportionate number of support requests, broken handoffs, and lost time in encrypted workflows.
Wildcard vs Single-Domain Certificates
Compare wildcard and single-domain TLS certificates by hostname coverage, DNS validation, renewal method, key exposure, and operational blast radius risk.
XML Format, Minify, and Convert
Handle XML safely by formatting for review, minifying for transport, and converting only when another format is required.
XML namespaces explained for people who just need the payload to parse
A practical XML namespace guide that explains prefixes, URIs, and default namespaces without turning into a theory lecture.
YAML Lint, Format, and Convert
A practical guide to validating, formatting, and converting YAML without breaking indentation-sensitive configs.
Base64URL padding mistakes that break tokens, PKCE, and signed URLs
Learn how omitted padding and alphabet differences create subtle failures in tokens, PKCE code challenges, and signed URL workflows.
Certificate fingerprints, serial numbers, and what each one is good for
Stop mixing up certificate fingerprints, serial numbers, subjects, and issuers by learning what each identifier is actually for.
Expiration math for tokens, signed URLs, and cache TTLs
A practical guide to expiry windows so tokens, signed URLs, and cached content stay valid for exactly as long as you intended.
First-Response Outage Triage for Small Websites
Triage a small website outage in a calm order by checking scope, DNS, TLS, hosting, HTTP behavior, and recent changes before restarting or editing systems.
How JWKS Key Rotation Works Without Breaking JWT Verification
A practical guide to `kid`, JWKS caching, and key rollover so JWT verification failures make sense when the signing key changes.
How to Decrypt Text with OpenSSL
Decrypt OpenSSL enc output by matching its cipher, PBKDF2, digest, salt, and Base64 settings, then verify the recovered bytes.
How to Encrypt Text with OpenSSL
Encrypt text with OpenSSL using a salted PBKDF2 recipe, preserve the settings needed for decryption, and verify the exact result.
OIDC Discovery URL and Metadata Explained
Understand what the OIDC discovery document is, which metadata fields matter first, and how to debug auth setup when issuer, jwks_uri, or authorization endpoints do not line up.
Replay windows, timestamp drift, and why signed requests sometimes fail at the edge
Connect signed-request freshness checks to clock drift and replay windows so HMAC and SigV4 failures stop feeling random.
When MD5 Is Still Okay — and When It Definitely Is Not
A realistic guide to the remaining checksum-style uses of MD5 and the places where modern workflows should move elsewhere.
Why certificate chain order matters and how to fix broken bundles
Understand leaf and intermediate ordering so your certificate bundle can actually be validated by clients instead of looking correct in a text editor.
XML to Base64 for Transport and Legacy Integrations
How to wrap XML in Base64 for transport, decode it again cleanly, and keep old integration workflows readable.
Bcrypt Cost Factor Explained in Plain English
How bcrypt cost works, why slower can be safer, and how to think about tuning without turning your login flow into a support issue.
Choosing the Right Encrypt Online Tool for Text, Files, Links, PDFs, and More
A practical selector guide so visitors land on the right tool first instead of bouncing between similar-looking workflows.
CSP hashes and nonces for small static sites that still want strict script rules
Use CSP hashes and nonces intentionally by matching them to static or dynamic site architectures instead of treating them as interchangeable syntax.
CSV and JSON Conversion for Data Workflows
Plan CSV and JSON conversions without losing headers, types, nested structures, or empty values, and choose the right format for each practical data workflow.
How to Decode Base64 JSON and XML Payloads Without Losing Context
A clean workflow for inspecting Base64-wrapped API payloads and immediately turning them back into readable JSON or XML.
How to Password-Protect a PDF Online Safely
A practical guide to protecting PDFs with a password, checking the result, and choosing the right sharing flow afterward.
How to Share an Encrypted Message With a Link
Create an encrypted message link, test the recipient workflow, and send the passphrase separately without putting readable text in the URL.
How to Use a Let’s Encrypt Certbot Command Generator Safely
Use a command generator to speed up certificate setup while still understanding what the flags and challenge choices mean.
How to verify a downloaded artifact with SHA-256, signatures, or SRI
Choose the right verification method for a downloaded artifact by comparing local checksums, public signatures, and browser-side integrity checks.
HTML, Markdown, and Text Conversion Workflows That Preserve Meaning
How to move content between HTML, Markdown, and plain text without turning a small cleanup task into formatting chaos.
HTTPS Migration Basics for Small Sites
Move a small site from HTTP to HTTPS with a practical checklist for certificates, redirects, mixed content, canonicals, cookies, testing, and renewal.
OAuth Callback URL Mismatch Debugging
Redirect URI mismatch errors usually come from small string differences. Compare the callback value, environment, path, port, and encoding before changing provider or application settings.
Secure Password Reset Design Basics for Small Teams
A plain-language guide to reset flows that respect password hashing, avoid recoverability traps, and reduce support pain.
Text Normalization Before Publishing or Encrypting
Clean up case, spacing, counts, and formatting before you encrypt, convert, or publish text-based content.
URL Encoding and Decoding Guide for Query Strings and Form Values
How to encode and decode query values correctly so spaces, symbols, and special characters survive web transport.
How to Remove Secrets From Logs Before Sharing
A practical guide to redacting tokens, cookies, API keys, and .env values before you paste logs into tickets, chat, or incident docs.
ID Token vs Access Token vs Refresh Token in Plain English
These token types are not interchangeable. Know which token proves login, which one authorizes APIs, and which one should stay out of front-end logs and requests.
Salts, Peppers, and Password Storage Basics
A practical explanation of salts and peppers, what problem each one solves, and where teams often misunderstand the difference.