Encryption vs Encoding vs Hashing
A clear decision guide to choosing encryption, encoding, or hashing so you use the right tool for the job.
Encrypt Online guides
Guides for working with data.
Understand a format, debug a token, or protect a file. Find a guide and open the tools as you read.
Find a guide
120 practical guides.
Guides by task
JWT Decode vs JWT Verify
Decode tells you what a token says. Verify tells you whether you should trust it. Use both in the right order when auth debugging gets noisy.
JSON Lint vs Format vs Minify
Learn when to lint, validate, format, minify, or unminify JSON, and use each step in the right order to diagnose syntax, readability, and payload issues.
AWS SigV4 Canonical Request Byte Matching
A practical SigV4 guide that explains canonical requests, signed headers, and the normalization details behind SignatureDoesNotMatch.
Canonical JSON for Signing and Hashing
Learn how canonical JSON gives signatures and hashes consistent input, including key ordering, number formatting and Unicode handling.
Fix AADSTS70021 and AADSTS700213 Federated Credential Errors
Compare issuer, subject, and audience to debug Entra federated credential errors in GitHub Actions and AKS. Includes Azure CLI commands and mismatch examples.
Fix Azure SAS Token 403 Errors: Expiry, Permissions, and Scope
Debug Azure Blob SAS 403 errors by checking expiry, permissions, resource scope, and encoding. Separate token problems from Azure policy and network failures.
Fix S3 Presigned URL SignatureDoesNotMatch Errors
Debug S3 presigned URL errors by checking the HTTP method, signed headers, URL encoding, region, and expiry. Includes Python and curl examples.
HMAC vs digital signatures for APIs and webhooks
Choose between shared-secret HMAC and public-key signatures by comparing trust model, rotation, verification scope, and operational overhead.
Replay windows, timestamp drift, and why signed requests sometimes fail at the edge
Connect signed-request freshness checks to clock drift and replay windows so HMAC and SigV4 failures stop feeling random.
Building Simple Checksum Workflows with SHA-256
A clean workflow for generating, comparing, and documenting SHA-256 fingerprints for files, strings, and deployment handoffs.
Checksum, Signature, or Encryption for File Integrity and Secrecy
Choose a checksum to compare file contents, a digital signature to verify the signer, or encryption to keep a file private.
How to verify a downloaded artifact with SHA-256, signatures, or SRI
Choose the right verification method for a downloaded artifact by comparing local checksums, public signatures, and browser-side integrity checks.
What Does SHA Stand For?
SHA stands for Secure Hash Algorithm. Learn what a hash does, how SHA-1, SHA-2, and SHA-3 differ, and when to use SHA-256, SHA-512, or SHAKE.
When MD5 Is Still Okay — and When It Definitely Is Not
A realistic guide to the remaining checksum-style uses of MD5 and the places where modern workflows should move elsewhere.
A Let’s Encrypt Renewal Checklist That Prevents Expiry Surprises
A practical renewal checklist covering challenge continuity, automation, notifications, and post-renewal deploy steps.
ACME Explained
A plain-language ACME guide that explains what your Let’s Encrypt tooling is actually doing during issuance and renewal.
AES-CBC vs AES-GCM in Modern Libraries
Compare AES-CBC and AES-GCM, including integrity, IVs, authentication tags, AAD, and common decryption failures.
Authenticated Encryption Explained
Learn how authenticated encryption keeps data private and detects changes, including how AES-GCM uses an authentication tag and associated data.
Base32 vs Base64 when humans, QR codes, or secrets are involved
Choose between Base32 and Base64 by looking at readability, transcription risk, and the workflows where each encoding is a better fit.
Base64 Is Not Encryption
A direct explanation of why Base64 is for representation and transport, not secrecy, plus the right moments to use it.
Base64URL padding mistakes that break tokens, PKCE, and signed URLs
Learn how omitted padding and alphabet differences create subtle failures in tokens, PKCE code challenges, and signed URL workflows.
Base64URL vs Base64 on the Web
A practical guide to the differences between standard Base64 and URL-safe Base64 so you stop breaking tokens and query values.
Bcrypt Cost Factor Explained in Plain English
How bcrypt cost works, why slower can be safer, and how to think about tuning without turning your login flow into a support issue.
Blowfish vs Modern Encryption for Legacy Data Workflows
When Blowfish still shows up, how to use it carefully for compatibility, and why modern workflows usually point elsewhere.
Browser-Side Cryptography Explained
A plain-English explanation of the strengths and limits of browser-side protection so you can use local tools with realistic expectations.
Building a privacy-first debugging workflow in the browser for tokens, keys, and payloads
A capstone guide to using browser-first tools responsibly for sensitive debugging without turning random paste bins into part of your security workflow.
Capturing Raw Request Bodies for Webhook Verification in Node, Express, and Next.js
Preserve the exact request bytes before parsing JSON so Stripe, GitHub, and other webhook signatures stop failing for boring reasons.
Certificate Chain Basics for Beginners
A beginner-friendly explanation of leaf certificates, intermediates, and why chain issues break trust.
Certificate File Types Explained
Learn how CRT, CER, PEM, DER, KEY, P7B, and P12 files differ by encoding and container, then choose the correct format for certificate deployment tasks.
Certificate fingerprints, serial numbers, and what each one is good for
Stop mixing up certificate fingerprints, serial numbers, subjects, and issuers by learning what each identifier is actually for.
Choosing Base16, Base32, or Base64 for Binary-to-Text Encoding
Compare Base16, Base32 and Base64 by output size, readability and compatibility, then choose the encoding your receiving system expects.
Choosing the Right Encrypt Online Tool for Text, Files, Links, PDFs, and More
Find the right tool for text, files, links, tokens and certificates, with examples of when to encrypt, decode, hash or convert your data.
Clean Copy-Paste Workflows for JSON, YAML, and XML
Reduce broken payloads and formatting mistakes when moving structured text between tools, docs, and tickets.
Common JWT Claim Validation Mistakes That Break Trust
A valid JWT signature is not enough. These are the claim checks teams skip when issuer, audience, timing, and token type actually decide whether a token should be accepted.
Common Mistakes When Sharing Encrypted Secrets
The most common ways good encryption workflows fail in practice, and the fixes that make them dependable for real handoffs.
Common RS256 and ES256 JWT verification failures and how to isolate each one
A failure-led guide to diagnosing JWT verification issues in RS256 and ES256 workflows without guessing at keys or claims.
Constant-Time Comparison Explained
A practical guide to timing-safe comparison so secret verification code does not leak more information than intended.
Converting certificate formats without losing the private key or chain
Convert PEM, DER and PKCS#12 certificates while keeping the required private key and intermediate certificates, then check the result before deployment.
Cron and Daylight Saving Time
Understand how daylight saving transitions affect cron schedules so recurring jobs stop surprising you every spring and fall.
CSP hashes and nonces for small static sites that still want strict script rules
Choose CSP hashes for fixed scripts and nonces for responses generated per request. Learn how each approach changes your script policy and deployment.
CSV and JSON Conversion for Data Workflows
Plan CSV and JSON conversions without losing headers, types, nested structures, or empty values, and choose the right format for each practical data workflow.
CSV Import Traps With Delimiters, Newlines, Encoding, and BOMs
A practical CSV guide that explains why simple-looking files still fail once they move between spreadsheets, databases, APIs, and shell scripts.
Encrypt Files Before Sharing
How to encrypt a file, verify the output, and avoid the handoff mistakes that break real-world file sharing.
Encrypt URLs Before Sharing and Send the Passphrase Separately
How to encrypt URL strings, test the decrypt path, and send the ciphertext and passphrase through separate channels.
Expiration math for tokens, signed URLs, and cache TTLs
A practical guide to expiry windows so tokens, signed URLs, and cached content stay valid for exactly as long as you intended.
First-Response Outage Triage for Small Websites
Triage a small website outage in a calm order by checking scope, DNS, TLS, hosting, HTTP behavior, and recent changes before restarting or editing systems.
Hex and ASCII Conversion Basics for Debugging and Inspection
How to move between Hex and ASCII when reading payloads, logs, and low-level outputs without losing track of what the data represents.
How JWKS Key Rotation Works Without Breaking JWT Verification
A practical guide to `kid`, JWKS caching, and key rollover so JWT verification failures make sense when the signing key changes.
How to choose the right JWKS key by kid and what to do when it is missing
Learn how to match a JWT to the correct key in a JWKS document and how to handle tokens that arrive without a usable kid.
How to Decode Base64 JSON and XML Payloads Without Losing Context
A clean workflow for inspecting Base64-wrapped API payloads and immediately turning them back into readable JSON or XML.
How to Decrypt Text with OpenSSL
Decrypt OpenSSL enc output by matching its cipher, PBKDF2, digest, salt, and Base64 settings, then verify the recovered bytes.
How to Diff Structured Data and Config Files Without Missing the Real Change
Compare JSON, YAML, XML, and configuration files with a workflow that normalizes formatting noise first, so meaningful value and structure changes stand out.
How to Encrypt Text in Your Browser Safely
A practical workflow for encrypting short text in the browser, testing decryption, and sharing the passphrase the right way.
How to Encrypt Text with OpenSSL
Encrypt text with OpenSSL using a salted PBKDF2 recipe, preserve the settings needed for decryption, and verify the exact result.
How to inspect a UUID or GUID and tell what version it is saying about itself
Learn how to read UUID version and variant bits so existing identifiers stop being opaque strings in logs and payloads.
How to Inspect an X.509 Certificate in Plain English
A practical way to read issuer, subject, SANs, validity, fingerprints, and signature details without getting lost in certificate jargon.
How to Password-Protect a PDF Online Safely
A practical guide to protecting PDFs with a password, checking the result, and choosing the right sharing flow afterward.
How to Read a CSR and Compare the Issued Certificate
A practical CSR guide that explains what you are really requesting, what CAs use, and why SANs matter more than the old common-name habit.
How to Remove Secrets From Logs Before Sharing
A practical guide to redacting tokens, cookies, API keys, and .env values before you paste logs into tickets, chat, or incident docs.
How to Share an Encrypted Message With a Link
Create an encrypted message link, test the recipient workflow, and send the passphrase separately without putting readable text in the URL.
How to split emergency recovery secrets without creating new failure modes
A practical operational guide to recovery secret splitting that focuses on custody, labeling, rehearsal, and survivable recovery.
How to Store API Secrets Safely
Where quick browser tools help, where they stop helping, and the rules teams should follow for secret material that must remain recoverable.
How to Use a Let’s Encrypt Certbot Command Generator Safely
Use a command generator to speed up certificate setup while still understanding what the flags and challenge choices mean.
How to Verify a Bcrypt Hash Without Guessing What the System Did
A clean workflow for checking plaintext against a bcrypt hash and understanding what successful verification really proves.
How to Verify a Webhook Signature
Verify webhook signatures with the exact raw request body, the correct secret, and constant-time comparison so replay and tampering bugs are easier to spot.
HTML Formatter and PHP Beautifier Workflow
Format HTML and PHP templates before review to expose structure, reduce noisy diffs, and separate readable source from correctness and runtime testing.
HTML, Markdown, and Text Conversion Workflows That Preserve Meaning
How to move content between HTML, Markdown, and plain text without turning a small cleanup task into formatting chaos.
HTTP-01 vs DNS-01 for Let's Encrypt
Choose the right validation method for issuance and renewal based on your hosting, DNS control, and certificate scope.
HTTPS Migration Basics for Small Sites
Move a small site from HTTP to HTTPS with a practical checklist for certificates, redirects, mixed content, canonicals, cookies, testing, and renewal.
ID Token vs Access Token vs Refresh Token in Plain English
These token types are not interchangeable. Know which token proves login, which one authorizes APIs, and which one should stay out of front-end logs and requests.
JavaScript Object vs JSON
Understand how JavaScript object literals differ from strict JSON text, including quotes, comments, functions, undefined values, parsing, and API interchange.
JSON Patch Explained
Learn JSON Patch add, replace, remove, move, copy and test operations with examples of paths, array indexes and failed updates.
JSON Pointer Explained
Read and write JSON Pointer paths, including escaped slashes, tilde characters, array indexes and the document root, with worked examples.
JSON Schema Validation for API Payloads
Use JSON Schema to define a predictable, explainable contract for payload validation.
JSON to Base64 Workflow for Transport and Storage
How to encode JSON for text-only transport, inspect it later, and avoid turning encoding into accidental confusion.
JSON vs YAML for Config Files
Compare JSON and YAML for configuration files across readability, parser strictness, comments, tooling, and team ownership before choosing a source format.
JSONPath vs JSON Pointer for Selection and Addressing
Understand when you need a query language like JSONPath and when you need an exact address like JSON Pointer.
JWK vs JWKS vs PEM for JWT Verification
A practical guide to JWK, JWKS, and PEM so you can feed the right key material into JWT verification and conversion workflows.
JWS vs JWE for Readable and Encrypted JWTs
Understand the difference between signed and encrypted JOSE objects so you know when decode is possible and when it is not.
JWT Claim Debugging for exp, nbf, iat, iss, aud, and Clock Skew
A practical walkthrough of the JWT claims that break most often in staging and production, especially around time and audience validation.
Migrating from MD5 to Bcrypt Without Breaking Logins
A practical migration pattern for teams moving away from legacy MD5 password storage toward a safer password-hash workflow.
Milliseconds vs Seconds vs Microseconds in Logs
A practical timestamp debugging guide for spotting unit mistakes quickly when values in logs or APIs look almost right.
OAuth Callback URL Mismatch Debugging
Redirect URI mismatch errors usually come from small string differences. Compare the callback value, environment, path, port, and encoding before changing provider or application settings.
OIDC Discovery URL and Metadata Explained
Understand what the OIDC discovery document is, which metadata fields matter first, and how to debug auth setup when issuer, jwks_uri, or authorization endpoints do not line up.
PEM vs DER for Certificates and Keys
A practical explanation of PEM and DER formats so certificate and key conversions stop feeling mysterious.
Percent-Encoded URL Debugging for Real Requests
How to read encoded URLs from logs and network traces, isolate the broken layer, and repair the value without guessing.
PGP Encryption Guide With OpenPGP Keys and Signatures
Learn to verify OpenPGP key fingerprints, encrypt and decrypt messages with GnuPG, and validate signatures.
Ping Basics for Site Owners
Learn how to use ping for network checks, understand blocked ICMP replies, and test HTTP and TLS separately when troubleshooting a website connection problem.
PKCE Code Verifier vs Code Challenge
A practical PKCE guide that shows the relationship between the verifier and challenge and the exact encoding steps that usually go wrong.
PKCS#1 vs PKCS#8 vs SPKI Key Labels
Understand common PEM labels and the structures they represent so you can stop renaming files and start importing the right thing.
PKCS#12 / PFX vs PEM vs JKS for Certificate Deployment
Choose the right certificate container by understanding what each format holds, what platforms expect, and where conversion mistakes usually happen.
Pre-Launch Security and Data Handling Checklist for Small Tools and Websites
A practical pre-launch checklist for teams publishing small web tools, forms, and content experiences.
Raw Request Bodies for Webhook Verification
Learn why webhook verification often fails after a framework parses the body and how to keep the exact bytes required for HMAC checks.
RFC 3339, ISO 8601, and Unix Time
A practical guide to the timestamp formats that show up in APIs, logs, and tokens, with clear rules for units, offsets, and normalization.
RSA-OAEP vs RSA Signatures
Learn why RSA encryption and RSA signatures solve different problems and how to keep padding, purpose, and tooling straight.
Salts, Peppers, and Password Storage Basics
A practical explanation of salts and peppers, what problem each one solves, and where teams often misunderstand the difference.
Secure Password Reset Design Basics for Small Teams
A plain-language guide to reset flows that respect password hashing, avoid recoverability traps, and reduce support pain.
SHA-256 vs MD5 vs Bcrypt
A practical chooser for checksums, integrity fingerprints, and password storage so you pick the right hash workflow the first time.
Stable JWK Thumbprints and Key Identifiers for Rotation
Use JWK thumbprints to create stable cryptographic key identifiers and understand how they differ from free-form kid values.
Subresource Integrity for CDN Assets
Use SRI deliberately for external scripts and stylesheets by understanding when fixed hashes improve trust and when mutable assets make them painful.
Text Normalization Before Publishing or Encrypting
Clean up case, spacing, counts, and formatting before you encrypt, convert, or publish text-based content.
ULID vs UUID v7 for Sortability and Timestamps
Compare ULID and UUID v7 by sort order, timestamp visibility, text format and library support to choose an identifier for your application.
URL Encoding and Decoding Guide for Query Strings and Form Values
How to encode and decode query values correctly so spaces, symbols, and special characters survive web transport.
Using cron expressions to model business schedules without waking up at 2 AM
Use cron expressions for weekday and business-hour schedules without forgetting the time-zone and DST realities behind the expression.
UTC Offset vs Time Zone
Learn why a numeric UTC offset cannot replace a real time zone when future local-time behavior matters.
UUID v1 vs v4 vs v7
A practical UUID guide that compares privacy, sortability, and operational behavior before your identifier choice gets baked into logs, databases, and APIs.
What Is Inside a PEM File?
Understand PEM boundary lines, Base64 content, and the block types that tell you whether you are looking at a certificate, a key, or a CSR.
What Token Introspection Is and When to Use It
Token introspection answers whether a token is active right now, but it is not the right tool for every JWT. Use it when revocation, opaque tokens, or central policy checks matter.
When Flattening Nested JSON to CSV Loses Meaning
A practical guide to flattening nested JSON into CSV without pretending every tree-shaped structure belongs in rows and columns.
When to use Ed25519 instead of RSA for signatures and tooling
Compare Ed25519 and RSA for signing workflows by looking at compatibility, key size, signature size, and developer ergonomics.
When to Use Shamir Secret Sharing
A practical Shamir guide that shows where threshold sharing reduces real risk and where simpler backup or access-control patterns are the better answer.
Why certificate chain order matters and how to fix broken bundles
Put leaf and intermediate certificates in the right order, find missing issuers, and test the assembled chain with the client that will use it.
Why Passwords Need Hashing, Not Encryption
Learn why authentication systems should verify password hashes without storing recoverable passwords.
Why You Should Always Run a Decrypt Test Before You Send
A small step that prevents a disproportionate number of support requests, broken handoffs, and lost time in encrypted workflows.
Wildcard vs Single-Domain Certificates
Compare wildcard and single-domain TLS certificates by hostname coverage, DNS validation, renewal method, key exposure, and operational blast radius risk.
XML Format, Minify, and Convert
Handle XML safely by formatting for review, minifying for transport, and converting only when another format is required.
XML namespaces explained for people who just need the payload to parse
A practical XML namespace guide that explains prefixes, URIs, and default namespaces without turning into a theory lecture.
XML to Base64 for Transport and Legacy Integrations
How to wrap XML in Base64 for transport, decode it again cleanly, and keep old integration workflows readable.
YAML Lint, Format, and Convert
A practical guide to validating, formatting, and converting YAML without breaking indentation-sensitive configs.