Security Tools

These posts exist because a lot of confident security advice is wrong, and the wrong parts are dangerous.

A worked example: a JWT signature proves the token was issued by someone holding the key. It does not prove the token is still valid, it does not encrypt the payload, and anyone can read the claims in it with a Base64 decoder. People routinely assume all three of those are false. The post on JWTs is mostly about that gap.

Elsewhere: why bcrypt is deliberately slow and why that slowness is the feature, not a bug to be optimised away. Why MD5 is fine for a checksum and catastrophic for a password. What entropy means for a password — measurably, in bits — and why a memorable passphrase can beat P@ssw0rd! by a wide margin. Why a UUIDv4 is random and a UUIDv1 leaks a timestamp and a MAC address.

For developers who inherited an auth system and need to judge it. Decode a real token in the JWT Studio while you read — it lands harder than a diagram.