Security Blog: Passwords, DNS, and Safe Habits
What Is HMAC Used For? Why APIs Need Signed Requests
What Is HMAC Used For? Why APIs Need Signed Requests So what is HMAC used for? HMAC, hash based message authentication code, is used to prove a request or payload
Random vs Memorable Passwords: Why Random Wins
Random vs Memorable Passwords: Why Random Wins In a real random vs memorable passwords comparison, random wins every time because it carries no pattern for cracking tools to exploit. Clever
Passphrase vs Password Security: Which Wins on Entropy?
Passphrase vs Password Security: Which Wins on Entropy? A four word random passphrase usually beats a complex ten character password on both entropy and memorability. Running the numbers, four words
How Do Hackers Crack Passwords? Real Methods Explained
How Do Hackers Crack Passwords? Real Methods Explained So how do hackers crack passwords in practice? Mostly they do not guess one character at a time in front of a
How Password Strength Is Measured (And Why It Matters)
How Password Strength Is Measured (And Why It Matters) Password strength is measured by combining four factors: length, character set variety, entropy (how many guesses an attacker would statistically need),
Other Posts
Practical security without the fear marketing
Most security advice is either terrifying or so generic it changes nothing. These posts aim for the middle: what the actual risk is, how large it is, and the specific thing worth doing about it.
Password advice is the clearest case. The rule about mixing symbols and numbers produced a generation of passwords like Summer2019! that a cracking tool guesses in seconds, because the pattern is entirely predictable. Length and unpredictability are what matter, and these posts show the entropy maths so you can see why a four word passphrase beats a mangled dictionary word by an enormous margin.
Hashing is the other subject people half know. A hash is not encryption, cannot be reversed, and MD5 has been broken for practical purposes since the mid 2000s while still appearing in new code every year. Understanding what a hash is for, and what salting adds, prevents a specific class of very expensive mistake.
The rest covers the checks you run on a live system: what an SSL certificate proves and what it does not, which security headers matter and which are decorative, and how to read what a server is telling you about itself.
What you will find here
- Password and passphrase strength explained with real entropy maths
- Hashing, salting and where MD5 and SHA1 should no longer appear
- Certificate, TLS and security header explainers
- Privacy and compliance basics for small sites
Questions about security blog
Short answers to what readers ask most about this category and the tools behind it.
It depends entirely on where the generation happens. Our Password Generator runs in your browser using the operating system cryptographic random source, so the password is created on your machine and never transmitted. A generator that builds passwords on a server is a different proposition, and you should assume that server saw it.
No. The analysis runs locally in your browser. It is still good practice never to type a password you currently use into any website, so test the pattern rather than the real thing, for example the same length and structure with different words.
Unpredictability multiplied by length. A random four or five word passphrase is stronger and far easier to remember than a short string with substituted characters, because cracking tools already know every common substitution. The posts here show the entropy calculation so the difference stops being a matter of opinion.
Not for anything security related. It is broken against collision attacks and has been for years, and it should never be used for passwords or signatures. It remains acceptable as a non security checksum for detecting accidental file corruption, which is the only place you should still see it.
That the connection is encrypted and that the certificate was issued for that domain by a trusted authority. It does not prove the site is honest, safe or run by who you think. Free certificates are as cryptographically strong as expensive ones, and the difference is validation depth, not security.
No. Each one starts with the risk in plain language before it goes near a protocol, and the more advanced sections are clearly marked so you can stop once you have what you need.