Security Blog: Passwords, DNS, and Safe Habits
SSL Certificate Expiry: 6 Real Examples, Clearly Solved
Work out SSL certificate expiry with 6 solved examples: days left, validity length, renewal dates, wildcard coverage and a missing chain, step by step.
HTTP Security Headers: 7 Real Myths, Clearly Fixed
HTTP security headers are widely misunderstood. See 7 common myths corrected with facts, a severity table and a quick audit you can run in a minute.
HMAC Signature: 8 Essential Rules for Safe Signing
An HMAC signature proves who sent a message and that it was not changed. Learn 8 exact rules, a lookup table and a checkable example to get it right.
What Is HMAC Used For? Why APIs Need Signed Requests
What Is HMAC Used For? Why APIs Need Signed Requests What is HMAC used for? HMAC, hash based message authentication code, is used to prove a request or payload came
Random vs Memorable Passwords: Why Random Wins
Random vs Memorable Passwords: Why Random Wins In a real random vs memorable passwords comparison, random wins every time because it carries no pattern for cracking tools to exploit. Clever
Other Posts
Practical security without the fear marketing
Most security advice is either terrifying or so generic it changes nothing. These posts aim for the middle: what the actual risk is, how large it is, and the specific thing worth doing about it.
Password advice is the clearest case. The rule about mixing symbols and numbers produced a generation of passwords like Summer2019! that a cracking tool guesses in seconds, because the pattern is entirely predictable. Length and unpredictability are what matter, and these posts show the entropy maths so you can see why a four word passphrase beats a mangled dictionary word by an enormous margin.
Hashing is the other subject people half know. A hash is not encryption, cannot be reversed, and MD5 has been broken for practical purposes since the mid 2000s while still appearing in new code every year. Understanding what a hash is for, and what salting adds, prevents a specific class of very expensive mistake.
The rest covers the checks you run on a live system: what an SSL certificate proves and what it does not, which security headers matter and which are decorative, and how to read what a server is telling you about itself.
What you will find here
- Password and passphrase strength explained with real entropy maths
- Hashing, salting and where MD5 and SHA1 should no longer appear
- Certificate, TLS and security header explainers
- Privacy and compliance basics for small sites
Questions about security blog
Short answers to what readers ask most about this category and the tools behind it.
It depends entirely on where the generation happens. Our Password Generator runs in your browser using the operating system cryptographic random source, so the password is created on your machine and never transmitted. A generator that builds passwords on a server is a different proposition, and you should assume that server saw it.
No. The analysis runs locally in your browser. It is still good practice never to type a password you currently use into any website, so test the pattern rather than the real thing, for example the same length and structure with different words.
Unpredictability multiplied by length. A random four or five word passphrase is stronger and far easier to remember than a short string with substituted characters, because cracking tools already know every common substitution. The posts here show the entropy calculation so the difference stops being a matter of opinion.
Not for anything security related. It is broken against collision attacks and has been for years, and it should never be used for passwords or signatures. It remains acceptable as a non security checksum for detecting accidental file corruption, which is the only place you should still see it.
That the connection is encrypted and that the certificate was issued for that domain by a trusted authority. It does not prove the site is honest, safe or run by who you think. Free certificates are as cryptographically strong as expensive ones, and the difference is validation depth, not security.
No. Each one starts with the risk in plain language before it goes near a protocol, and the more advanced sections are clearly marked so you can stop once you have what you need.