How Cryptography Protects Your Data (A Practical Guide)
Cryptography is the science of keeping information secret and verifiable. It powers every HTTPS padlock, every password you store safely, and every token that proves you are who you say you are. You do not need a maths degree to understand how it works — and understanding it makes you a better developer and a safer user.
The three things cryptography does
Most cryptographic operations fall into one of three categories:
- Hashing — turns any input into a fixed-length fingerprint that cannot be
reversed.
- Encryption — scrambles data so only someone with the right key can read it.
- Encoding — converts data to a different representation without any secrecy
(Base64 is encoding, not encryption).
Confusing these three is one of the most common security mistakes.
Hashing: the one-way fingerprint
A hash function takes any input — a password, a file, a million-line log — and produces a short, fixed string. The same input always produces the same output, but you cannot work backwards from the hash to recover the input.
SHA-256, for example, always produces a 64-character hex string. Whether your input is one character or one gigabyte, the output is the same length. You can try it yourself in the hash generator.
Why hashing matters:
- Websites store your password as a hash, never in plain text. When you log in,
the site hashes what you typed and compares the result — your actual password never sits in a database.
- File integrity checks compare hashes. If even one byte of a download is
corrupted, the hash changes completely.
- Digital signatures use hashing: you hash a document, then encrypt that hash
with a private key to create a signature anyone can verify.
Encoding: Base64 is not a secret
Base64 is a way to represent binary data as plain text using 64 printable characters. It is reversible by anyone — it has no key, no secret. Its purpose is transport, not security: email attachments, data URLs, and JSON payloads all use it to safely carry binary data through systems that only handle text.
Try the Base64 encoder/decoder and notice that clicking decode perfectly recovers the original input. That is the point — but it also means that Base64-encoded data is not protected in any way.
JWTs: hashing and Base64 together
A JSON Web Token (JWT) puts these ideas together in a pattern you see everywhere in web authentication. A JWT has three parts, each Base64url-encoded and separated by dots:
- Header — the algorithm (e.g.
HS256). - Payload — claims: user ID, expiry, roles, etc.
- Signature — the header and payload hashed with a secret key.
Anyone can decode the header and payload — they are just Base64. The signature is what makes the token trustworthy: only the server that holds the secret key can produce a valid one.
Paste any JWT into the JWT decoder to inspect the header and payload. You will see exactly what the server can read from your token — and why you should never put sensitive information in the payload unless the token is also encrypted.
Strong passwords: entropy beats patterns
A password's strength is measured in entropy — how many guesses an attacker needs in the worst case. Length and randomness matter far more than substitutions like p@ssw0rd.
A randomly generated 16-character password using upper, lower, digits, and symbols has around 100 bits of entropy. A human-chosen word with a few substitutions might have 20–30. The gap is enormous.
The password generator produces cryptographically random passwords using the browser's crypto.getRandomValues API — the same randomness source as professional security tools. It never sends the password anywhere.
The common thread
Every tool in the developer category that touches data — the hash generator, the Base64 encoder, the JWT decoder, the password generator — runs entirely in your browser. No data leaves your machine. That is not just a convenience; it is a security property: a tool that never sees your plaintext cannot leak it.
Understanding what hashing, encoding, and encryption each do — and what they do not do — is the foundation of writing software that handles data responsibly.