Security
Encoding is not encryption, a token is not a password, and "random" means something specific once an attacker is involved. These posts take the security ideas developers meet most often and explain what each one actually guarantees — and, more usefully, what it does not.
What's Inside a JWT — And What You Should Never Put There
A JWT is three Base64url strings and a signature. Understanding which part is secret (none of them) changes how you design with it.
How Browsers Generate Cryptographically Secure Random Numbers
Math.random is predictable by design. What crypto.getRandomValues does differently, and why the difference decides whether a token is guessable.
Base64 Myths: Why It's Not Encryption and Never Was
It has no key. That single fact settles most of what people believe about Base64 — and explains the three bugs it keeps causing.
How Cryptography Protects Your Data (A Practical Guide)
Cryptography is the engine behind passwords, tokens, and secure communication. Here is what every developer and curious user should know.
Why Client-Side Tools Are More Private
Client-side tools process your data in the browser and never upload it. Here is why that matters and how to tell the difference.