4 tools in this category
View all toolsSecurity & Crypto Guides & Technical Standards
Master workflows, understand protocol specifications, and avoid production edge-cases.
Technical Field Manuals
.env File Formatting & Escaping: Multiline Secrets, Quotes & 12-Factor Config
Master .env formatting rules, resolve multiline string and certificate escaping bugs, manage .env precedence, and prevent secret leaks in CI/CD.
Content Security Policy (CSP) Headers: Production Implementation & Debugging Guide
Master Content Security Policy (CSP) headers, nonce generation, sha256 script hashing, Report-Only mode, and debugging modern Next.js and SPA violations.
Cryptographic Hash Functions in Modern Web Architecture: SHA-2, SHA-3, BLAKE2 & HMAC Guide
Master cryptographic hashing: evaluate collision resistance, benchmark SHA-2 vs SHA-3 vs BLAKE2, prevent length extension attacks with HMAC, and safely verify file checksums.
Debugging CORS Errors: The Complete Guide to Preflight OPTIONS & Headers
A production debugging guide to fixing missing origin headers, failed preflight OPTIONS requests, credentialed CORS mismatches, and reverse-proxy proxy pass drops.
Debugging JWT Errors: Fixing Signature Verification, Expiration & JWKS Failures
A comprehensive developer debugging guide to resolving JSON Web Token (JWT) errors: signature mismatches, expired tokens, alg: none attacks, clock skew, and JWKS key rotation.
HTML Entity Encoding & Escaping: XSS Prevention, Unicode & Parser Nuances
Master HTML entity encoding, numeric character references, context-aware XSS escaping in body vs attributes vs JS, and HTML5 named entity parser rules.
Mastering Number Base Conversions: Binary, Hex, Two's Complement & IEEE 754 Floating Point
A comprehensive developer guide to positional numeral systems, arbitrary-precision BigInt radix conversions, two's complement signed arithmetic, and IEEE 754 float inspection.
Modern Cookie Security & CSRF Prevention: SameSite, __Host- Prefixes & CHIPS
Implement bulletproof browser cookie security with SameSite=Lax/Strict, enforce host binding via __Host- and __Secure- prefixes, prevent CSRF attacks, and configure CHIPS for cross-site embeds.
Modern Password Hashing in 2026: Argon2id vs bcrypt vs PBKDF2 & OWASP Security Standards
Benchmark memory-hard Argon2id against bcrypt and PBKDF2, configure work factors for modern GPU resistance, avoid the 72-byte bcrypt truncation trap, and implement seamless on-login hash upgrades.
Prompt Injection Scanning: A Practical Security Checklist
A developer security guide to identifying direct, indirect, and multi-turn prompt injection vulnerabilities in LLM applications and agent pipelines.
Protobuf Debugging: Reading Wire-Format Errors & Binary Streams
A developer guide to Protocol Buffers wire format, decoding varints, resolving tag mismatches, and debugging corrupt binary gRPC and Kafka streams.
SSL/TLS Certificate Decoding & Chain Validation: Complete Production Troubleshooting Guide
Master X.509 certificate decoding, debug missing intermediate CA chains, fix SSL_ERROR_UNTRUSTED_ISSUER, configure DNS CAA records, and verify TLS 1.3 setups.
UUIDv7 vs ULID vs UUIDv4: Database Primary Key Performance Guide
Compare RFC 9562 UUIDv7, ULID, and UUIDv4 for database primary keys. Understand B-tree index fragmentation, sortability, and storage efficiency in PostgreSQL and MySQL.
Webhook Security & HMAC Signature Verification: Production Implementation Guide
Master webhook security: implement HMAC-SHA256 signature verification, prevent replay attacks with timestamp headers, avoid raw-body parser bugs, and secure asynchronous API callbacks.
RFC Standards & Terminology
Browse other categories
Frequently Asked Questions
Are the security & crypto tools free?+
Yes, all security & crypto tools are free and run entirely in your browser with no usage limits and no account required.
Is it safe to generate a hash or password here?+
Yes. Hash and password generation happen client-side using the Web Crypto API — your input never leaves your device.
What is the CSP builder used for?+
The CSP builder helps you construct a Content-Security-Policy header that restricts which domains a page may load scripts and styles from, blocking XSS attacks before the browser can fetch them.