3 tools in this category
View all toolsSecurity & Crypto Guides & Technical Standards
Master workflows, understand protocol specifications, and avoid production edge-cases.
Technical Field Manuals
.env File Formatting & Escaping: Multiline Secrets, Quotes & 12-Factor Config
Master .env formatting rules, resolve multiline string and certificate escaping bugs, manage .env precedence, and prevent secret leaks in CI/CD.
Content Security Policy (CSP) Headers: Production Implementation & Debugging Guide
Master Content Security Policy (CSP) headers, nonce generation, sha256 script hashing, Report-Only mode, and debugging modern Next.js and SPA violations.
Debugging CORS Errors: The Complete Guide to Preflight OPTIONS & Headers
A production debugging guide to fixing missing origin headers, failed preflight OPTIONS requests, credentialed CORS mismatches, and reverse-proxy proxy pass drops.
Debugging JWT Errors: Fixing Signature Verification, Expiration & JWKS Failures
A comprehensive developer debugging guide to resolving JSON Web Token (JWT) errors: signature mismatches, expired tokens, alg: none attacks, clock skew, and JWKS key rotation.
Modern Cookie Security & CSRF Prevention: SameSite, __Host- Prefixes & CHIPS
Implement bulletproof browser cookie security with SameSite=Lax/Strict, enforce host binding via __Host- and __Secure- prefixes, prevent CSRF attacks, and configure CHIPS for cross-site embeds.
Modern Password Hashing in 2026: Argon2id vs bcrypt vs PBKDF2 & OWASP Security Standards
Benchmark memory-hard Argon2id against bcrypt and PBKDF2, configure work factors for modern GPU resistance, avoid the 72-byte bcrypt truncation trap, and implement seamless on-login hash upgrades.
Prompt Injection Scanning: A Practical Security Checklist
A developer security guide to identifying direct, indirect, and multi-turn prompt injection vulnerabilities in LLM applications and agent pipelines.
Protobuf Debugging: Reading Wire-Format Errors & Binary Streams
A developer guide to Protocol Buffers wire format, decoding varints, resolving tag mismatches, and debugging corrupt binary gRPC and Kafka streams.
UUIDv7 vs ULID vs UUIDv4: Database Primary Key Performance Guide
Compare RFC 9562 UUIDv7, ULID, and UUIDv4 for database primary keys. Understand B-tree index fragmentation, sortability, and storage efficiency in PostgreSQL and MySQL.
Webhook Security & HMAC Signature Verification: Production Implementation Guide
Master webhook security: implement HMAC-SHA256 signature verification, prevent replay attacks with timestamp headers, avoid raw-body parser bugs, and secure asynchronous API callbacks.
RFC Standards & Terminology
Browse other categories
Frequently Asked Questions
Are the security & crypto tools free?+
Yes, all security & crypto tools are free and run entirely in your browser with no usage limits and no account required.
Is it safe to generate a hash or password here?+
Yes. Hash and password generation happen client-side using the Web Crypto API — your input never leaves your device.
What is the CSP builder used for?+
The CSP builder helps you construct a Content-Security-Policy header that restricts which domains a page may load scripts and styles from, blocking XSS attacks before the browser can fetch them.