Learn
These articles are static pages built from Markdown in the repository. They explain concepts and point to tools that run locally in your browser whenever the task allows. Browse by topic or search the full set.
Topics
- Published: 2026-09-09
Sharing an env file securely with an encrypted link
How to share a .env file with a teammate without pasting secrets into Slack or email—seal the contents locally, put ciphertext in a URL fragment, and send the password out of band.
Read article → - Published: 2026-09-05
What is TOTP?
How time-based one-time passwords work (RFC 6238): shared secrets, 30-second windows, HMAC, otpauth QR codes, and why generating TOTP locally keeps secrets off servers.
Read article → - Published: 2026-09-05
AES-GCM basics (nonce, tag, AAD)
How AES-GCM encryption works in plain language: key sizes, 96-bit nonces, the authentication tag, optional AAD, and why you must never reuse an IV with the same key.
Read article → - Published: 2026-09-05
RSA keypairs: sizes and PEM
How RSA public/private keys work in practice: 2048 vs 3072 vs 4096-bit moduli, OAEP vs PSS vs PKCS#1 signatures, and what PKCS#8 / SPKI PEM blocks contain.
Read article → - Published: 2026-09-05
What is in a PEM file?
How PEM wraps DER: BEGIN/END labels, Base64 payloads, common key and certificate types, multi-block pastes, and how to inspect them locally without uploading secrets.
Read article → - Published: 2026-09-05
HKDF vs PBKDF2 in plain language
When to use PBKDF2 for password stretching vs HKDF for expanding high-entropy key material—salt, iterations, info strings, and deriving keys locally with Web Crypto.
Read article → - Published: 2026-09-05
HMAC webhook signatures
How providers sign webhook bodies with HMAC (SHA-256 and friends), why exact bytes and header formats matter, Stripe-style t=/v1= headers, and how to verify signatures locally without uploading secrets.
Read article → - Published: 2026-09-05
PKI: CSR, certificates, and SANs (overview)
How public-key infrastructure pieces fit together—keypairs, PKCS#10 CSRs, X.509 certificates, DNS SANs, and self-signed certs—and how to build or inspect them locally in the browser.
Read article → - Published: 2026-09-05
Browser fingerprinting: what sites can infer
How sites combine canvas, WebGL, audio, fonts, screen, User-Agent, and WebRTC signals into a trackable fingerprint—and how to audit those exposures locally without uploading a report.
Read article → - Published: 2026-09-05
Sharing secrets with a link (fragment-based)
How URL hash fragments keep ciphertext off server logs, how AES-GCM plus a password seals a shareable link, and what fragment-based secret sharing can and cannot guarantee.
Read article → - Published: 2026-07-20
Reading a JWT without trusting the server
How JWT structure, Base64URL encoding, and signatures work — and why decoding locally beats pasting tokens into random websites.
Read article → - Published: 2026-07-20
Why “local only” matters for developer tools
What browser-local processing means for privacy, compliance, and trust — and when you should still avoid pasting secrets into any website.
Read article → - Published: 2026-07-20
Password strength beyond “8 characters”
Entropy, dictionary attacks, and zxcvbn-style scoring — why length and uniqueness beat complex rules on a sticky note.
Read article → - Published: 2026-07-20
Generating test JWT tokens locally
How to create HMAC-signed JWTs for API mocks with iat and exp claims — and why signing should stay in your browser or CI, not a random website.
Read article → - Published: 2026-07-18
Generating passwords and tokens in the browser
How to create strong random passwords and API tokens with Web Crypto, character classes, ambiguous-character exclusion, and local-only tools—without Math.random or a server.
Read article →