Data & cryptography
Technical guides about data & cryptography, written for practical follow-up.
Latest guides
16 articlesA readable JWT payload is not an accepted login token
Build a verification decision from a trusted key, expected issuer and audience, expiry and the algorithm policy.
The download hash matches. Where did the expected value come from?
Separate a complete checksum comparison from the independent publisher evidence needed to trust a download.
Before encrypting your only copy, rehearse the recovery
Use a verified encryption and decryption round trip to plan password handling, backups and safe file replacement.
These strings look identical. Their UTF-8 bytes may differ
Inspect Unicode composition, line endings and exact input bytes when a text digest disagrees across systems.
The webhook JSON is equivalent, but its HMAC no longer matches
Verify the original request bytes and provider signing contract before parsing and reserialising a webhook body.
No breach match is evidence about a corpus, not a password guarantee
Understand range-query disclosure, known-corpus limits and the practical response to a matching password.
An unpredictable UUID is still an identifier, not access control
Check UUIDv4 version and randomness while keeping resource identifiers separate from authorisation decisions.
The password rule changed. Keep length, randomness and storage in the plan
Generate unique credentials around real service restrictions and a password-manager workflow.
A reset token needs a lifetime and a storage rule as well as random bytes
Plan entropy, encoding, verifier storage, single use and expiry for application tokens.
A HAR redaction can remove cookies and still leave account data behind
Review request URLs, headers and bodies while keeping enough evidence to reproduce a support issue.
The Base64 decoded, but the text did not. Inspect the bytes first
Separate Base64 alphabet and padding issues from UTF-8 decoding and the binary data represented by the input.
Hex pairs are bytes. Their meaning depends on the format
Check complete byte pairs, text encoding and endianness before interpreting hexadecimal input as data.
Valid JSON can still lose a number or hide a duplicate field
Review syntax separately from duplicate keys, numeric precision and the application schema.
A timestamp points to the wrong decade. Check seconds versus milliseconds
Identify epoch units and timezone presentation before changing a stored event time.
Prepare a support HAR that explains the failure without exporting the account
Use disposable reproductions and application-specific redaction while preserving a useful network request sequence.
Checksum, encrypted file or breach query: choose the operation for the question
Distinguish byte integrity, confidentiality and known-password evidence with practical workflows for each tool.
No guides match that search.
16 guides