Security & Cryptography Guides
4 articlesCryptography is unforgiving in a specific way: the code runs fine, the tests pass, and the mistake only surfaces when an attacker finds it. These guides focus on the decisions where that gap is widest — picking a password hash (Argon2 vs bcrypt vs scrypt, and why a fast hash like SHA-256 is the wrong tool), understanding what TOTP and HOTP actually protect against, and keeping the three commonly-confused operations straight: encoding (Base64, reversible by anyone), hashing (one-way), and encryption (reversible only with a key). The aim is to give you the mental model behind each primitive so you can reason about why a choice is safe, not just copy a snippet that happens to work.
What You'll Learn
- Password hashing done right: Argon2, bcrypt, and scrypt — work factors, memory hardness, and migration
- Why Base64 is not encryption, and how encoding, hashing, and encryption differ in purpose and guarantees
- Symmetric vs asymmetric: AES-256, SHA-256, and where each belongs in a real system
- Two-factor authentication: how TOTP and HOTP work and the replay protection a server must add
- Hash collisions, the pigeonhole principle, and why a strong algorithm makes them infeasible in practice
- Post-quantum context: what Grover's algorithm does to symmetric key strength and why AES-256 holds up
Why This Matters
A single weak choice — a fast hash for passwords, a reused TOTP code, treating Base64 as a secret — can quietly undermine an otherwise solid system, and the failure is usually invisible until it is exploited. Understanding the primitives lets you make choices you can defend, rather than ones that merely run without error.
All Articles
Are Online Password Generators Safe? What Client-Side Really Means
Is a web password generator safe? It comes down to one thing: is the password created in your browser or on a server? How to tell, and why it matters.
Password Hashing in 2026: Argon2 vs bcrypt vs scrypt vs PBKDF2
How to store passwords securely: compare Argon2id, bcrypt, scrypt, and PBKDF2, understand salts, peppers, and work factors, and what OWASP recommends.
AES-256 vs SHA-256 vs Base64: Encryption, Hashing, Encoding
AES-256 encrypts (reversible with the key). SHA-256 hashes (one-way). Base64 only encodes. Which one to use for passwords, tokens, and file checksums.
TOTP vs HOTP: Cryptographic Authentication Architecture Comparison
TOTP (RFC 6238) vs HOTP (RFC 4226): time-step validation, counter sync, replay attacks, and drift resynchronization in two-factor authentication.