Security tips, password guides, and best practices for staying safe online.
Published: 2026-11-02
I ran P@ssw0rd2026! through 10 password strength checkers. Some said 2 million years, one script cracked it in 50,000 guesses. Here's which meters you can trust.
Read more →Published: 2026-10-30
A one-visit checklist to protect elderly parents from phone scams: iPhone and Android settings for calls, texts, app installs, SIM PIN and recovery.
Read more →Published: 2026-10-29
What to do if your account is hacked: an ordered first-hour checklist for Instagram, Facebook and Telegram, plus the email step most people skip.
Read more →Published: 2026-10-29
Should you use passkeys? Yes, for your email and main accounts first. What a passkey is, which accounts to switch, and what happens if you lose your phone.
Read more →Published: 2026-10-11
Inlining images as Base64 data URIs rarely speeds up a page. Measured overhead, caching and LCP costs, and the small cases where inlining does pay off.
Read more →Published: 2026-07-13 · Updated: 2026-10-24
Bulk URL encoding for redirect maps, UTM tags and Cyrillic slugs: pick the right encoder, catch %25 double-encoding and NFC/NFD mismatches before they 404.
Read more →Published: 2026-06-28 · Updated: 2026-10-13
A social media security policy for teams and agencies: native roles over shared logins, a vault for the rest, phishing-resistant 2FA and fast offboarding.
Read more →Published: 2026-06-22 · Updated: 2026-10-22
Generate webhook secrets for Zapier, Make and n8n, turn on the auth they already have, and verify HMAC on the raw body. Tested in Node 22 and gitleaks.
Read more →Published: 2026-06-10 · Updated: 2026-10-21
A CSPRNG is a random source you can't predict from its output. I rebuilt Math.random() from 4 outputs in Node 22. Here's why, and what to use instead.
Read more →Published: 2026-06-09 · Updated: 2026-10-12
Encoding vs encryption vs hashing: who can reverse each one, why Base64 hides nothing, real cases where it was mistaken for security, and what to use when.
Read more →Published: 2026-06-08 · Updated: 2026-10-21
Generate, prefix, hash, scope and rotate API keys, tested in Node 22: which key formats gitleaks catches, and why SHA-256 beats bcrypt here.
Read more →Published: 2026-05-27 · Updated: 2026-10-20
UUID v4 is 122 random bits; v7 starts with a millisecond timestamp so database indexes stay sequential. Bit layout, a collision test and which to pick.
Read more →Published: 2026-05-23 · Updated: 2026-10-12
Generate an SSH key with ssh-keygen: ed25519 vs RSA, what the passphrase and KDF rounds buy you if the key file leaks, ssh-agent, and offboarding.
Read more →Published: 2026-05-17 · Updated: 2026-10-15
Keep .env secrets out of git, Docker images and logs, generate them properly, and rotate first when one leaks. With real commands and my own deploy setup.
Read more →Published: 2026-05-13 · Updated: 2026-10-11
What bcrypt is, how its salt and cost factor work, why MD5 password hashes fall in hours on one GPU, and how to migrate an MD5 table without resets.
Read more →Published: 2026-05-12 · Updated: 2026-10-11
How to store passwords in 2026: per-user salts, Argon2id or bcrypt settings from OWASP, real RTX 4090 numbers, peppers, and migrating old hashes.
Read more →Published: 2026-05-09 · Updated: 2026-10-30
Secure your Google Account and Apple ID: passkeys or security keys, recovery options you can actually use, device and app cleanup, and the settings that matter.
Read more →Published: 2026-05-08 · Updated: 2026-10-09
Ten password mistakes that still catch developers and power users, from reuse and forced rotation to Math.random(), with the real numbers and a fix for each.
Read more →Published: 2026-05-04 · Updated: 2026-10-31
Chrome, Safari and Firefox password managers compared on what actually matters: who holds the key, what infostealers can read, and when to use a dedicated vault.
Read more →Published: 2026-05-02 · Updated: 2026-10-08
Password entropy in bits, how much an attacker can actually exhaust per year, and why 12 random characters is the floor while NIST asks for 15.
Read more →Published: 2026-04-30 · Updated: 2026-10-31
Got a data breach notification? What to change first, how fast a leaked hash really falls, and how to stop credential stuffing and follow-up phishing.
Read more →Published: 2026-04-26 · Updated: 2026-10-14
2FA is MFA with exactly two factors. What matters more is which second factor you pick: what SMS, TOTP, push and passkeys each stop, with NIST Rev. 4 rules.
Read more →Published: 2026-04-25 · Updated: 2026-10-07
A brute force attack guesses passwords until one works. How the variants differ, why length beats complexity, and what stops each one in practice.
Read more →Published: 2026-04-21 · Updated: 2026-10-06
Password crack time on one RTX 4090, by length and charset, against MD5 and bcrypt. The real assumptions behind the table, plus how long yours should be.
Read more →Published: 2026-04-19 · Updated: 2026-10-13
How to create a strong password: why length beats symbols, what NIST now requires, real RTX 4090 crack times, and when a passphrase is the better choice.
Read more →Published: 2026-04-19 · Updated: 2026-10-14
Six random words match 12 random characters, but only if the words come from a big list. The entropy math, a crack-time table and when to use each.
Read more →Published: 2026-04-19 · Updated: 2026-10-20
Password security best practices in the order I'd set them up: unique random passwords, a manager, phishing-resistant 2FA, and the rules developers should drop.
Read more →