Explanations and guidance behind the tools on this site. Search articles →
AES-GCM checks every byte it decrypts against an authentication tag. AES-CBC does not, which means a modified ciphertext can decrypt cleanly into different plaintext and your code will never know.
A plain hash proves data has not changed. It says nothing about who sent it, and that gap is exactly where naive webhook signature checks fall apart.
A salt turns identical passwords into different hashes and makes precomputed rainbow tables useless. Here is what a salt actually does, why it does not need to be secret, and how it differs from a pepper.
Client-side encryption protects data from a snooping network and an honest-but-curious server, but not from the JavaScript that runs it. Here is the trust boundary that doesn't go away just because the crypto happens in your browser.
Both do AES, both do SHA, and both end up calling the same underlying primitives. Here is what actually differs between the Web Crypto API and Node's built-in crypto module, and when it matters which one you reach for.
AES-128, AES-192, and AES-256 differ in key length and round count, not in how vulnerable they are today. Here is what the number actually buys you and when it matters.
A nonce does not need to be secret, but it must never repeat under the same key. Here is exactly what breaks in AES-GCM when it does, and how to make sure it never does.
How the Regex Tester's pattern builder turns plain-language pieces like "one or more digits" into a correct regular expression, and where a builder like this still runs out of road.
Why regex is easy to write badly and hard to read later, the mistakes that cause the most damage, and how to check a pattern before it ships.
Unix seconds, milliseconds, ISO 8601, .NET ticks: every system encodes time differently. Why integrations keep breaking over it, and how to fix it fast.
Disk encryption alone still leaves data readable once a system is compromised. Why application-level encryption at rest gives you real control over what a breach exposes.
Bad tooling doesn’t just waste time, it introduces bugs, security gaps, and decision fatigue. Here is what actually changes when your workflow tools are good.
A rundown of the latest additions to KeyForge: a JWT decoder with HS256 verification, a hash identifier, JSON diffing, GUID inspection, and bulk GUID export, all running client-side.
The Web Crypto API throws a bare OperationError on every failed AES-GCM decrypt, on purpose. Here is what actually causes it and how to find the real problem.
A practical checklist for judging whether a GUID generator, password tool, or JSON formatter is actually worth bookmarking, and how KeyForge stacks up against it.
The story behind KeyForge: why a developer tired of juggling a dozen different online tools decided to build one client-side toolkit instead, and what that actually took.
A straightforward comparison of SHA-256 and MD5: why MD5 is broken for security purposes, why it still shows up in checksums, and when SHA-256 is the right call instead.
Why keeping GUID generation, encryption, password generation, and JSON formatting in a single client-side toolkit saves developers time and avoids the risks of scattered, server-side tools.
How weak or reused passwords actually get broken: credential stuffing, brute force, phishing, and rainbow tables, and how to generate passwords that hold up.
Why JSON.stringify() silently drops fields, reorders keys, or throws on circular references, and what to do about each case.
What entropy actually measures, how length and character sets affect it, and how to pick a password length that resists brute-force.
A plain-language introduction to AES encryption for developers who need to use it correctly without getting a cryptography degree first.
Answers to common questions about client-side developer tools: data safety, encoding vs encryption, and more.
A quick reference for generating a version 4 UUID in JavaScript, Python, and Go, using each language's built-in tools, no third-party dependency required.
Block cipher modes explained, and why GCM is the better default over CBC for most new work.
Why encoding a value with Base64 provides zero confidentiality, why developers keep making this mistake anyway, and what to use instead.
What a UUID is, why it exists, and how versions 1, 4, and 5 differ.
How to check whether a password generator, including the one built into your password manager, is actually using cryptographically secure randomness.
The difference between JSON that fails to parse and JSON that parses fine but violates a schema, and why tooling should treat them separately.
When a UUID primary key is worth the tradeoffs over a simple auto-increment integer, and when the integer is still the better choice.
Three common binary-to-text encodings compared on size, alphabet, and where each one actually gets used.
A practical comparison of localStorage, sessionStorage, environment variables, and secrets managers for storing AES encryption keys, and why most of the obvious options are wrong.
Why a fast general-purpose hash like SHA-256 is the wrong tool for storing passwords, and how bcrypt and Argon2 close that gap.
A walkthrough of the most common "Unexpected token" JSON parse errors, what each one actually means, and how to fix them quickly.
How symmetric and asymmetric encryption differ, why real systems use both together, and how to pick the right one for a given problem.