Security & Privacy

A PIN's strength is just 10 raised to the digit count — here's the exact combination count and bit figure for each length, and why going from 4 to 6 digits matters more than it sounds.

A passphrase's strength is just word-count times bits-per-word, plus whatever's on the end — here's the arithmetic, worked on a real 2048-word list.

An API key's strength is just its length times 4 bits per hex character — here's why that number is exact, and what length actually buys you.

An 8-character password with symbols falls in seconds. A 16-character one holds for ages. Entropy is just counting — here's how to do it, and what actually protects your accounts.

If you own a domain, you can host a static site for free on Cloudflare Pages. Here's how to do it and harden it so it isn't soft — with five free WAF rules that stay effective even in public.

“Password-protected” and “properly encrypted” aren't the same thing. Here's what really makes a PDF secure — and how to verify it privately.

SOC 2 is really one question repeated: for each control, can you prove it's happening? Here's how to score yourself before an auditor does.

No account, no ads, no trackers, no upload. Here is how the whole thing fits together — and why the free half is genuinely free.

Not a detection engine — a documented set of risk-based criteria, and the record of what you examined.

It looks scrambled, so people treat it as though it hides something. It hides nothing — here is a round trip you can check, and what that means for anything you have encoded.

A JSON Web Token is signed, not encrypted. The signature proves nobody altered it — it does not hide a single character of what is inside.

SHA-256 is not encryption and there is no reverse operation. Here is what a hash is genuinely good for, and one job it is the wrong tool for.