Base64, JWTs, URLs, hashes, passwords, and other encoding or security checks.
You build a link. It works in the browser when you click it. It fails when you paste it into a JSON body, a CSV, or a redirect rule. A space becomes a problem. An ampersand eats the rest of the query. A plus sign turns into a space and a token dies. URL encoding … Read more
You downloaded a program. The site printed a SHA-256 string. You have no idea what to do with it, so you skip it. Or you install a package and later wonder whether the file on disk is still the file you fetched. A hash is a fingerprint of bytes. If the bytes change, the fingerprint … Read more
A JWT looks like security. It is three chunks of text with dots. People paste them into dashboards, stash them in localStorage, and assume the payload is gospel because it arrived in a token. A JWT is a signed statement, or sometimes an encrypted one. Decoding the middle part is reading the statement. Verifying the … Read more
People do not fail at passwords because they cannot imagine a random string. They fail because they have forty accounts, they are asked to rotate them, and a site rejects the one character their manager suggested. Then they reuse Summer2024! with a tiny twist, and a breach at a junk forum becomes a breach at … Read more
Base64 shows up when you least want a new problem. An API wants a basic auth header. An email attachment looks like alphabet soup. A data URL starts with data:image/png;base64, and you need the actual image. A JWT middle section is Base64url, which is almost Base64 and enough different to waste twenty minutes. You do … Read more