Security Guides
Long-form explanations of the ideas behind our tools. Each guide shows its math, cites its sources, and lists the date it was last reviewed. Written by an independent developer.
Password Entropy Explained: The Math Behind Strong Passwords
What "bits of entropy" really means, how to calculate it for random passwords and passphrases, and how many bits you actually need.
How Password Cracking Actually Works (and What It Means for You)
Online guessing vs offline cracking, real GPU hash rates, dictionary and rule attacks, and why bcrypt and Argon2 change the math.
Passphrases vs Random Passwords: Which Is Stronger?
A side-by-side comparison with real numbers: how many words you need, how word-list size matters, and when each option is the better choice.
NIST Password Guidelines (SP 800-63B-4) in Plain English
What the 2025 revision of NIST SP 800-63B actually requires: length, blocklists, no composition rules, no forced rotation, and how to apply it.
7 JWT Security Mistakes and How to Avoid Them
The alg "none" trap, algorithm confusion, decoding without verifying, weak HMAC secrets, missing claim checks, and token storage.