Security guides
Clear technical reading for browser privacy, networks, web security and cryptography.
Latest guides
54 articlesWhy your public IP changes: VPNs, CGNAT and IPv6
Trace an unexpected address to the request, route and address family that produced it, with a practical comparison record.
Read a WebRTC test without confusing every address with a leak
Identify host, server-reflexive and relay candidates, then investigate differences between browser web traffic and ICE gathering.
Read DNS records when a website or email service stops working
Use A, AAAA, CNAME, MX and TXT evidence to isolate delegation, record and cache problems before changing a zone.
Audit security headers across redirects, errors and authenticated pages
Build a response matrix that catches missing middleware, stale edge policies and differences between public and signed-in responses.
JWT validation: signatures, claims and the key you actually trust
Work through a token-verification decision using issuer, audience, expiry and an independently trusted key.
IPv4 subnetting with a worked /26 network plan
Calculate network boundaries, usable ranges and broadcast addresses, including the exceptions for point-to-point links and host routes.
Read IPv6 addresses, prefixes and compressed notation
Expand and shorten IPv6 correctly, recognise address scope and separate a local address observation from internet reachability.
Test canvas fingerprint repeatability without inventing a privacy score
Control browser settings, rendering conditions and comparison inputs to find what changed in a canvas measurement.
What a WebGL renderer reveals, and why it sometimes disappears
Interpret masked renderer strings, software rendering and graphics limits while separating privacy controls from performance failures.
Offline audio fingerprints: what the browser calculates
Understand an oscillator-compressor test, compare repeatability and avoid confusing an audio computation with microphone recording.
Debug browser permissions by origin, frame and request state
Resolve permission failures by distinguishing browser support, user grants, secure contexts and embedding policy.
GPC and Do Not Track: inspect the signal and its limits
Read exposed privacy preferences and understand why a browser setting does not prove how a remote service handles data.
CSS pixels, zoom and the mobile keyboard: a viewport field guide
Find layout failures by comparing screen dimensions, layout viewport, visual viewport and device pixel ratio.
Feature detection that survives browser updates
Use existence checks, secure-context checks and a real operation to decide whether an API is usable in the current page.
Browser storage: quotas, eviction and persistence
Plan offline data handling around estimated usage, origin boundaries, failed writes and the limits of persistence requests.
Why a supported video format still fails to play
Separate container support, codec profiles, decoding performance and network delivery when diagnosing media playback.
Locale and timezone bugs: test the values your page actually uses
Reproduce date, number and language errors using explicit locale settings and timezone-aware examples.
DNSSEC validation: read the AD flag and the chain behind it
Distinguish resolver assertions, signed zones and broken delegation evidence before changing DS or DNSKEY records.
Domain names, Unicode and Punycode: inspect the exact hostname
Separate a domain label, URL and registrable name, then review internationalised names without treating conversion as a trust verdict.
CAA records: authorise certificate issuers without blocking renewals
Review issuer tags, wildcard handling and inherited policies before a certificate renewal reaches its deadline.
Plan a DNS migration around TTLs and real cache behaviour
Build a cutover timeline that accounts for old TTLs, negative caching, resolver policy and application connections.
Audit an email domain using a real delivered message
Follow envelope sender, DKIM signing domain and visible From through SPF, DKIM and DMARC evidence.
SPF records: lookup limits, includes and the wrong From address
Trace SPF evaluation, identify expensive DNS mechanisms and understand why SPF success can still leave DMARC failing.
DMARC alignment and a staged path to enforcement
Use authentication reports and representative mail flows to decide when quarantine or reject is appropriate.
DKIM selectors, public keys and rotation without guesswork
Locate the selector in a real signature, inspect its DNS key and distinguish key publication from message verification.
Diagnose TLS certificate failures by hostname, chain and time
Investigate certificate errors using the requested hostname, SNI, chain evidence and the clock involved in validation.
Roll out HSTS without stranding a forgotten subdomain
Plan max-age, includeSubDomains and preload decisions around service ownership and recovery time.
Build a CSP rollout around nonces and actual application flows
Move from a dependency inventory to report-only observation and enforcement, with concrete nonce and reporting decisions.
Session cookies: scope, SameSite and prefix rules
Choose attributes that fit login and payment flows, then check what the browser actually accepts and sends.
Referrer-Policy: decide which navigation details leave your site
Compare origin and full-URL disclosure across request types, and test policies where redirects and subresources complicate the picture.
Permissions Policy for embedded camera and microphone features
Debug feature access across top-level headers, iframe allow attributes, user permission and secure contexts.
Debug CORS preflights and credentialed requests
Trace a browser request from Origin through OPTIONS and the actual response, including cache and credential failures.
Read a URL before you trust its destination
Locate the real hostname, identify userinfo and encoding traps, and separate URL syntax from destination reputation.
Percent encoding: choose the right operation for each URL component
Avoid double encoding, broken query parameters and plus-sign mistakes with component-level examples.
Subresource Integrity for scripts served from a CDN
Generate a digest from exact asset bytes and plan for CORS, version changes and failed loads during deployment.
Write a security.txt file that a reporter can actually use
Publish reachable contact details, expiry and canonical information, then test the complete reporting path.
Verify a download checksum without confusing integrity with trust
Compare complete digests, obtain the expected value independently and understand when a signature gives stronger evidence.
Browser file encryption: plan the password and recovery test first
Understand authenticated encryption, the vault format and a safe round-trip workflow before deleting or moving source files.
Why identical-looking text produces different hashes
Inspect UTF-8 bytes, Unicode normalisation and line endings before comparing text digests across applications.
Verify webhook HMACs using the original request bytes
Define the signed message, key encoding, timestamp window and replay rules before comparing a webhook signature.
Password breach checks: what a range query can tell you
Understand hash prefixes, padded responses and corpus limits, then choose a practical response to a match.
UUIDv4 identifiers: randomness, collisions and validation
Read the version and variant bits, estimate collision risk responsibly and keep identifiers separate from access control.
Generate passwords around a password-manager workflow
Choose length and character rules with an explicit threat model, then handle storage, recovery and service restrictions.
Design random tokens with enough entropy and a clear expiry
Convert a byte budget into encoded length, store verifiers safely and plan single-use and revocation behaviour.
Review a HAR archive before it reaches a support ticket
Inspect request and response data, remove application-specific secrets and verify that redaction preserves a useful reproduction.
Base64 and Base64url: decode bytes without losing Unicode
Work through padding, alphabet differences and UTF-8 conversion, including why encoding is not encryption.
Hexadecimal data: bytes, text and endianness
Read hex pairs, recognise malformed input and decide when a byte sequence should be decoded as text or a number.
JSON validation beyond a missing comma
Separate syntax, duplicate member names, numeric precision and schema requirements when reviewing an API payload.
Unix timestamps: seconds, milliseconds and timezone mistakes
Recognise units, preserve range and reproduce daylight-saving errors without treating a timestamp as a local clock reading.
Your fingerprint is not your identity.
A matching browser signature is an observation. Here is what it can tell you, what it cannot, and how to compare your own setup.
A VPN check needs more than an IP address.
HTTP, WebRTC and DNS can follow different paths. Learn to compare the evidence without mistaking one successful check for a complete audit.
Security headers that earn their place.
A practical way to improve response policies while preserving login, checkout and the integrations your site actually needs.
That HAR file might be your login.
Before attaching a network trace to a support ticket, check the credentials and application data that may be travelling with it.
Hashing and encryption do different jobs.
A file checksum, an encrypted vault and a breach lookup can all involve cryptography. Knowing which question each answers prevents expensive mistakes.
No guides match that search.
54 guides