Technical deep dives on backend engineering, application security and Italian standards. Every article starts from a real algorithm — the one running in the free tools on this site — and ends at what it changes in day-to-day work.
Base64url is not encryption and decoding is not verifying. Token structure, the classic attacks (alg none, RS256/HS256 confusion) and a server-side verification checklist.
Entropy measures the process that generated the password, not the string you are looking at. With the numbers: what a bit is worth, why "one uppercase and a symbol" makes things worse, and what actually works.
Collisions, preimages, the avalanche effect. Why MD5 is unusable for signatures yet legitimate for cache keys, and why SHA-256 is the wrong choice for passwords.
v4's pure randomness fragments B-tree indexes. v7 puts a timestamp in the high bits and restores insert locality, at the cost of revealing when it was created.