Security tools
Passwords, TLS certificates and the things that keep you off incident calls.
Password Generator
Cryptographically secure passwords and passphrases, with real crack-time estimates.
Runs in your browser
SSL Certificate Checker
Expiry countdown, chain details, protocol and SAN list for any HTTPS host.
Hash Generator
MD5, SHA-256, SHA-512 and HMAC for text and files, with checksum verification.
Runs in your browser
Reading in this category
Cloudflare origin PQC: ML-DSA-44, OpenSSL 3.5.0
Authenticated Origin Pulls and Custom Origin Trust Store now take ML-DSA certificates. The requirements: OpenSSL 3.5.0, seed-only keys, Full (strict).
Classic McEliece is the first ISO post-quantum standard
ISO just made Classic McEliece the first post-quantum algorithm in ISO/IEC 18033-2. Here is what that milestone means, and why it is not your TLS default.
Post-quantum TLS: why ML-DSA is the signature to ship
NIST has nine newer post-quantum signatures cooking, but Cloudflare says ship ML-DSA now. Here is what its size and speed really cost your TLS.
Proton Lumo 2.0 review: how private is it, really?
Proton Lumo 2.0 is a big jump for the private ChatGPT alternative. What its zero-access encryption actually protects, what the server still sees, and who should switch.
Secure Boot certificates expire in 2026: the Linux fix
Microsoft's 2011 Secure Boot certificates expire in 2026. Your Linux or dual-boot PC keeps booting; the real fix is enrolling the 2023 key with fwupd. Here's how.
No, Claude Mythos didn't hack the NSA: what really happened
An authorized AI red-team drill became the viral claim that Claude Mythos hacked the NSA. What Anthropic's eval really showed, and what it means for defenders.
Is your nginx exposed? How to check and harden it
The June 2026 critical nginx CVEs only hit specific configs. How to check if you are exposed, which version patches them, and how to harden nginx for the long run.
How to secure a new Ubuntu VPS
Secure a fresh Ubuntu VPS: a sudo user instead of root, SSH keys with passwords off, a default-deny ufw firewall, fail2ban, and automatic updates. The order that matters.
How to generate an SSH key (ssh-keygen)
Generate an SSH key with ssh-keygen -t ed25519, set a passphrase, and copy the public key to a server. Same steps on Linux, macOS and Windows, with the RSA fallback.
Are JWTs encrypted? No, and the difference will bite you
JWTs are encoded and signed, not encrypted: anyone holding a token can read every claim. What the signature really protects and what never belongs in a payload.
How long does it take to crack a password in 2026?
Real crack times for 2026: an 8 character password falls in under 2 hours offline, 16 characters holds for ages. The math, the hardware and what to do.
TLS 1.2 vs TLS 1.3: what changed and what to run in 2026
TLS 1.3 handshakes in one round trip instead of two, drops every broken cipher and encrypts more of the handshake. What changed, why, and how to migrate.