Your Password Generator Is Only as Good as crypto.getRandomValues
How PassForge uses crypto.getRandomValues and entropy math to build passwords that actually resist offline guessing attacks.
Article archive
More articles
Browse older engineering guides and field notes, page 4.
Continue browsing
Articles
The FDIC BankFind API: Pull Any U.S. Bank’s Financials and Failure History as JSON (No Key)
The FDIC BankFind Suite API gives you every insured bank’s call reports, deposits, and failure history as free keyless JSON. Here’s how to query it.
Reading a JWT Offline: How to Spot alg:none and Algorithm Confusion Before They Bite
Most JWT bugs aren't cryptographic — you catch them by reading the token. Here's how I decode JWTs offline to spot alg:none, HS256/RS256 confusion, and leaked PII.
Your Photos Are Broadcasting Your Home Address — Strip EXIF GPS in the Browser
Phone photos carry your exact GPS coordinates inside the file. Here's what's in that EXIF block, which apps leak it, and how to strip it browser-side.
The Treasury FiscalData API: Pull the U.S. National Debt as JSON (No Key)
The U.S. Treasury FiscalData API serves the national debt, interest rates, and FX rates as clean JSON — no API key. How to use it, with tested Python.
Check If a Password Was Breached Without Sending It (HIBP k-Anonymity)
How Have I Been Pwned's k-anonymity range API lets you check a password against 900M+ breaches without ever sending it. Real code, real numbers, and the padding trick…