Live fingerprint
Make a message. Get a hash.
SHA-256256 bits
Change one character. The fingerprint changes completely.
Beginner field guide Secrets · fingerprints · signatures · trust
The internet runs on cryptography. Let’s see what it does.
Start with the jobs cryptography performs, touch the ideas in local labs, then follow how modern protocols combine the pieces.
- Plain language
- Real SHA-256
- No tracking
01 First principles
Four tools. Four different jobs.
Most confusion disappears once you stop treating “crypto” as one magical action. Start by asking what job needs doing.
Keep it secret
Encryption
Turns readable plaintext into scrambled ciphertext. The right key reverses it.
Think: a locked box
Notice a change
Hashing
Makes a fixed-size digest from any input. It is designed to be one-way, not unlocked later.
Think: a fingerprint
Prove shared-secret origin
MAC
A message authentication code detects changes and shows that someone with the shared secret made it.
Think: a secret wax seal
Prove key-holder origin
Digital signature
A private key signs. The corresponding public key lets others check the signer and the message.
Think: a verifiable autograph
The fast translation
What are you trying to achieve?
Choose the goal first. Then choose a well-reviewed tool or protocol that provides it.
| Goal | Typical tool | Can it be reversed? | Needs a secret? |
|---|---|---|---|
| Hide data | Encryption | Yes, with a key | Yes |
| Fingerprint data | Hash | No | No |
| Authenticate between secret-sharers | MAC / HMAC | No | Shared secret |
| Publicly verifiable origin | Digital signature | No | Private signing key |
02 Shared-key encryption
One shared secret. Fast protection for real data.
Symmetric encryption uses the same secret key to protect and recover data. It is the efficient workhorse behind encrypted files, disks, databases, and network sessions.
Plaintext
The readable message or file.
AES key
Unpredictable key material shared by authorized parties.
Nonce
A per-message value that must meet the mode’s uniqueness rules.
Ciphertext + tag
Hidden content plus evidence that detects tampering.
The standard primitive
AES is a block cipher, not a complete recipe.
AES transforms fixed-size blocks under a secret key. Applications use it through a carefully specified mode and a maintained library rather than applying raw AES directly.
The safer goal
AEAD protects secrecy and integrity together.
Authenticated encryption with associated data can hide the message, detect changes, and authenticate unencrypted context such as a record type or protocol header.
The reuse trap
A nonce is public. Reusing it can still be catastrophic.
Nonce requirements depend on the algorithm. With widely used modes such as GCM, repeating a nonce with the same key can expose relationships between messages and undermine authentication.
Encoding changes representation
Base64 and hexadecimal make bytes easier to store or transmit. They provide no secrecy; anyone can decode them.
Hashing makes a digest
A hash is designed to be one-way and uses no decryption key. It does not hide low-entropy guesses such as passwords.
Encryption hides content
Encryption is reversible for someone with the required key. Secure use also needs integrity protection.
Randomness and entropy
Unpredictability is raw material.
Keys, salts, and many nonces begin with secure randomness. Use the operating system, a maintained cryptographic library, or approved hardware. Human choices, timestamps, and ordinary random functions are not substitutes.
MAC and HMAC
Shared-secret authentication without encryption.
A MAC detects message changes and shows that someone with the shared secret produced it. HMAC is a standard construction built from a cryptographic hash; it authenticates but does not hide the message.
Hybrid cryptography
Protocols combine tools because no primitive does every job.
TLS uses public-key techniques to authenticate and establish fresh secrets, key derivation to create session keys, and fast authenticated encryption to protect application data.
03 Hash functions
A tiny fingerprint for any amount of data.
A cryptographic hash function accepts a message of any practical length and produces a fixed-length digest. It is easy to compute forward—and deliberately hard to undo.
Repeatable
Identical input, identical digest—every time.
Sensitive
A tiny input change should scramble the output.
One-way
A digest should not reveal the original message.
LAB / 01
The avalanche lab
Compare two messages. Changed digest bytes light up; the meter counts the exact output bits that differ.
Original
SHA-256 digest
One character changed
SHA-256 digest
Output difference
— / 256 bits
Edit either message to compare its fingerprint.
Important distinction
A hash is not encryption.
Encryption is meant to be reversed by someone with a key. A cryptographic hash has no decryption key. You verify a guess by hashing it and comparing digests.
candidatehash()compare
Password trap
Fast hashes are bad password vaults.
SHA-256 is intentionally fast. Attackers can therefore test guesses quickly. Password storage needs a unique salt and a deliberately costly password-hashing function such as Argon2id.
OWASP password guidanceGo deeper What does “hard to break” mean for a hash?
Preimage resistance
Given a digest, finding any input that produces it should be computationally infeasible.
Second-preimage resistance
Given one message, finding a different message with the same digest should be infeasible.
Collision resistance
Finding any two different messages with the same digest should be infeasible. Collisions must exist mathematically, but finding one should be out of reach.
The algorithm matters
MD5 and SHA-1 have practical collision weaknesses and should not be chosen for collision-resistant security. Use current, reviewed guidance for real systems.
04 Public-key cryptography
One key you share. One key you guard.
A keypair contains mathematically related keys with different roles. The public key can be distributed; the private key stays under its owner’s control.
Share it
PUBLIC KEY
Others can use it to encrypt to you or verify your signatures, depending on the system.
Guard it
PRIVATE KEY
Its holder can decrypt to themselves or create signatures, depending on the system.
LAB / 02
Who uses which key?
Switch the goal. Watch the key roles change.
Alice
Uses Bob’s public key
CIPHERTEXT
Public network
Eve sees scrambled data
Bob
Uses his private key
Goal: Alice wants only Bob to read her message.
- 1
Alice obtains an authentic copy of Bob’s public key.
- 2
She uses it to protect a secret for Bob.
- 3
Only Bob’s private key can complete the decryption.
“Public” does not mean “trusted.”
You still need confidence that a public key belongs to the person or service named. Certificates, trust stores, fingerprints, and verified directories help bind identities to keys.
A signature does not hide a message.
It makes tampering detectable and connects the signature to a private-key holder. Confidentiality is a separate job.
Modern systems are hybrids.
Public-key techniques solve authentication and key-agreement problems; symmetric cryptography efficiently protects the ongoing data.
Analogy check Where the “lock and key” metaphor breaks
Keys are data
They are carefully generated bit strings, not physical objects. Copying one may leave no visible trace.
Algorithms have precise roles
“Encrypt with the private key” is an oversimplification for signatures. Real signature schemes have distinct signing and verification operations.
Identity is a separate layer
The mathematics can show that two operations use a matching pair. It cannot, by itself, tell you whose pair it is.
05 Cryptography in practice
Strong math still needs careful operations.
Protocols fail when keys are predictable, copied casually, overused, or left trusted after compromise. Treat each key as controlled data with an owner, purpose, and planned end.
Generate
Use a cryptographically secure source and the correct algorithm, size, and parameters.
Control
Keep secret keys out of code, logs, chat, tickets, and ordinary files. Limit who or what may use them.
Replace
Know every dependency before rotation. Revoke and replace promptly when compromise is known or reasonably suspected.
Retire
End trust deliberately, preserve only what policy and recovery needs require, and remove obsolete copies.
Where the pieces meet
Cryptography you already use.
01 / WEB
Website certificates
A web server guards its private key. Its certificate publishes identity information and a public key, signed into a chain your browser can check.
Watch for: certificate validation, expiry, and exposed private keys.
02 / ACCESS
SSH keys
Your private key stays with you; servers receive your public key. Agents and hardware authenticators can reduce direct private-key exposure.
Watch for: stale access and unprotected private-key copies.
03 / SIGN-IN
Passkeys
A site stores a public key. Your authenticator retains the private key and signs a challenge tied to the real site, helping resist phishing.
Watch for: device sync, recovery, and authentic site binding.
04 / ASSETS
Wallet recovery phrases
A recovery phrase can recreate wallet key material. Anyone who obtains it may be able to control the assets; loss can make recovery impossible.
High-stakes rule: never enter one into an untrusted site or share it for “support.”
Continue the operational trail
Key Management 101
The companion guide covers inventories, ownership, storage, envelope encryption, rotation, revocation, recovery, audit trails, and compromise response in practical depth.
06 Video signal deck
See the ideas move.
Five carefully chosen explainers, arranged as a short viewing path. Select a card, then choose whether to load YouTube.
Hashing Algorithms and Security
Computerphile
8:11
01 / 05
0105
*The TLS video is a conceptual walkthrough and discusses protocol history. For precise current behavior, consult the linked TLS 1.3 standard.
07 Knowledge check
Three decisions, no trick questions.
Choose an answer, then read the reasoning. Security lives in the reasoning.
01 / 03
You downloaded a file. Which tool can help check whether its contents changed?
02 / 03
What is the better foundation for storing website passwords?
03 / 03
A private key may have been copied by an attacker. What comes first?
08 Resource library
Keep following the trail.
Selected for authority, clarity, and usefulness—not for having the loudest search result. Labels tell you what kind of reading to expect.
START HERE
Explainer · Beginner
How public-key encryption works
Build intuition
A concise bridge from keypairs to HTTPS.
Free book · Beginner+ Crypto 101A programmer-friendly tour from ciphers and hashes to TLS.
Reference · Beginner Security terminologyPlain distinctions between encryption, hashing, signatures, and more.
GO DEEPER
Open textbook · Intermediate
The Joy of Cryptography
Study the craft
A rigorous undergraduate path with open online chapters.
Free textbook · Advanced A Graduate Course in Applied CryptographyA broad, mathematically serious reference.
Book · Intermediate Cryptography EngineeringDesign principles and the surrounding systems where crypto succeeds or fails.
STANDARDS DESK
Guidance · Professional
Recommendation for Key Management
Check the source
NIST’s current final Part 1 guidance at the time this page was reviewed.
Checklist · Professional Key Management Cheat SheetApplication-focused practices for generation, storage, compromise, and recovery.
Standard · Advanced TLS 1.3The protocol specification behind modern secure browser connections.
Sources last reviewed July 2026. SP 800-57 Part 1 Rev. 5 remains NIST’s current final guidance; Rev. 6 is a public draft. Standards and security recommendations change, so check publication status before production decisions.
09 Pocket glossary
Translate the jargon.
AEAD
Authenticated encryption with associated data: encryption that also detects tampering and can authenticate selected unencrypted context.
AES
The Advanced Encryption Standard, a widely used symmetric block cipher that applications use through an appropriate mode.
Algorithm
A defined set of steps. A cryptographic algorithm specifies how data and keys are transformed.
Certificate
A signed document that binds identity information to a public key for a stated period and purpose.
Ciphertext
The scrambled output of encryption, intended to be unreadable without the required key.
Digest
The fixed-size output of a hash function.
Entropy
Unpredictability used when generating secure keys, nonces, and other cryptographic values.
Forward secrecy
A property that keeps old sessions protected even if a long-term key is compromised later.
Hash function
A function that maps input data to a fixed-size digest. Cryptographic hashes add specific resistance properties.
HMAC
A standard construction that combines a hash function and secret key to authenticate messages.
Initialization vector
A mode-specific input used with an encryption key. Its uniqueness or unpredictability requirements depend on the selected algorithm and mode.
Key derivation function
A function that derives one or more strong keys from source key material or, in specialized forms, a password.
Keypair
Two mathematically related keys used by an asymmetric cryptographic system.
Nonce
A value intended for one use in a particular cryptographic context; requirements vary by algorithm.
Private key
The non-public half of a keypair, used for operations such as decryption or signing.
Public key
The shareable half of a keypair, used for operations such as encryption or signature verification.
PKI
Public key infrastructure: the roles, policies, systems, and certificates used to establish trust in public keys.
Revocation
Marking a key, certificate, or credential as no longer trustworthy before its scheduled expiration.
Rotation
Replacing a key and transitioning systems to the replacement under a planned process.
Salt
A unique, non-secret value added before password hashing to defeat precomputed tables and separate identical passwords.
Secret key
A key that must remain confidential; in symmetric cryptography, authorized parties share it.
Digital signature
Data created with a private key that a corresponding public key can verify.
Trust anchor
A public key or certificate accepted as a starting point for validating a chain of trust.
No glossary terms match that search.