Skip to main content

Passwords, Hashes, and Tokens

This passwords, hashes, and tokens path explains what secure generation, password hashing, checksums, and JWT inspection solve—and what they do not.

Beginner to intermediate 40–55 minutes 5 steps

Why this workflow matters

Encoding, encryption, hashing, and signing are often mixed together in documentation and incident reports. That confusion leads to weak credential storage and unsafe token handling. This path uses local, disposable examples so you can see the boundaries between the concepts.

Use the browser-based security tools hub when you need one password, hashing, or token task without completing the full sequence.

Work through the steps

0 of 5 complete
1

Generate a strong random secret

Uses Password Generator

What to understand

Length and unpredictability matter more than clever substitutions. A password manager can store a long random value that a person should not need to memorize.

Try it

Generate values at 12, 20, and 32 characters. Compare the estimated strength while changing only length. Complete the exercise in the Password Generator, then return here to verify the checkpoint.

Checkpoint

You can state which settings are constraints and which ones meaningfully increase the search space.

2

Recognize predictable passwords

Uses Password Strength Checker

What to understand

A strength meter is an estimate, not a guarantee. It is most useful for identifying short, repeated, or commonly structured inputs—not for certifying a real credential.

Try it

Test invented examples only: a dictionary word, a predictable substitution, a passphrase, and a generated string. Never enter a real password. Complete the exercise in the Password Strength Checker, then return here to verify the checkpoint.

Checkpoint

You can explain why a longer passphrase may outperform a short “complex” password.

3

Hash passwords with bcrypt

Uses Bcrypt Hash Generator

What to understand

Bcrypt combines a random salt with an adjustable cost. The same password should produce different stored hashes while each hash can still verify the input.

Try it

Hash the same disposable password twice, compare the outputs, and verify both. Increase the cost once and observe the time difference. Complete the exercise in the Bcrypt Hash Generator, then return here to verify the checkpoint.

Checkpoint

The two hashes differ, both verify, and the plaintext cannot be recovered from either hash.

4

Use hashes for integrity

Uses Hash Generator

What to understand

A fast digest such as SHA-256 is useful for checksums and fingerprints. Fast hashing alone is not suitable for password storage because attackers can test guesses quickly.

Try it

Hash two strings that differ by one character. Compare their SHA-256 results, then create an HMAC with a disposable key. Complete the exercise in the Hash Generator, then return here to verify the checkpoint.

Checkpoint

You can distinguish an unkeyed digest from an HMAC and from a password hash.

5

Inspect, but do not trust, a JWT

Uses JWT Decoder

What to understand

JWT header and payload segments are Base64URL-encoded and readable. Decoding reveals claims; it does not prove that the token is authentic or still acceptable.

Try it

Decode a public sample token. Identify the algorithm, subject, issued-at time, and expiry without entering a production token. Complete the exercise in the JWT Decoder, then return here to verify the checkpoint.

Checkpoint

You can explain why a server must verify the signature, issuer, audience, and time claims.