Cryptography Tutorial with Examples.
Applied cryptography tutorial you can run: hashes and HMACs, AES-GCM, nonce reuse, password work factors, signatures, a local CA, TLS and key rotation.
Beginner
Start here — no prior experience needed
Hashes and HMACs: What Each One Actually Proves
Run SHA-256 and HMAC in Python: one input bit flips half the digest, a recomputed hash fools a naive check, and only the keyed HMAC rejects the forgery.
Symmetric Encryption with AES-GCM: Tampering Raises InvalidTag
Encrypt with AES-GCM in Python, then flip one bit, use the wrong key or the wrong associated data, and watch each raise InvalidTag instead of garbage.
Intermediate
For developers with core concepts down
ECB Leaks Patterns, and a Reused Nonce Leaks Plaintext
See two classic AES mistakes on your own data: ECB repeating identical blocks, and a reused GCM nonce making c1 XOR c2 equal p1 XOR p2. Then fix both.
Password Hashing Work Factors, Measured
Time SHA-256, PBKDF2, bcrypt, scrypt and argon2id on your own machine to see the guesses per second each allows, then store and upgrade argon2id hashes.
Public-Key Signatures and Key Exchange with Ed25519 and X25519
Sign with Ed25519 and watch one changed byte or the wrong public key raise InvalidSignature, then agree on a shared AES key with X25519 and HKDF in Python.
X.509 Certificates: Build a Local CA and Watch Verification Fail
Build a throwaway CA with openssl, issue a server certificate, then watch verify fail with error 20, pass with -CAfile, and reject a hostname mismatch.
The TLS Handshake, Run Locally with openssl s_server
Run a TLS 1.3 handshake on localhost with openssl s_server and s_client, then watch it fail on an unknown CA, a wrong hostname and a TLS 1.2-only client.
Advanced
Production-grade patterns for experienced engineers
Also part of Cryptography
Taught in other topics. Each link opens the lesson in its home topic.
Python Security
Run real attacks against local Python code and fix them: SQL injection, shell injection, path traversal, weak tokens and password hashes.
Java Security
Secure Java coding by running it: allowlist validation, SQL injection vs PreparedStatement, PBKDF2 hashing, SecureRandom, AES-GCM and KeyStore.
Data Security and PII: Hashing, Masking, and Tokenization
Run the same email and SSN through three PII techniques and see what each gives up: hashing for joins, masking for display, tokenization for reversal.
FastAPI Authentication: Password Hashing, OAuth2 and JWT
Hash passwords with pwdlib and Argon2, log in through FastAPI's OAuth2 password flow, issue JWTs, and see wrong, expired and tampered tokens get 401s.
JWT Authentication in Spring Boot
Issue and verify JWTs in Spring Boot 3 with Spring Security's resource server: login endpoint, roles claim, forged and expired tokens, all curled.
JavaScript Security Best Practices
Learn how to protect JavaScript applications from XSS, CSRF, prototype pollution, insecure JWT handling, and other common web security vulnerabilities.
Secrets: Real Log Masking, and the Base64 Trick That Defeats It
GitHub Actions masks a secret printed directly to the log — but transforming it first (base64, a substring, a hash) produces output the masker never recognizes as the secret, leaking it in full.
sensitive = true: What It Hides, and What It Doesn't
sensitive = true masks a secret in plan output, but state keeps it in plain text. Real runs show both, plus why an ephemeral variable is refused.
Variable Precedence: host_vars Beats group_vars, and extra-vars Beats Everything
The same variable name, defined in three places, resolves to three different values depending on where you look — verified by actually stacking group_vars, host_vars, and -e against each other.