COSESAI

JWT Inspector & Verifier Field Guide: When Decoding Is Not Verifying

By xiezixing 2026年8月28日

Decode, verify, and rehearse the algorithm-confusion attack on JWTs. The seven claims that decide whether your verifier admits or rejects a token.

未分类

SSH Key Pair Generator: A Field Guide to Modern SSH Authentication

By xiezixing 2026年8月7日

Ed25519, RSA 4096, and ECDSA P-256 all solve the same problem — proving identity without sending a secret. This guide walks through the OpenSSH key format, the SHA256 fingerprint workflow, and how to generate a key pair locally with the Elysia Tools SSH Key Pair Generator.

未分类

Your JWT Verifier Passed a Forged Token. The Library Did Exactly What It Was Told.

By xiezixing 2026年7月29日

Algorithm confusion is the most common JWT verifier failure in production. Pin the alg, pin the iss, pin the aud — then verify the signature.

Base64URL Encoder Decoder poster dark with cyan accent

未分类

Why Your JWT Breaks in URLs: The Base64URL Mistake 9 in 10 Engineers Ship

By xiezixing 2026年7月23日

Base64URL is not Base64 — and the difference breaks a JWT every time it travels through a URL. Here is the alphabet, the two-line fix, and the three workflows that catch the wrong encoding.

Scrypt Validator cover showing seven parameter inputs and a bit-exact answer

未分类

Why Scrypt Verification Quietly Fails: The Parameter Trap Behind Every Login

By xiezixing 2026年7月19日

A standalone Scrypt Validator belongs in your incident kit. Verification is where scrypt silently breaks, and a bit-exact debugging instrument catches it before customers do.

PKCE Code Verifier and Challenge Generator — Three modes that turn invalid_grant into a concrete check

未分类

Three PKCE Modes That Turn invalid_grant Into a Concrete Check

By xiezixing 2026年7月5日

Generate, validate, and verify OAuth 2.0 PKCE code_verifier and code_challenge pairs against RFC 7636 — without round-tripping through the identity provider.