COSESAI

Base64URL Encoder Decoder poster dark with cyan accent

Why Your JWT Breaks in URLs: The Base64URL Mistake 9 in 10 Engineers Ship

By xiezixing 2026年7月23日

Base64URL is not Base64 — and the difference breaks a JWT every time it travels through a URL. Here is the alphabet, the two-line fix, and the three workflows that catch the wrong encoding.

X.509 Certificate Decoder — read PEM certs in 30 seconds

未分类

X.509 Certificate Decoder: 8 Fields, 4 Traps, 5 Sibling Tools for Reading PEM

By xiezixing 2026年7月12日

Parse PEM certificates into subject, issuer, validity, SANs, fingerprint, and key usage — what openssl x509 prints, rendered without the command line.

Security Headers Checker — 12-Header Audit, A+ to F Grade

未分类

Security Headers Checker: A+ to F Grade in 30 Seconds

By xiezixing 2026年7月9日

Audit HTTP response headers for OWASP security compliance. Paste raw headers from curl, DevTools, or CI — get a letter grade with copy-ready fixes for HSTS, CSP, X-Content-Type-Options, COOP/COEP/CORP, and nine more.

Bcrypt Generator - Why Your Password Hash Is the Wrong Defense

未分类

Why Your Password Hash Is the Wrong Defense (and How Bcrypt Closes the Gap)

By xiezixing 2026年7月9日

Bcrypt has held the password-storage line for twenty-five years. Here is the algorithm, the cost knob, and the four things that fail when teams wire it in.

PKCE Code Verifier and Challenge Generator — Three modes that turn invalid_grant into a concrete check

未分类

Three PKCE Modes That Turn invalid_grant Into a Concrete Check

By xiezixing 2026年7月5日

Generate, validate, and verify OAuth 2.0 PKCE code_verifier and code_challenge pairs against RFC 7636 — without round-tripping through the identity provider.