Learning path
Security from the ground up
Start with the mathematics of public and private keys, see how TLS uses them to protect every connection, then learn how websites store passwords safely and how OAuth lets apps act for you without ever seeing your password.
Step 1 of 4 · 13 min read
How public-key cryptography works
How two strangers can agree on a secret in public and prove who they are, explained with small worked examples of Diffie-Hellman and RSA, elliptic curves, digital signatures, key sizes and the move to post-quantum algorithms.
Step 2 of 4 · 15 min read
How TLS works
How Transport Layer Security protects data on the internet, from the cryptographic building blocks and the TLS 1.3 handshake to certificates, the key schedule, resumption and what TLS cannot hide.
Step 3 of 4 · 9 min read
How passwords are stored
How websites store passwords so that a stolen database does not reveal them, from hash functions and salts to slow and memory-hard functions such as PBKDF2, scrypt and Argon2, and the defenses that go beyond the database.
Step 4 of 4 · 11 min read
How OAuth and OpenID Connect work
How OAuth 2.0 lets an app act on your behalf without your password, from the four roles and the authorization code flow to PKCE, access and refresh tokens, JSON Web Tokens, sign-in with OpenID Connect, and today's security best practices.