# Peasy Safe — Full Catalog > Security tools made easy. Peasy Safe provides free browser-based tools at https://peasysafe.com/. All processing happens client-side — files never leave your device. ## Tools (15) ### Password Generator Generate strong, random passwords Create cryptographically secure random passwords with customizable length, character sets, and complexity requirements. Uses Web Crypto API for true randomness. - URL: https://peasysafe.com/safe/safe-password-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Set your desired password length (8–128 characters) 2. Select character types: uppercase, lowercase, digits, symbols 3. Click Generate to create a secure password 4. Review the entropy and estimated crack time 5. Copy the password to your clipboard ### Password Strength Checker Analyze password strength and vulnerability Evaluate password strength with detailed scoring, pattern detection, and actionable improvement suggestions. Checks against common password lists. - URL: https://peasysafe.com/safe/password-strength/ - Category: Privacy & Security - Processing: client - Steps: 1. Enter or paste a password to analyze 2. View the strength score (0–100) and grade 3. Check detected patterns and weaknesses 4. Follow improvement suggestions ### Hash Generator Generate SHA and other cryptographic hashes Compute cryptographic hash digests of any text using SHA-1, SHA-256, SHA-384, or SHA-512. Output in hex or Base64 format. - URL: https://peasysafe.com/safe/safe-hash-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Enter or paste text to hash 2. Select the hash algorithm (SHA-256 recommended) 3. Choose output format: hex or Base64 4. Click Hash to generate the digest 5. Copy the hash value ### HMAC Generator Generate keyed-hash message authentication codes Compute HMAC (Hash-based Message Authentication Code) using a secret key. Supports SHA-256 and SHA-512 algorithms. - URL: https://peasysafe.com/safe/hmac-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Enter the message to authenticate 2. Enter your secret key in the second input 3. Select HMAC algorithm (SHA-256 or SHA-512) 4. Click Generate to compute the HMAC 5. Copy the HMAC value ### AES Encrypt / Decrypt Encrypt and decrypt text with AES-256-GCM Encrypt text with AES-256-GCM authenticated encryption using a password. Decrypt previously encrypted messages with the same password. - URL: https://peasysafe.com/safe/aes-encrypt/ - Category: Privacy & Security - Processing: client - Steps: 1. Enter the text to encrypt (or ciphertext to decrypt) 2. Enter your password in the second input 3. Select Encrypt or Decrypt mode 4. Click to process 5. Copy the result — share it safely ### Random String Generator Generate cryptographically secure random strings Generate random strings with customizable length, character sets, and formats. Uses Web Crypto API for true cryptographic randomness. - URL: https://peasysafe.com/safe/random-string/ - Category: Privacy & Security - Processing: client - Steps: 1. Set the desired string length 2. Choose a character set: alphanumeric, hex, base64, or custom 3. Click Generate to create random strings 4. Copy the result ### CSP Header Generator Build Content Security Policy headers Build Content-Security-Policy headers with an interactive form. Generates HTTP header, meta tag, Nginx, and Apache configurations. - URL: https://peasysafe.com/safe/csp-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Set source values for each CSP directive 2. Use 'self' for same-origin, specific domains, or 'none' to block 3. Click Generate to build the CSP header 4. Copy the configuration for your server type 5. Test the policy with browser DevTools ### Text Redactor Redact sensitive information from text Automatically detect and redact sensitive information including emails, phone numbers, SSNs, credit card numbers, and IP addresses. - URL: https://peasysafe.com/safe/text-redactor/ - Category: Privacy & Security - Processing: client - Steps: 1. Paste text containing sensitive information 2. Select which PII types to redact 3. Optionally customize the replacement text 4. Click Redact to process 5. Copy the redacted text ### CORS Header Generator Build Cross-Origin Resource Sharing configurations Generate CORS (Cross-Origin Resource Sharing) configurations for Nginx, Express.js, Apache, and Django. Control which domains can access your API. - URL: https://peasysafe.com/safe/cors-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Enter allowed origin(s) or use * for any origin 2. Select allowed HTTP methods 3. Specify allowed request headers 4. Configure credentials and max-age 5. Click Generate and copy the config for your server ### SRI Hash Generator Generate Subresource Integrity hashes Generate Subresource Integrity (SRI) hashes for script and link tags. Verify that CDN-hosted resources have not been tampered with. - URL: https://peasysafe.com/safe/sri-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. Paste the content of your JS or CSS file 2. Select the hash algorithm (SHA-384 recommended) 3. Choose output format: integrity attribute or full HTML tag 4. Click Generate to compute the SRI hash 5. Add the integrity attribute to your HTML tags ### Base64 Encoder / Decoder Encode and decode Base64 with URL-safe variants Encode text to Base64 or decode Base64 strings. Supports standard (RFC 4648) and URL-safe variants. Shows data URI format, byte size, and encoding overhead. - URL: https://peasysafe.com/safe/base64-encoder-decoder/ - Category: Privacy & Security - Processing: client - Steps: 1. 1 2. . 3. 4. E 5. n 6. t 7. e 8. r 9. 10. t 11. e 12. x 13. t 14. 15. t 16. o 17. 18. e 19. n 20. c 21. o 22. d 23. e 24. 25. o 26. r 27. 28. a 29. 30. B 31. a 32. s 33. e 34. 6 35. 4 36. 37. s 38. t 39. r 40. i 41. n 42. g 43. 44. t 45. o 46. 47. d 48. e 49. c 50. o 51. d 52. e 53. 54. 2 55. . 56. 57. M 58. o 59. d 60. e 61. 62. i 63. s 64. 65. a 66. u 67. t 68. o 69. - 70. d 71. e 72. t 73. e 74. c 75. t 76. e 77. d 78. 79. ( 80. o 81. r 82. 83. c 84. h 85. o 86. o 87. s 88. e 89. 90. e 91. n 92. c 93. o 94. d 95. e 96. / 97. d 98. e 99. c 100. o 101. d 102. e 103. ) 104. 105. 3 106. . 107. 108. V 109. i 110. e 111. w 112. 113. s 114. t 115. a 116. n 117. d 118. a 119. r 120. d 121. 122. a 123. n 124. d 125. 126. U 127. R 128. L 129. - 130. s 131. a 132. f 133. e 134. 135. B 136. a 137. s 138. e 139. 6 140. 4 141. 142. v 143. a 144. r 145. i 146. a 147. n 148. t 149. s 150. 151. 4 152. . 153. 154. C 155. o 156. p 157. y 158. 159. t 160. h 161. e 162. 163. r 164. e 165. s 166. u 167. l 168. t 169. 170. o 171. r 172. 173. d 174. a 175. t 176. a 177. 178. U 179. R 180. I 181. 182. f 183. o 184. r 185. m 186. a 187. t ### JWT Decoder Decode and inspect JSON Web Tokens Parse JWT tokens to inspect header, payload, and signature. Shows all standard claims with descriptions, expiration status, and algorithm information. - URL: https://peasysafe.com/safe/jwt-decoder/ - Category: Privacy & Security - Processing: client - Steps: 1. 1 2. . 3. 4. P 5. a 6. s 7. t 8. e 9. 10. a 11. 12. J 13. W 14. T 15. 16. t 17. o 18. k 19. e 20. n 21. 22. ( 23. h 24. e 25. a 26. d 27. e 28. r 29. . 30. p 31. a 32. y 33. l 34. o 35. a 36. d 37. . 38. s 39. i 40. g 41. n 42. a 43. t 44. u 45. r 46. e 47. ) 48. 49. 2 50. . 51. 52. V 53. i 54. e 55. w 56. 57. d 58. e 59. c 60. o 61. d 62. e 63. d 64. 65. h 66. e 67. a 68. d 69. e 70. r 71. 72. ( 73. a 74. l 75. g 76. o 77. r 78. i 79. t 80. h 81. m 82. , 83. 84. t 85. y 86. p 87. e 88. , 89. 90. k 91. e 92. y 93. 94. I 95. D 96. ) 97. 98. 3 99. . 100. 101. I 102. n 103. s 104. p 105. e 106. c 107. t 108. 109. p 110. a 111. y 112. l 113. o 114. a 115. d 116. 117. c 118. l 119. a 120. i 121. m 122. s 123. 124. w 125. i 126. t 127. h 128. 129. e 130. x 131. p 132. l 133. a 134. n 135. a 136. t 137. i 138. o 139. n 140. s 141. 142. 4 143. . 144. 145. C 146. h 147. e 148. c 149. k 150. 151. e 152. x 153. p 154. i 155. r 156. a 157. t 158. i 159. o 160. n 161. 162. s 163. t 164. a 165. t 166. u 167. s 168. 169. a 170. n 171. d 172. 173. t 174. i 175. m 176. i 177. n 178. g ### UUID Generator Generate and validate UUIDs (v4 random) Generate cryptographically random UUID v4 identifiers. Validate and parse existing UUIDs. Shows version, variant, and multiple format variations. - URL: https://peasysafe.com/safe/uuid-generator/ - Category: Privacy & Security - Processing: client - Steps: 1. 1 2. . 3. 4. L 5. e 6. a 7. v 8. e 9. 10. e 11. m 12. p 13. t 14. y 15. 16. t 17. o 18. 19. g 20. e 21. n 22. e 23. r 24. a 25. t 26. e 27. 28. n 29. e 30. w 31. 32. U 33. U 34. I 35. D 36. ( 37. s 38. ) 39. , 40. 41. o 42. r 43. 44. p 45. a 46. s 47. t 48. e 49. 50. o 51. n 52. e 53. 54. t 55. o 56. 57. v 58. a 59. l 60. i 61. d 62. a 63. t 64. e 65. 66. 2 67. . 68. 69. S 70. e 71. t 72. 73. c 74. o 75. u 76. n 77. t 78. 79. t 80. o 81. 82. g 83. e 84. n 85. e 86. r 87. a 88. t 89. e 90. 91. m 92. u 93. l 94. t 95. i 96. p 97. l 98. e 99. 100. U 101. U 102. I 103. D 104. s 105. 106. a 107. t 108. 109. o 110. n 111. c 112. e 113. 114. 3 115. . 116. 117. V 118. i 119. e 120. w 121. 122. f 123. o 124. r 125. m 126. a 127. t 128. 129. v 130. a 131. r 132. i 133. a 134. t 135. i 136. o 137. n 138. s 139. 140. ( 141. s 142. t 143. a 144. n 145. d 146. a 147. r 148. d 149. , 150. 151. n 152. o 153. - 154. d 155. a 156. s 157. h 158. e 159. s 160. , 161. 162. u 163. p 164. p 165. e 166. r 167. c 168. a 169. s 170. e 171. , 172. 173. U 174. R 175. N 176. ) 177. 178. 4 179. . 180. 181. C 182. o 183. p 184. y 185. 186. a 187. n 188. y 189. 190. f 191. o 192. r 193. m 194. a 195. t ### TOTP Configurator Configure Time-Based One-Time Password (TOTP) parameters and generate otpauth:// URIs for authenticator apps. Calculate token windows and validate settings. - URL: https://peasysafe.com/safe/totp-configurator/ - Category: Privacy & Security - Processing: client ### SSL Certificate Decoder Decode and analyze PEM-encoded SSL/TLS certificates. View subject, issuer, validity period, key details, extensions, and certificate chain information. - URL: https://peasysafe.com/safe/ssl-certificate-decoder/ - Category: Privacy & Security - Processing: client ## Guides (61) ### How to Check if Your Password Has Been Compromised Data breaches expose millions of passwords regularly. Learn how to check whether your credentials have been leaked without risking further exposure, using k-anonymity-based services and local hash comparison. - URL: https://peasysafe.com/guides/check-password-compromised/ - Category: How-To - Reading time: 1 min - Words: 243 Key takeaways: - As of 2025, over 12 billion account credentials have been exposed in data breaches. - The safest way to check a password uses k-anonymity: your password is hashed locally, and only the first 5 characters of the hash are sent to the server. - Use at least 12 characters (16+ for important accounts). - Passwords alone are increasingly insufficient. - ## Password Strength Tips - Use at least 12 characters (16+ for important accounts). ## The Breach Landscape As of 2025, over 12 billion account credentials have been exposed in data breaches. Many people reuse passwords across sites, meaning a single breach can compromise multiple accounts. ## Safe Checking Methods ### K-Anonymity (Have I Been Pwned) The safest way to check a password uses k-anonymity: your password is hashed locally, and only the first 5 characters of the hash are sent to the server. The server returns all matching hashes, and your device checks for a match locally. Your full password never leaves your device. ### Local Hash Comparison Download the hash database and check locally. This provides maximum privacy as no data leaves your machine, but requires downloading a multi-gigabyte file. ## What to Do If Your Password Is Compromised 1. **Change the password immediately** on the affected service. 2. **Change it everywhere** you used the same password. 3. **Enable two-factor authentication** on the account. 4. **Use a password manager** to generate unique passwords going forward. 5. **Check for unauthorized activity** on the affected account. ## Password Strength Tips - Use at least 12 characters (16+ for important accounts). - Avoid dictionary words, names, dates, and keyboard patterns. - Use a passphrase: random words strung together (e.g., "correct horse battery staple"). - Never reuse passwords across services. - Use a password manager to handle complexity. ## Beyond Passwords Passwords alone are increasingly insufficient. Enable multi-factor authentication (MFA) using authenticator apps or hardware security keys wherever possible. ### How to Generate Strong Random Passwords Password generation requires cryptographic randomness and careful character selection. This guide covers the principles behind strong password generation, entropy calculation, and common generation mistakes to avoid. - URL: https://peasysafe.com/guides/generate-strong-random-passwords/ - Category: How-To - Reading time: 1 min - Words: 224 Key takeaways: - Password strength is measured in entropy — the number of bits of randomness. - Entropy = log2(character_set_size ^ password_length) - Never use `Math.random()` or similar pseudo-random functions for password generation. - Random word passphrases (like "correct horse battery staple") offer high entropy while being memorizable. - Using common substitutions (p@ssw0rd) — these are in every cracking dictionary. ## What Makes a Password Strong? Password strength is measured in entropy — the number of bits of randomness. Higher entropy means more possible combinations, making brute-force attacks impractical. ## Entropy Calculation Entropy = log2(character_set_size ^ password_length) | Character Set | Pool Size | 12-char Entropy | 16-char Entropy | |--------------|-----------|-----------------|----------------| | Lowercase only | 26 | 56 bits | 75 bits | | Mixed case | 52 | 68 bits | 91 bits | | Mixed + digits | 62 | 71 bits | 95 bits | | Mixed + digits + symbols | 95 | 79 bits | 105 bits | A password with 80+ bits of entropy is considered strong for most purposes. ## Cryptographic Randomness Never use `Math.random()` or similar pseudo-random functions for password generation. These are predictable. Use cryptographically secure random number generators (CSPRNG): - JavaScript: `crypto.getRandomValues()` - Python: `secrets` module - Node.js: `crypto.randomBytes()` ## Passphrase Alternative Random word passphrases (like "correct horse battery staple") offer high entropy while being memorizable. A 4-word passphrase from a 7776-word list (Diceware) provides 51 bits of entropy; 6 words provides 77 bits. ## Common Mistakes - Using common substitutions (p@ssw0rd) — these are in every cracking dictionary. - Truncating generated passwords to meet site limits (reduces entropy). - Generating passwords that don't meet the site's character requirements. - Using non-cryptographic random sources. ### Password Strength Analysis: How Strong Is Your Password Really? Learn the science behind password strength meters and entropy calculations. Understand what makes a password truly secure, how attackers crack weak passwords, and practical strategies for creating memorable yet unbreakable credentials. - URL: https://peasysafe.com/guides/password-strength-analysis-guide/ - Category: How-To - Reading time: 1 min - Words: 287 Key takeaways: - Password strength is measured in bits of entropy — the mathematical randomness that determines how long a brute-force attack would take. - Attackers rarely rely on pure brute force. - The most effective approach combines length with randomness. - Most online strength meters check only basic criteria — length, character variety, and common patterns. - A four-word passphrase like `correct-horse-battery-staple` provides roughly 44 bits of entropy from a standard dictionary — adequate for low-value accounts but insufficient for critical ones. ## Understanding Password Entropy Password strength is measured in bits of entropy — the mathematical randomness that determines how long a brute-force attack would take. A password with 40 bits of entropy can be cracked in hours, while 80+ bits would take centuries with current hardware. Entropy depends on both the character set and the password length. | Character Set | Pool Size | Entropy/Char | | --- | --- | --- | | Lowercase only | 26 | 4.7 bits | | Mixed case | 52 | 5.7 bits | | Mixed + digits | 62 | 5.9 bits | | All printable ASCII | 95 | 6.6 bits | ## Common Attack Methods Attackers rarely rely on pure brute force. Dictionary attacks test common words and phrases first. Rule-based attacks apply transformations like appending numbers or substituting letters (e.g., `p@ssw0rd`). Rainbow table attacks use precomputed hashes for known passwords. Modern GPUs can test billions of hashes per second against weak algorithms like MD5. ## Building Strong Passwords The most effective approach combines length with randomness. A four-word passphrase like `correct-horse-battery-staple` provides roughly 44 bits of entropy from a standard dictionary — adequate for low-value accounts but insufficient for critical ones. Adding mixed case, symbols, and a fifth word pushes entropy above 80 bits. Password managers eliminate the need to memorize complex strings entirely. ## What Password Meters Miss Most online strength meters check only basic criteria — length, character variety, and common patterns. They cannot detect whether your password appears in leaked databases or matches personal information an attacker might know. Use the Peasy password strength analyzer for entropy-based scoring that goes beyond simple rule checks, and always verify your password against known breach databases. ### Two-Factor Authentication Methods Compared: TOTP, SMS, and Hardware Keys Compare the security, convenience, and cost of major 2FA methods including authenticator apps, SMS codes, hardware security keys, and biometrics. Find the right balance between protection and usability for your accounts. - URL: https://peasysafe.com/guides/two-factor-authentication-methods-compared/ - Category: Comparison - Reading time: 1 min - Words: 289 Key takeaways: - Over 80% of data breaches involve compromised credentials. - SMS-based 2FA is the most widely supported method but also the weakest. - Time-based One-Time Password apps like Google Authenticator and Authy generate six-digit codes that rotate every 30 seconds. - FIDO2/WebAuthn hardware keys like YubiKey provide the strongest protection available. - The shared secret never leaves your device after initial setup, eliminating network interception risks. ## Why Passwords Alone Fail Over 80% of data breaches involve compromised credentials. Two-factor authentication adds a second verification layer that remains effective even when passwords are stolen. However, not all 2FA methods provide equal protection — the differences matter significantly for security-conscious users. ## Comparison of 2FA Methods | Method | Security | Convenience | Cost | Phishing Resistance | | --- | --- | --- | --- | --- | | SMS codes | Low | High | Free | None | | TOTP apps | Medium | Medium | Free | Low | | Push notifications | Medium | High | Free | Low | | Hardware keys (FIDO2) | Very high | Medium | $25-70 | Full | | Passkeys | High | High | Free | Full | ## SMS: Convenient but Vulnerable SMS-based 2FA is the most widely supported method but also the weakest. SIM-swap attacks allow criminals to port your phone number to their device. SS7 protocol vulnerabilities enable interception of text messages in transit. Despite these risks, SMS 2FA is still dramatically better than no second factor at all. ## TOTP Authenticator Apps Time-based One-Time Password apps like Google Authenticator and Authy generate six-digit codes that rotate every 30 seconds. The shared secret never leaves your device after initial setup, eliminating network interception risks. However, TOTP codes can still be captured by sophisticated phishing sites that relay them in real time. ## Hardware Security Keys FIDO2/WebAuthn hardware keys like YubiKey provide the strongest protection available. They use public-key cryptography bound to the specific website origin, making phishing mathematically impossible. The key signs a challenge that includes the site URL — a fake site produces a different challenge that the key rejects. ### Encryption Algorithms Compared: AES, ChaCha20, and RSA Explained Understand the differences between symmetric and asymmetric encryption, when to use AES-256 vs ChaCha20-Poly1305, and how RSA fits into modern cryptographic systems. A practical guide for non-cryptographers making security decisions. - URL: https://peasysafe.com/guides/encryption-algorithms-compared-aes-chacha20-rsa/ - Category: Comparison - Reading time: 1 min - Words: 294 Key takeaways: - Symmetric encryption uses the same key for encryption and decryption — fast but requires secure key exchange. - The Advanced Encryption Standard with 256-bit keys is the most widely deployed symmetric cipher. - Designed by Daniel Bernstein, ChaCha20 is a stream cipher paired with the Poly1305 authenticator. - RSA remains widely used for digital signatures and key exchange, though newer elliptic curve algorithms (ECDH, Ed25519) provide equivalent security with smaller keys. ## Symmetric vs Asymmetric Encryption Symmetric encryption uses the same key for encryption and decryption — fast but requires secure key exchange. Asymmetric encryption uses a public/private key pair — slower but solves the key distribution problem. Modern systems combine both: asymmetric encryption exchanges a symmetric session key, then symmetric encryption handles the bulk data transfer. ## AES-256: The Industry Standard The Advanced Encryption Standard with 256-bit keys is the most widely deployed symmetric cipher. It operates on 128-bit blocks and uses 14 rounds of substitution and permutation. AES-GCM mode provides both encryption and authentication in a single operation. Hardware acceleration (AES-NI instructions) makes it extremely fast on modern processors — often exceeding 10 GB/s. ## ChaCha20-Poly1305: The Mobile-Friendly Alternative Designed by Daniel Bernstein, ChaCha20 is a stream cipher paired with the Poly1305 authenticator. It performs exceptionally well on devices without AES hardware acceleration — particularly older smartphones and IoT devices. ChaCha20 is also resistant to timing attacks by design, whereas some AES implementations require careful countermeasures. | Feature | AES-256-GCM | ChaCha20-Poly1305 | | --- | --- | --- | | Type | Block cipher | Stream cipher | | Key size | 256 bits | 256 bits | | Speed (hardware) | Very fast | Fast | | Speed (software) | Medium | Very fast | | Nonce size | 96 bits | 96 bits | ## RSA and Modern Key Exchange RSA remains widely used for digital signatures and key exchange, though newer elliptic curve algorithms (ECDH, Ed25519) provide equivalent security with smaller keys. A 256-bit elliptic curve key offers comparable strength to a 3072-bit RSA key. For file encryption tools, the choice of symmetric cipher matters most — use AES-GCM when hardware acceleration is available, or ChaCha20-Poly1305 for universal compatibility. ### Password Strength and Generation: A Security Guide Weak passwords remain the leading cause of account breaches. This guide covers password entropy calculation, generation strategies, and storage best practices. - URL: https://peasysafe.com/guides/password-strength-generation-guide/ - Category: Best Practice - Reading time: 1 min - Words: 274 Key takeaways: - Password strength is measured in bits of entropy — the number of possible combinations. - Four to six randomly selected words from a large dictionary. - Use a password manager (1Password, Bitwarden) - Use personal information (birthdays, names) - Use a cryptographically secure random number generator (CSPRNG), never `Math. ## What Makes a Password Strong Password strength is measured in bits of entropy — the number of possible combinations. Higher entropy means more guesses required to crack it. `Entropy = log2(characters ^ length)` | Password Type | Characters | Length | Entropy | |--------------|-----------|--------|--------| | 4-digit PIN | 10 | 4 | 13.3 bits | | Lowercase only | 26 | 8 | 37.6 bits | | Mixed case + numbers | 62 | 8 | 47.6 bits | | Full ASCII printable | 95 | 12 | 78.8 bits | | Passphrase (4 words) | ~7,776 | 4 words | ~51.7 bits | ## Generation Strategies ### Random Character Strings Maximum entropy per character. Use a cryptographically secure random number generator (CSPRNG), never `Math.random()` or Python's `random` module. Use `secrets` (Python) or `crypto.getRandomValues()` (JavaScript). ### Passphrase (Diceware) Four to six randomly selected words from a large dictionary. Easier to remember, similar entropy to a 10-12 character random string. Example: `correct-horse-battery-staple` (classic XKCD reference, 44 bits with 4 common words — use a 7,776-word list for better entropy). ### Pronounceable Passwords Alternating consonant-vowel patterns create memorable strings: `bapido-kumefa-niratu`. Lower entropy than pure random but more memorable. ## Storage Best Practices - Use a password manager (1Password, Bitwarden) - Generate unique passwords for every site - Minimum 16 characters for important accounts - Enable two-factor authentication (TOTP or hardware key) wherever available ## What NOT to Do - Reuse passwords across sites - Use personal information (birthdays, names) - Apply predictable substitutions (@ for a, 3 for e) — attackers know these patterns - Rely on complexity rules (uppercase + symbol) instead of length ### Environment Variable Management: Security and Best Practices Environment variables separate configuration from code, keeping secrets out of version control. Mismanaging them leads to leaked API keys, broken deployments, and configuration drift between environments. - URL: https://peasysafe.com/guides/environment-variable-management-guide/ - Category: Best Practice - Reading time: 2 min - Words: 361 Key takeaways: - Hardcoding configuration values — database URLs, API keys, feature flags — into source code creates three problems: secrets end up in version control (and Git history forever), the same code can't run in different environments without modification, and configuration changes require code deployments. - `.env` files store key-value pairs loaded at application startup: - Maintain separate configurations for each environment: - For small teams, 1Password or similar tools can store and sync `.env` files. - Using different variable names across environments (DB_HOST vs DATABASE_HOST) causes confusion. ## Why Environment Variables Exist Hardcoding configuration values — database URLs, API keys, feature flags — into source code creates three problems: secrets end up in version control (and Git history forever), the same code can't run in different environments without modification, and configuration changes require code deployments. Environment variables solve all three by storing configuration outside the codebase, injected at runtime. ## The .env File Pattern ### Structure `.env` files store key-value pairs loaded at application startup: ```bash DATABASE_URL=postgres://user:pass@host:5432/dbname DJANGO_SECRET_KEY=a-long-random-string-here STRIPE_API_KEY=sk_live_... DEBUG=false ALLOWED_HOSTS=example.com,www.example.com ``` ### Critical Rule: Never Commit .env Files Add `.env` and `.env.prod` to `.gitignore` immediately when starting a project. If a secret is committed even once, it exists in Git history forever — even after deleting the file. Leaked secrets should be rotated immediately, not just removed from the repository. ### .env.example Maintain a `.env.example` file (committed to Git) that lists all required variables with placeholder values. This documents what configuration a new developer needs without exposing actual secrets: ```bash DATABASE_URL=postgres://user:password@localhost:5432/myapp DJANGO_SECRET_KEY=change-me-to-a-random-string STRIPE_API_KEY=sk_test_... ``` ## Environment Separation ### Per-Environment Configuration Maintain separate configurations for each environment: | Variable | Development | Staging | Production | |----------|------------|---------|------------| | DEBUG | true | false | false | | DATABASE_URL | localhost | staging-rds | production-rds | | LOG_LEVEL | DEBUG | INFO | WARNING | | API keys | Test keys | Test keys | Live keys | Never use production secrets in development. Most third-party services provide separate test/sandbox keys for this reason. ## Secret Management at Scale ### Password Managers For small teams, 1Password or similar tools can store and sync `.env` files. A `sync-secrets` command pulls the latest values from the password manager and writes them to the local `.env` file. ### Cloud Secret Managers For larger deployments, use AWS Secrets Manager, Google Secret Manager, … ### Password Managers Compared: Features That Matter A password manager is the single most impactful security tool for most people. This comparison covers the key features to evaluate when choosing a password manager for personal or team use. - URL: https://peasysafe.com/guides/password-managers-compared/ - Category: Comparison - Reading time: 1 min - Words: 254 Key takeaways: - The average person has 100+ online accounts. - The provider should never be able to access your passwords. - Any password manager is better than no password manager. - ### Sharing and Teams For families and businesses, sharing individual passwords or entire vaults securely is important. - ## Key Features to Evaluate ### Zero-Knowledge Architecture The provider should never be able to access your passwords. ## Why Use a Password Manager? The average person has 100+ online accounts. Without a password manager, people resort to reusing passwords or using simple, guessable ones. A password manager generates and stores unique, strong passwords for every site. ## Key Features to Evaluate ### Zero-Knowledge Architecture The provider should never be able to access your passwords. Your master password should encrypt your vault locally before any data reaches the server. ### Cross-Platform Support Your password manager should work on every device and browser you use: Windows, macOS, Linux, iOS, Android, and browser extensions for Chrome, Firefox, and Safari. ### Autofill Quality Good autofill recognizes login forms reliably, fills credentials accurately, and handles multi-step login flows. Poor autofill leads to frustration and users abandoning the tool. ### Sharing and Teams For families and businesses, sharing individual passwords or entire vaults securely is important. Look for fine-grained permissions and audit logs. ## Evaluation Criteria | Feature | Weight | Why It Matters | |---------|--------|---------------| | Zero-knowledge encryption | Critical | Your data stays private | | Browser extension quality | High | Daily usability | | Mobile app quality | High | On-the-go access | | Password generator | Medium | Convenience | | Breach monitoring | Medium | Proactive security | | Emergency access | Medium | Account recovery | | Open-source audit | Nice-to-have | Transparency | ## The Non-Negotiable Any password manager is better than no password manager. Even the simplest option dramatically improves security by enabling unique passwords for every service. ### How to Strip EXIF Metadata From Photos for Privacy Photos contain hidden metadata including GPS coordinates, device info, and timestamps. Before sharing photos online, learn how to remove this data to protect your privacy and prevent location tracking. - URL: https://peasysafe.com/guides/strip-exif-metadata-privacy/ - Category: How-To - Reading time: 1 min - Words: 234 Key takeaways: - EXIF (Exchangeable Image File Format) metadata is automatically embedded in photos by cameras and smartphones. - Browser-based EXIF strippers process your photos locally without uploading them. - Disable GPS tagging in your phone's camera settings. - Your images never leave your device, which is the safest approach. ## What Is EXIF Data? EXIF (Exchangeable Image File Format) metadata is automatically embedded in photos by cameras and smartphones. This data includes technical shooting parameters and often sensitive personal information. ## Types of Hidden Data | Data Type | Privacy Risk | Example | |-----------|-------------|--------| | GPS coordinates | High | Home address, workplace | | Date/time | Medium | Travel patterns, daily routine | | Device model | Low | Phone model, camera type | | Serial number | Medium | Unique device identifier | | Thumbnail | Medium | Pre-edit version of cropped photo | | Software | Low | Editing tools used | ## How to Remove EXIF Data ### Client-Side Tools Browser-based EXIF strippers process your photos locally without uploading them. Your images never leave your device, which is the safest approach. ### Selective Removal Sometimes you want to keep some metadata (like the date for organization) while removing sensitive fields (like GPS). Selective removal lets you choose which fields to strip. ### Before Sharing Online Some social media platforms strip EXIF data automatically (Instagram, Twitter), but many don't (forums, email, direct sharing). When in doubt, strip metadata before sharing. ## Prevention - Disable GPS tagging in your phone's camera settings. - Review sharing settings in your photo apps. - Use share sheets that strip metadata by default. - Be especially careful with photos of children or your home. ### How to Create QR Codes for Wi-Fi Networks Wi-Fi QR codes let guests connect to your network instantly by scanning with their phone camera. This guide covers the Wi-Fi QR format, security considerations, and best placement practices. - URL: https://peasysafe.com/guides/create-wifi-qr-codes/ - Category: How-To - Reading time: 1 min - Words: 211 Key takeaways: - Wi-Fi QR codes use a specific text format that phones recognize and auto-connect: - Create a separate guest network for QR code sharing. - Hotels: Room cards or welcome packets. - iOS**: Built-in Camera app (iOS 11+). - ## Placement Best Practices - Hotels: Room cards or welcome packets. ## Wi-Fi QR Code Format Wi-Fi QR codes use a specific text format that phones recognize and auto-connect: `WIFI:T:WPA;S:NetworkName;P:Password;;` ### Format Parameters - **T**: Authentication type (WPA, WEP, or nopass for open networks). - **S**: Network SSID (name). Use `\` to escape `;`, `,`, `"`, and `\`. - **P**: Password. Same escaping rules apply. - **H**: Hidden network (true/false). Optional. ## Security Considerations ### Guest Networks Create a separate guest network for QR code sharing. This isolates guest devices from your main network, protecting your devices and data. ### Password Rotation When you change your Wi-Fi password, the QR code becomes invalid. Print QR codes that are easy to replace, or use a redirect URL that you can update. ### Physical Security Anyone who can see (or photograph) the QR code gets network access. Place Wi-Fi QR codes where they're visible to authorized guests but not from outside your premises. ## Placement Best Practices - Hotels: Room cards or welcome packets. - Restaurants: Table tents or menus. - Offices: Meeting room displays. - Homes: Near the router or on the fridge. ## Device Compatibility - **iOS**: Built-in Camera app (iOS 11+). - **Android**: Built-in Camera app (Android 10+), or Google Lens. - **Older devices**: May need a third-party QR scanner app. ### Encryption Best Practices for Personal Data Encryption protects your data from unauthorized access, whether stored on your devices or transmitted over the internet. This guide covers practical encryption strategies for personal data protection. - URL: https://peasysafe.com/guides/encryption-best-practices-personal/ - Category: Best Practice - Reading time: 1 min - Words: 224 Key takeaways: - Encryption transforms readable data (plaintext) into unreadable data (ciphertext) using a mathematical algorithm and a key. - Protects data stored on disks, drives, and cloud storage: - Enable full-disk encryption on all your devices. - Encryption is only as strong as your key management: - ### Backup Encryption Encrypted backups are critical. ## Encryption Basics Encryption transforms readable data (plaintext) into unreadable data (ciphertext) using a mathematical algorithm and a key. Only someone with the correct key can decrypt and read the original data. ## Types of Encryption ### At Rest (Stored Data) Protects data stored on disks, drives, and cloud storage: - **Full-disk encryption**: FileVault (macOS), BitLocker (Windows), LUKS (Linux). - **File-level encryption**: Encrypt individual files or folders. - **Cloud storage**: End-to-end encrypted cloud services. ### In Transit (Network Data) Protects data moving across networks: - **HTTPS/TLS**: Web traffic encryption (look for the padlock icon). - **VPN**: Encrypts all traffic between your device and the VPN server. - **End-to-end messaging**: Signal, WhatsApp (messages encrypted between devices). ## Practical Recommendations ### Device Encryption Enable full-disk encryption on all your devices. Modern CPUs have hardware acceleration for AES encryption, so the performance impact is negligible. ### Backup Encryption Encrypted backups are critical. An unencrypted backup of an encrypted drive defeats the purpose of encryption. ### Email Encryption Standard email is sent in plaintext. For sensitive communications, use end-to-end encrypted email services or PGP/GPG encryption. ## Key Management Encryption is only as strong as your key management: - Store recovery keys in a password manager. - Don't store keys alongside the encrypted data. - Use separate keys for different purposes. - Have a recovery plan for lost keys. ### Troubleshooting Random Number Generation Issues Incorrect random number generation causes security vulnerabilities, biased results, and non-reproducible tests. This guide covers common RNG pitfalls and how to verify your random numbers are truly random. - URL: https://peasysafe.com/guides/troubleshooting-random-number-generation/ - Category: Troubleshooting - Reading time: 1 min - Words: 228 Key takeaways: - Understanding the difference between PRNG and CSPRNG is critical for choosing the right tool for each use case. - Using `random() % n` to generate numbers in a range introduces bias when the random source's range isn't evenly divisible by n. - Histogram test**: Generate many numbers and verify uniform distribution. - ## Types of Random Number Generators Understanding the difference between PRNG and CSPRNG is critical for choosing the right tool for each use case. ## Types of Random Number Generators Understanding the difference between PRNG and CSPRNG is critical for choosing the right tool for each use case. ### PRNG (Pseudo-Random Number Generator) Deterministic algorithms that produce sequences that appear random. Given the same seed, they produce the same sequence. Examples: Mersenne Twister, xoshiro256. ### CSPRNG (Cryptographically Secure PRNG) PRNGs that are safe for security applications. Their output is indistinguishable from true randomness. Examples: /dev/urandom, crypto.getRandomValues(). ## Common Issues ### Modulo Bias Using `random() % n` to generate numbers in a range introduces bias when the random source's range isn't evenly divisible by n. For example, `random_byte() % 100` slightly favors values 0-55. **Fix:** Use rejection sampling — discard values that would cause bias. ### Seed Predictability Seeding a PRNG with the current timestamp makes the output predictable to anyone who knows approximately when the generator was initialized. **Fix:** Use OS-provided entropy sources for seeds, or use CSPRNGs. ### Insufficient Entropy Systems with low entropy (embedded devices, early boot) may produce predictable random numbers. **Fix:** Wait for entropy pool to fill, use hardware RNG if available. ## Testing Randomness - **Histogram test**: Generate many numbers and verify uniform distribution. - **Chi-squared test**: Statistical test for deviation from expected distribution. - **Sequence correlation**: Check that consecutive values aren't correlated. - **Bit pattern analysis**: Verify all bit positions have approximately equal 0s and 1s. ### Two-Factor Authentication Methods: TOTP, WebAuthn, and SMS Two-factor authentication (2FA) adds a critical layer of security beyond passwords. This guide compares TOTP apps, hardware security keys, SMS codes, and passkeys to help you choose the strongest protection. - URL: https://peasysafe.com/guides/two-factor-authentication-methods/ - Category: Comparison - Reading time: 1 min - Words: 235 Key takeaways: - Passwords alone are insufficient. - A one-time code sent via text message. - Use passkeys or hardware keys for critical accounts (email, banking, cloud). ## Why 2FA Matters Passwords alone are insufficient. Even strong, unique passwords can be compromised through phishing, server breaches, or malware. 2FA ensures that a stolen password alone isn't enough to access your account. ## Authentication Methods ### SMS Codes A one-time code sent via text message. While better than no 2FA, SMS is the weakest method due to SIM-swapping attacks and SS7 vulnerabilities. **Security:** Low | **Convenience:** High ### TOTP (Authenticator Apps) Time-based One-Time Passwords generated by apps like Google Authenticator, Authy, or 1Password. Codes rotate every 30 seconds and work offline. **Security:** Good | **Convenience:** Medium ### Hardware Security Keys (WebAuthn/FIDO2) Physical devices (YubiKey, Google Titan) that use public-key cryptography. They're phishing-resistant because the key verifies the website's identity. **Security:** Excellent | **Convenience:** Medium ### Passkeys The newest standard, combining the security of hardware keys with the convenience of biometrics. Passkeys are stored in your device's secure enclave and synced across your ecosystem. **Security:** Excellent | **Convenience:** High ## Comparison | Method | Phishing Resistant | Offline | Recovery | |--------|-------------------|---------|----------| | SMS | No | No | Easy | | TOTP | No | Yes | Medium | | Hardware Key | Yes | Yes | Difficult | | Passkey | Yes | Yes | Easy (cloud sync) | ## Recommendation Use passkeys or hardware keys for critical accounts (email, banking, cloud). Use TOTP for everything else. Avoid SMS-only 2FA when possible. ### Hash Functions Compared: MD5, SHA-1, SHA-256, and Beyond Hash functions are used for file integrity, password storage, and digital signatures. This comparison covers the most common algorithms, their security status, and when to use each one in modern applications. - URL: https://peasysafe.com/guides/hash-functions-compared/ - Category: Comparison - Reading time: 1 min - Words: 245 Key takeaways: - A cryptographic hash function takes input of any size and produces a fixed-size output (the hash or digest). - MD5 was widely used in the 1990s-2000s but is now cryptographically broken. - SHA-1 was broken in 2017 by Google's SHAttered attack. - SHA-256 (part of the SHA-2 family) is the most widely recommended hash function for security applications. - File checksums (non-security)**: MD5 or CRC32 for speed. ## What Is a Hash Function? A cryptographic hash function takes input of any size and produces a fixed-size output (the hash or digest). Good hash functions are deterministic, fast, and practically impossible to reverse. ## Algorithm Comparison | Algorithm | Output Size | Security Status | Speed | |-----------|------------|----------------|-------| | MD5 | 128 bits | Broken | Very Fast | | SHA-1 | 160 bits | Broken | Fast | | SHA-256 | 256 bits | Secure | Medium | | SHA-3 | 256 bits | Secure | Medium | | BLAKE3 | 256 bits | Secure | Very Fast | ## MD5: Legacy Only MD5 was widely used in the 1990s-2000s but is now cryptographically broken. Collision attacks can be performed in seconds on modern hardware. Use MD5 only for non-security purposes like file deduplication or cache keys. ## SHA-1: Deprecated SHA-1 was broken in 2017 by Google's SHAttered attack. Git still uses SHA-1 for commit hashes but is migrating to SHA-256. Browsers no longer accept SHA-1 for TLS certificates. ## SHA-256: The Current Standard SHA-256 (part of the SHA-2 family) is the most widely recommended hash function for security applications. It's used in TLS certificates, Bitcoin, file integrity verification, and most modern protocols. ## When to Use Each - **File checksums (non-security)**: MD5 or CRC32 for speed. - **File integrity verification**: SHA-256. - **Password hashing**: bcrypt, Argon2, or scrypt (not raw SHA-256). - **Digital signatures**: SHA-256 or SHA-3. - **High-performance hashing**: BLAKE3. ### How to Check If Your Email Has Been Breached Data breaches expose billions of email addresses and passwords. Learn how to check if your accounts are compromised and what to do about it. - URL: https://peasysafe.com/guides/how-to-check-email-breach/ - Category: How-To - Reading time: 1 min - Words: 184 Key takeaways: - As of 2025, over 12 billion accounts have been exposed in data breaches. - Breach-checking services compare your email against known breach databases. - The safest breach checkers never send your full email to a server. - Use unique passwords for every account (password manager essential). - ## Prevention Use unique passwords for every account (password manager essential). ## The Scale of Data Breaches As of 2025, over 12 billion accounts have been exposed in data breaches. Major breaches at LinkedIn, Adobe, Yahoo, and others mean most email addresses appear in at least one breach database. ## How to Check Breach-checking services compare your email against known breach databases. They tell you which breaches included your email and what data was exposed (password, phone number, address, etc.). ## Client-Side Checking The safest breach checkers never send your full email to a server. Instead, they hash your email locally and send only a partial hash (k-anonymity model). The server returns all matching hashes, and the client checks for an exact match. ## What to Do After a Breach 1. Change passwords on the breached service immediately. 2. Change the same password on any other site where you reused it. 3. Enable two-factor authentication. 4. Monitor for suspicious account activity. 5. Consider a credit freeze if financial data was exposed. ## Prevention Use unique passwords for every account (password manager essential). Enable 2FA everywhere possible. Use email aliases for sign-ups to limit exposure scope. ### How to Generate Secure Passphrases Passphrases are easier to remember than random passwords while being equally secure. Learn how to generate strong, memorable passphrases. - URL: https://peasysafe.com/guides/how-to-generate-secure-passphrases/ - Category: How-To - Reading time: 1 min - Words: 185 Key takeaways: - A password like `X#9kL!2m` is hard to remember. - Diceware uses physical dice to select words from a list of 7,776 words. - Using separators (hyphens, spaces, dots) between words adds minimal entropy but greatly improves readability. - Don't choose words yourself — human choices are predictable. ## Passwords vs Passphrases A password like `X#9kL!2m` is hard to remember. A passphrase like `correct-horse-battery-staple` is easy to remember and actually harder to crack due to its length. Entropy depends on length and randomness, not complexity. ## Diceware Method Diceware uses physical dice to select words from a list of 7,776 words. Each word adds ~12.9 bits of entropy. A 6-word passphrase has ~77 bits of entropy — comparable to a random 12-character password. ## Recommended Length | Words | Entropy | Crack Time (1T guesses/sec) | |-------|---------|---------------------------| | 4 | ~51 bits | Days | | 5 | ~64 bits | Years | | 6 | ~77 bits | Centuries | | 7 | ~90 bits | Heat death of universe | ## Word Separator Using separators (hyphens, spaces, dots) between words adds minimal entropy but greatly improves readability. Some systems require special characters — adding one number and one symbol to a passphrase satisfies complexity requirements. ## Avoiding Patterns Don't choose words yourself — human choices are predictable. Use a cryptographically secure random generator. Avoid song lyrics, book quotes, and common phrases. ### VPN vs Tor vs Proxy: Privacy Tools Compared VPNs, Tor, and proxies all hide your IP address but differ in security, speed, and privacy guarantees. Compare them for your threat model. - URL: https://peasysafe.com/guides/vpn-vs-tor-vs-proxy-comparison/ - Category: Comparison - Reading time: 1 min - Words: 197 Key takeaways: - A VPN encrypts all traffic between your device and a VPN server, hiding your IP from websites. - Tor routes traffic through three random relays, encrypting at each hop. - A proxy forwards requests from your browser through an intermediary server. - For general privacy (ISP snooping, public Wi-Fi): VPN. ## VPN (Virtual Private Network) A VPN encrypts all traffic between your device and a VPN server, hiding your IP from websites. The VPN provider can see your traffic (choose a no-log provider). Speed impact is minimal (10-20% reduction). ## Tor (The Onion Router) Tor routes traffic through three random relays, encrypting at each hop. No single relay knows both the source and destination. Speed is slow (3-10x slower) but privacy is strong even against well-funded adversaries. ## Proxy Server A proxy forwards requests from your browser through an intermediary server. HTTP proxies don't encrypt traffic. SOCKS5 proxies handle any protocol but still lack encryption unless combined with TLS. ## Comparison | Feature | VPN | Tor | Proxy | |---------|-----|-----|-------| | Encryption | Full | Multi-layer | None/Optional | | Speed | Fast | Slow | Fast | | All traffic | Yes | Browser only | Browser only | | Anonymity | Provider trusts | Strong | Weak | | Cost | $3-12/mo | Free | Free/Paid | ## Choosing Based on Threat Model For general privacy (ISP snooping, public Wi-Fi): VPN. For anonymity from governments and corporations: Tor. For bypassing geo-restrictions: VPN or proxy. ### QR Code Security and Phishing Prevention Protect against QR code phishing attacks and implement secure QR code practices for businesses and consumers. - URL: https://peasysafe.com/guides/qr-code-security-phishing-prevention/ - Category: Best Practice - Reading time: 1 min - Words: 287 Key takeaways: - QR codes present unique security challenges because users cannot visually inspect the encoded content before scanning. - ### For Businesses Creating QR Codes Always use your own domain rather than URL shorteners — users should see your brand in the URL preview. - ### For Users Scanning QR Codes Modern smartphone cameras show a URL preview before opening — always read this preview. - Never scan QR codes from unsolicited emails or messages. ## QR Code Security QR codes present unique security challenges because users cannot visually inspect the encoded content before scanning. This makes them a vector for phishing, malware distribution, and financial fraud. ### Common Attack Vectors Quishing (QR phishing) involves placing malicious QR codes over legitimate ones — a sticker on a parking meter redirecting to a fake payment site, for example. Attackers also distribute QR codes via email, printed flyers, and social media that link to credential-harvesting pages. Since shortened URLs hide the destination, users have no way to verify the link before scanning. ### For Businesses Creating QR Codes Always use your own domain rather than URL shorteners — users should see your brand in the URL preview. Register all variations of your domain to prevent typosquatting. Use HTTPS exclusively. Include your brand logo in the QR code to make unauthorized replacements more obvious. Monitor your QR code destinations with analytics to detect if a physical code has been replaced with a sticker. ### For Users Scanning QR Codes Modern smartphone cameras show a URL preview before opening — always read this preview. Look for suspicious domain names, HTTP (not HTTPS), or unfamiliar URL shorteners. If a QR code is on a sticker placed over another code, it's likely malicious. Never scan QR codes from unsolicited emails or messages. Be especially cautious with QR codes that request payment or login credentials. ### Dynamic QR Code Security Dynamic QR codes redirect through a service that can change the destination URL. While convenient for marketing, this means the QR code creator can change where it points at any time. Only use dynamic QR codes from trusted services, and prefer static codes for security-sensitive applications like payment links. ### Data Privacy Best Practices for Online Tools Using online tools means trusting them with your data. Learn how to evaluate tool privacy and protect sensitive information. - URL: https://peasysafe.com/guides/data-privacy-best-practices-online-tools/ - Category: Best Practice - Reading time: 1 min - Words: 185 Key takeaways: - The most important privacy distinction is where processing happens. - Open browser DevTools (Network tab) before using a tool. - Files contain metadata you might not realize: document author names, GPS coordinates in photos, edit history in Office documents, and machine identifiers in PDFs. - Before using any online tool with sensitive data: - Some tasks (OCR, AI processing) require server resources. ## Client-Side vs Server-Side Processing The most important privacy distinction is where processing happens. Client-side tools process data entirely in your browser — files never leave your device. Server-side tools upload your data for processing, creating privacy risks. ## How to Verify Client-Side Processing Open browser DevTools (Network tab) before using a tool. If no file uploads appear during processing, the tool is genuinely client-side. Look for large POST requests that would indicate file uploads. ## Metadata Awareness Files contain metadata you might not realize: document author names, GPS coordinates in photos, edit history in Office documents, and machine identifiers in PDFs. Strip metadata before sharing sensitive files. ## The Privacy Tool Checklist Before using any online tool with sensitive data: 1. Is processing client-side (browser-only)? 2. Does the privacy policy exist and make clear claims? 3. Is the tool open-source (verifiable claims)? 4. Does it work offline (ultimate privacy test)? ## When Server Processing Is Unavoidable Some tasks (OCR, AI processing) require server resources. In these cases, verify the service encrypts uploads, doesn't store files after processing, and complies with relevant regulations (GDPR, CCPA). ### How to Password-Protect a PDF Learn how to encrypt PDFs with passwords to control who can open, edit, print, or copy content from your documents. - URL: https://peasysafe.com/guides/how-to-password-protect-pdf/ - Category: How-To - Reading time: 1 min - Words: 187 Key takeaways: - PDFs support two types of passwords: an open password (prevents opening the file) and a permissions password (allows opening but restricts actions like printing, copying, or editing). - Modern PDFs use AES-256 encryption, the same standard used by banks and governments. - Beyond the open password, you can restrict specific actions: - Browser-based PDF encryption processes files locally without uploading to servers. - PDF permissions passwords provide only soft protection — they rely on the viewer software to enforce restrictions. ## Types of PDF Passwords PDFs support two types of passwords: an open password (prevents opening the file) and a permissions password (allows opening but restricts actions like printing, copying, or editing). ## Encryption Standards Modern PDFs use AES-256 encryption, the same standard used by banks and governments. Older PDFs may use weaker 128-bit or even 40-bit RC4 encryption, which can be cracked relatively easily. ## Setting Permissions Beyond the open password, you can restrict specific actions: - **Printing**: Prevent or allow printing (some tools offer low-resolution print as a middle ground). - **Copying text**: Block clipboard copying of text content. - **Editing**: Prevent modifications, annotations, or form filling. - **Page extraction**: Block the ability to extract or rearrange pages. ## Client-Side Encryption Browser-based PDF encryption processes files locally without uploading to servers. This is ideal for sensitive documents since the unencrypted file never leaves your device. ## Important Limitations PDF permissions passwords provide only soft protection — they rely on the viewer software to enforce restrictions. Determined users with technical knowledge can sometimes bypass these restrictions. For true security, use the open password with AES-256 encryption. ### How to Audit Your Digital Privacy Settings Review and tighten privacy settings across browsers, social media, mobile devices, and cloud services. - URL: https://peasysafe.com/guides/how-to-audit-digital-privacy-settings/ - Category: How-To - Reading time: 2 min - Words: 312 ## Digital Privacy Audit Your digital footprint grows automatically through default settings that favor data collection over privacy. A periodic privacy audit identifies and closes these gaps. ### Browser Privacy Disable third-party cookies (most browsers now do this by default). Review installed extensions — each one can see your browsing data. Remove extensions you don't actively use. Check auto-fill settings and remove saved credit card numbers and passwords you'd rather manage through a dedicated password manager. Enable DNS-over-HTTPS (DoH) to prevent your ISP from seeing your DNS queries. ### Social Media Settings Each platform has a privacy settings page that controls who sees your posts, whether your profile appears in search engines, and what data is used for ad targeting. Review: profile visibility, post audience defaults, tag review, location sharing, and ad preferences. Download your data archive periodically to see exactly what each platform has collected. Delete old posts that no longer represent you. ### Mobile Device Privacy Review app permissions — many apps request camera, microphone, contacts, and location access without needing them. Revoke unnecessary permissions. On iOS, use App Tracking Transparency to deny cross-app tracking. On Android, use the Privacy Dashboard to see which apps accessed sensitive data recently. Disable Wi-Fi and Bluetooth scanning when not in use — these can be used for location tracking. ### Cloud Service Audit Review sharing settings on Google Drive, Dropbox, and iCloud — old shared links may still be accessible. Check which third-party apps have access to your Google, Microsoft, and Apple accounts (OAuth authorizations). Revoke access for apps you no longer use. Enable two-factor authentication on every cloud service. ### Annual Privacy Checklist Update passwords for critical accounts. Review and revoke unused OAuth authorizations. Check your accounts on haveibeenpwned.com. Review and clean browser auto-fill data. Update recovery email addresses and … ### Secure File Sharing Best Practices Share sensitive files securely using encryption, expiring links, password protection, and access controls. - URL: https://peasysafe.com/guides/secure-file-sharing-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 285 Key takeaways: - Email attachments, public cloud links, and USB drives all present security risks for sensitive documents. - Links that never expire accumulate over time, creating a growing attack surface of accessible documents. - The encryption/decryption happens entirely in the browser — the file never leaves your device in unencrypted form. ## Secure File Sharing Email attachments, public cloud links, and USB drives all present security risks for sensitive documents. Implementing proper file sharing practices protects confidential information without creating workflow friction. ### Encryption Before Sharing Encrypt files before uploading to any cloud service. Password-protected ZIP files use weak encryption — use 7-Zip's AES-256 encryption or GPG for serious security. Share the decryption password through a different channel than the file link. For example, send the file link via email and the password via SMS or a secure messenger. ### Expiring Links Most cloud storage services (Google Drive, Dropbox, OneDrive) support expiring shared links. Set links to expire after the recipient has had time to download — typically 24-72 hours for business documents. Links that never expire accumulate over time, creating a growing attack surface of accessible documents. ### Access Controls Use view-only permissions by default. Only grant edit access when collaboration is required. Require authentication (email-specific access) rather than using "anyone with the link" sharing. Audit shared document access periodically — people leave organizations but their access may persist. ### Client-Side Encryption Tools Browser-based encryption tools process files locally without server uploads. You encrypt a file in your browser, share the encrypted file through any channel, and the recipient decrypts it in their browser using the shared password. The encryption/decryption happens entirely in the browser — the file never leaves your device in unencrypted form. ### Metadata and Redaction Shared documents may contain hidden metadata: author names, revision history, comments, tracked changes, and embedded GPS coordinates in images. Sanitize metadata before sharing sensitive documents. For PDFs, use redaction tools (not just black rectangles over text — that's cosmetic, not secure) to permanently remove sensitive content. ### Cookie Consent and GDPR Compliance for Websites Implement compliant cookie consent banners and data privacy practices for GDPR, CCPA, and global regulations. - URL: https://peasysafe.com/guides/cookie-consent-gdpr-compliance-websites/ - Category: Best Practice - Reading time: 1 min - Words: 277 Key takeaways: - Privacy regulations require informed consent before setting non-essential cookies. - ## Cookie Consent and Privacy Compliance Privacy regulations require informed consent before setting non-essential cookies. - ### What Requires Consent Essential cookies (session management, security, load balancing) don't require consent — they're necessary for the website to function. - ### Implementation Best Practices Load zero non-essential cookies until consent is given. - ### GDPR Requirements (EU/EEA) Consent must be freely given, specific, informed, and unambiguous. ## Cookie Consent and Privacy Compliance Privacy regulations require informed consent before setting non-essential cookies. Getting this wrong risks fines, user distrust, and legal liability. ### What Requires Consent Essential cookies (session management, security, load balancing) don't require consent — they're necessary for the website to function. Analytics cookies (Google Analytics, Hotjar), advertising cookies (Facebook Pixel, Google Ads), and social media cookies all require explicit opt-in consent before being set. Pre-checked consent boxes don't count as valid consent under GDPR. ### GDPR Requirements (EU/EEA) Consent must be freely given, specific, informed, and unambiguous. This means: a clear explanation of what cookies do and why, separate consent for each purpose (analytics, marketing, personalization), equally easy to accept or reject (no dark patterns), and the ability to withdraw consent at any time. Record consent for compliance auditing. ### CCPA Requirements (California) CCPA focuses on the right to opt out of data selling rather than requiring opt-in consent. Display a "Do Not Sell My Personal Information" link. Provide a clear privacy policy describing data collection and sharing practices. Honor Global Privacy Control (GPC) browser signals. ### Implementation Best Practices Load zero non-essential cookies until consent is given. Use a consent management platform (CMP) that stores consent records. Implement server-side consent checking — client-side only is easily bypassed. Set cookie lifetimes appropriately: session cookies expire when the browser closes, persistent cookies should have reasonable expiry dates (not 10 years). ### Cookieless Alternatives Privacy-respecting analytics (Cloudflare Web Analytics, Plausible, Fathom) don't use cookies and don't require consent banners. Server-side analytics using access logs provide basic traffic data without any client-side tracking. These alternatives simplify compliance while still providing useful data for decision-making. ### SHA-256 vs SHA-3 vs BLAKE3: Hash Function Comparison Hash functions are fundamental to security and data integrity. Compare the performance, security, and use cases of modern hash algorithms. - URL: https://peasysafe.com/guides/sha256-vs-sha3-vs-blake3/ - Category: Comparison - Reading time: 1 min - Words: 174 Key takeaways: - A cryptographic hash function converts input of any size into a fixed-size output (digest) that's practically impossible to reverse. - Part of the SHA-2 family, SHA-256 produces a 256-bit (32-byte) hash. - SHA-3 uses a completely different internal structure (Keccak sponge construction) from SHA-2. - BLAKE3 is the newest option, designed for speed. - Use SHA-256 for compatibility and standards compliance. ## What Hash Functions Do A cryptographic hash function converts input of any size into a fixed-size output (digest) that's practically impossible to reverse. Even a single bit change in the input produces a completely different hash. ## SHA-256 Part of the SHA-2 family, SHA-256 produces a 256-bit (32-byte) hash. It's the most widely used hash function, powering Bitcoin mining, TLS certificates, Git commits, and digital signatures. Performance: ~500 MB/s on modern CPUs. ## SHA-3 SHA-3 uses a completely different internal structure (Keccak sponge construction) from SHA-2. It provides a security margin against potential SHA-2 weaknesses. Performance: ~300 MB/s — slower than SHA-256 but considered a stronger design. ## BLAKE3 BLAKE3 is the newest option, designed for speed. It processes data at 5-10 GB/s on modern CPUs using SIMD instructions and supports parallelism. BLAKE3 is ideal for file integrity checking and content-addressed storage. ## Recommendation Use SHA-256 for compatibility and standards compliance. Use BLAKE3 for file hashing and content-addressed storage where speed matters. Use SHA-3 when you need an alternative hash family for defense-in-depth. ### Browser Privacy Settings: A Comprehensive Configuration Guide Modern browsers offer extensive privacy controls that most users never configure. Learn which settings to enable, which extensions to install, and what tradeoffs to expect. - URL: https://peasysafe.com/guides/browser-privacy-settings-comprehensive/ - Category: Best Practice - Reading time: 2 min - Words: 303 ## Default Browser Privacy Out of the box, most browsers prioritize compatibility over privacy. Third-party cookies, tracking scripts, and fingerprinting techniques monitor your browsing across the web. Adjusting privacy settings introduces some website breakage but significantly reduces tracking. ### Essential Settings (All Browsers) Block third-party cookies — this stops cross-site tracking with minimal website breakage. Enable DNS-over-HTTPS to prevent your ISP from seeing your DNS queries. Disable pre-loading pages (reduces tracking but may make browsing feel slightly slower). Send "Do Not Track" requests (mostly symbolic, but some sites honor it). ### Extension Recommendations uBlock Origin is the most effective content blocker — it blocks ads, trackers, and malware domains using filter lists. HTTPS Everywhere forces HTTPS connections where available. Cookie AutoDelete removes cookies when you close a tab, limiting tracking persistence. Avoid installing too many extensions — each one increases your browser fingerprint's uniqueness. ### Browser-Specific Recommendations Firefox: Enable Enhanced Tracking Protection (Strict mode). Turn on DNS-over-HTTPS in settings. Consider enabling resist fingerprinting in about:config. Chrome: Limited built-in privacy controls. Third-party cookie blocking is being phased in. Consider switching to Brave for a Chromium-based alternative with built-in ad blocking. Safari: Intelligent Tracking Prevention is enabled by default. Enable "Prevent cross-site tracking" and "Hide IP address from trackers." ### The Fingerprinting Problem Even without cookies, websites can identify you through browser fingerprinting — your screen resolution, installed fonts, browser plugins, timezone, language settings, and hardware characteristics create a nearly unique profile. Tor Browser is the most effective defense against fingerprinting, but its usability tradeoffs are significant for daily browsing. ### Tradeoffs to Expect Aggressive privacy settings break some websites. CAPTCHAs appear more frequently. Some streaming services detect VPNs and privacy tools. Saved logins may not persist. The key is finding the level of privacy that matches your threat model without making … ### Browser Security Features You Should Know Understand built-in browser security features including sandboxing, HTTPS indicators, and permission controls. - URL: https://peasysafe.com/guides/browser-security-features-you-should-know/ - Category: How-To - Reading time: 2 min - Words: 324 ## Browser Security Features Modern browsers include sophisticated security features that protect users from malicious websites, phishing, and data theft. Understanding these features helps both users and developers. ### HTTPS and Certificate Indicators Browsers prominently indicate whether a connection is encrypted. The padlock icon means the connection uses TLS encryption — data between you and the server is encrypted in transit. It does NOT mean the website is trustworthy or legitimate. Phishing sites can (and do) use HTTPS. Extended Validation (EV) certificates used to show the company name in green, but most browsers have removed this distinction. ### Site Isolation and Sandboxing Each tab runs in a separate process, preventing a malicious page from accessing data from other tabs. JavaScript cannot read cookies or storage from different origins (Same-Origin Policy). This is why cross-site scripting (XSS) is dangerous — it executes malicious code within the trusted origin, bypassing these protections. ### Permission Controls Browsers gate access to sensitive APIs behind user permissions: camera, microphone, location, notifications, clipboard, and screen sharing. Each permission is granted per-origin and can be revoked at any time. Best practice for developers: request permissions only when needed (not on page load), explain why you need them before the browser prompt appears, and gracefully handle denial. ### Safe Browsing Google Safe Browsing (used by Chrome, Firefox, and Safari) maintains a real-time database of malicious URLs. When you navigate to a flagged URL, the browser shows a warning. This catches most known phishing and malware sites, but zero-day threats may not be flagged. The database is queried in a privacy-preserving way — your full browsing history is not sent to Google. ### Password Manager Integration Built-in password managers generate and store unique passwords for each site. They auto-fill on the correct origin only, providing phishing protection — a … ### EXIF Data Privacy: What Your Photos Reveal Understand what metadata your camera stores in photos and how to strip it before sharing for privacy protection. - URL: https://peasysafe.com/guides/exif-data-privacy-what-photos-reveal/ - Category: How-To - Reading time: 1 min - Words: 299 ## EXIF Photo Metadata Privacy Every photo your smartphone or camera takes embeds metadata that can reveal your exact location, device model, the time it was taken, and even your name. Understanding this metadata helps you protect your privacy when sharing photos. ### What EXIF Contains Camera make and model, lens information, shutter speed, aperture, ISO, focal length, white balance, flash status. GPS coordinates (latitude, longitude, altitude) accurate to within a few meters. Date and time of capture. Thumbnail preview image. Software used for editing. Copyright information. On smartphones: device serial number and sometimes Wi-Fi network name. ### Privacy Risks GPS coordinates in shared photos can reveal your home address, workplace, children's school, and daily routine. This information has been used in stalking, burglary (knowing when you're away), and doxxing. Even photos taken indoors contain GPS data. Social media platforms like Twitter/X and Facebook strip GPS data on upload, but many other platforms (forums, messaging apps, cloud storage) do not. ### Stripping EXIF Data Browser-based tools process images locally, removing all metadata while preserving the image quality. Upload photos, select which metadata to strip (all, GPS only, or custom selection), and download the cleaned versions. The image pixels are untouched — only the metadata wrapper is modified. ### Selective Metadata Preservation Sometimes you want to keep camera settings (for photography portfolios) while removing GPS data. Most EXIF stripping tools offer selective removal. Preserve: camera model, exposure settings, lens info. Remove: GPS coordinates, date/time, thumbnails, device identifiers, editing software traces. ### Prevention Settings On iPhone: Settings → Privacy → Location Services → Camera → set to "Never." On Android: Camera app settings → Location/GPS tagging → Off. This prevents GPS data from being embedded in future photos. For photos already taken, you need to strip the metadata after the fact. ### Understanding End-to-End Encryption End-to-end encryption ensures that only the sender and recipient can read messages. Learn how it works, what it protects against, and its limitations. - URL: https://peasysafe.com/guides/understanding-end-to-end-encryption/ - Category: Best Practice - Reading time: 2 min - Words: 302 ## How E2EE Works In end-to-end encryption, messages are encrypted on the sender's device and can only be decrypted on the recipient's device. The service provider (WhatsApp, Signal, iMessage) transports the encrypted data but cannot read it — they don't have the decryption keys. ### The Key Exchange Problem Before communicating, both parties need to establish shared encryption keys without an eavesdropper intercepting them. Modern E2EE systems use public key cryptography: each user has a public key (shared openly) and a private key (stored only on their device). Messages encrypted with a public key can only be decrypted with the corresponding private key. ### What E2EE Protects Against E2EE prevents the service provider from reading your messages, even under a court order (they genuinely don't have access). It protects against server breaches — stolen encrypted messages are useless without the keys. It prevents man-in-the-middle attacks during transmission. ### What E2EE Does NOT Protect Against E2EE cannot protect against a compromised device — if malware has access to your screen or keyboard, it can read messages before encryption or after decryption. It doesn't protect metadata — the service provider still knows who you're communicating with, when, and how often. Screenshots and forwarded messages exist outside the encryption boundary. ### Verifying Encryption Most E2EE messaging apps offer a way to verify encryption keys, usually by comparing "safety numbers" or "security codes" with your contact in person or over a trusted channel. This prevents sophisticated attacks where an adversary substitutes their own keys to intercept communications. ### Backup Considerations Cloud backups of your message history may not be encrypted, creating a vulnerability. If your chat history is backed up to iCloud or Google Drive without additional encryption, those messages are accessible to the cloud provider and potentially to law enforcement. Enable encrypted backups … ### Hash Generator Selection Guide Choose the right hash algorithm for checksums, passwords, content addressing, and data integrity verification. - URL: https://peasysafe.com/guides/hash-generator-selection-guide/ - Category: Comparison - Reading time: 1 min - Words: 253 Key takeaways: - Different hash algorithms serve fundamentally different purposes. - MD5 and SHA-1 are cryptographically broken but still acceptable for non-security checksums where speed matters and collision resistance is not critical. - ### Password Hashing Never use SHA-256 or MD5 for passwords — they're designed to be fast, which helps attackers. - The hash becomes the identifier — identical content always produces the same hash, enabling deduplication and integrity verification in a single operation. ## Hash Generator Selection Different hash algorithms serve fundamentally different purposes. Using a fast hash for passwords or a slow hash for checksums wastes either security or performance. ### Checksum and Integrity Hashes For file integrity verification and deduplication, use SHA-256 or BLAKE3. SHA-256 is universally supported and produces a 64-character hex string. BLAKE3 is 5-10x faster while being equally secure — ideal for hashing large files or many small files. MD5 and SHA-1 are cryptographically broken but still acceptable for non-security checksums where speed matters and collision resistance is not critical. ### Password Hashing Never use SHA-256 or MD5 for passwords — they're designed to be fast, which helps attackers. Use bcrypt, scrypt, or Argon2id specifically designed to be slow and memory-hard. Argon2id is the current recommendation: it resists both GPU attacks (memory-hard) and side-channel attacks. Configure the work factor so hashing takes 200-500ms on your server hardware. ### Content Addressing For content-addressable storage (like Git or IPFS), use SHA-256. The hash becomes the identifier — identical content always produces the same hash, enabling deduplication and integrity verification in a single operation. For shorter identifiers, truncate the hash (first 8-12 characters) with awareness of the birthday problem collision probability. ### HMAC and Authentication When you need to verify both integrity and authenticity (the data wasn't modified AND it came from a trusted source), use HMAC with SHA-256. HMAC combines a secret key with the hash, preventing attackers from forging valid hashes. Use this for API request signing, webhook verification, and session tokens. ### URL Encoding Best Practices for Web Developers Proper URL encoding prevents broken links and security vulnerabilities. Learn which characters must be encoded and how to handle international URLs. - URL: https://peasysafe.com/guides/url-encoding-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 173 Key takeaways: - URLs can only contain ASCII characters. - Spaces become `%20` (or `+` in query strings). - Different URL parts have different encoding rules: - Domain names with non-ASCII characters use Punycode encoding. - A common bug is encoding already-encoded values, turning `%20` into `%2520`. ## Why URL Encoding Matters URLs can only contain ASCII characters. Special characters, spaces, and non-ASCII characters must be percent-encoded (%XX format) to be safely transmitted. Incorrect encoding causes broken links, XSS vulnerabilities, and data loss. ## Characters That Must Be Encoded Spaces become `%20` (or `+` in query strings). Forward slashes in values must be encoded as `%2F`. Ampersands in values need `%26` to avoid being interpreted as parameter separators. ## Component-Specific Encoding Different URL parts have different encoding rules: - **Path**: Encode spaces and special chars, preserve `/`. - **Query string**: Encode spaces as `+`, preserve `&` and `=` as separators. - **Fragment**: Encode most special characters. ## International Domain Names (IDN) Domain names with non-ASCII characters use Punycode encoding. For example, `münchen.de` becomes `xn--mnchen-3ya.de`. Modern browsers display the Unicode version while transmitting the Punycode version. ## Double Encoding A common bug is encoding already-encoded values, turning `%20` into `%2520`. This happens when a URL passes through multiple encoding layers. Always check if data is already encoded before encoding it again. ### PDF Security Best Practices for Business Documents Business documents often contain sensitive information. Learn how to secure PDFs with encryption, redaction, and metadata removal. - URL: https://peasysafe.com/guides/pdf-security-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 177 Key takeaways: - Before applying security measures, classify your documents. - A common mistake is 'hiding' sensitive text by placing a black rectangle over it. - PDFs store metadata that can reveal sensitive information: author name, company name, creation software, edit history, and GPS coordinates (for scanned photos). - Digital signatures using PKI certificates prove the document's authenticity and detect any modifications after signing. - For the highest security, combine encryption with distribution tracking. ## Document Classification Before applying security measures, classify your documents. Public documents need minimal protection. Internal documents should have basic access controls. Confidential documents require encryption, and restricted documents need the highest level of protection. ## Redaction vs Hiding A common mistake is 'hiding' sensitive text by placing a black rectangle over it. This does not remove the text — it can be revealed by selecting and copying. True redaction permanently removes the underlying text, replacing it with blank space. ## Metadata Cleaning PDFs store metadata that can reveal sensitive information: author name, company name, creation software, edit history, and GPS coordinates (for scanned photos). Always strip metadata from documents shared externally. ## Digital Signatures Digital signatures using PKI certificates prove the document's authenticity and detect any modifications after signing. They're legally binding in most jurisdictions and essential for contracts, regulatory filings, and official communications. ## Distribution Controls For the highest security, combine encryption with distribution tracking. Add unique watermarks to each copy with the recipient's name, making it possible to trace leaks back to the source. ### Privacy-First Password Management Best Practices Implement strong password hygiene using password managers, MFA, and zero-knowledge architecture. - URL: https://peasysafe.com/guides/privacy-first-password-management-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 279 Key takeaways: - The average person has 100+ online accounts but uses only 3-4 unique passwords. - Look for zero-knowledge architecture — the service cannot access your passwords even if their servers are compromised. - Your master password is the single point of failure. - Enable MFA on every account that supports it. - Regularly audit your password vault for weak, reused, or compromised passwords. ## The Password Problem The average person has 100+ online accounts but uses only 3-4 unique passwords. Credential stuffing attacks exploit this reuse — when one service is breached, attackers try those credentials everywhere. The only effective defense is unique, complex passwords for every account, which requires a password manager. ## Choosing a Password Manager Look for zero-knowledge architecture — the service cannot access your passwords even if their servers are compromised. Key features: end-to-end encryption, cross-platform sync, secure sharing, breach monitoring, and TOTP authenticator built-in. Consider whether your data is stored locally, in their cloud, or self-hosted. Evaluate the master password recovery mechanism. ## Master Password Strategy Your master password is the single point of failure. Use a passphrase of 4-5 random words (at least 20 characters). Never reuse it anywhere. Consider writing it down and storing it in a physical safe — this protects against memory failure while remaining secure against digital threats. Enable biometric unlock for daily convenience while keeping the master password for critical operations. ## Multi-Factor Authentication Enable MFA on every account that supports it. Priority order: hardware security keys (FIDO2/WebAuthn) > authenticator apps (TOTP) > SMS codes. SMS-based 2FA is vulnerable to SIM swapping but still better than no MFA. Use your password manager's built-in TOTP generator for convenience, or a separate authenticator app for security-critical accounts. ## Ongoing Maintenance Regularly audit your password vault for weak, reused, or compromised passwords. Most password managers include a security dashboard showing these issues. When a service announces a breach, change that password immediately. Review and remove accounts you no longer use. Export your vault periodically as an encrypted backup stored separately from your primary vault. ### Privacy-First Analytics: Alternatives to Google Analytics Google Analytics collects extensive user data and requires cookie consent banners in the EU. Learn about privacy-respecting alternatives that provide useful insights without tracking individuals. - URL: https://peasysafe.com/guides/privacy-first-analytics-alternatives/ - Category: Comparison - Reading time: 2 min - Words: 309 ## The Privacy Problem with GA Google Analytics 4 collects user-level data across sessions, devices, and properties. It requires cookie consent under GDPR and ePrivacy Directive, often resulting in consent banners that reduce measurement accuracy (30-50% of EU users decline tracking). GA data is also used by Google for advertising. ### Privacy-Respecting Alternatives Plausible Analytics: Lightweight (under 1KB script), no cookies, GDPR-compliant without consent banners, open source. Provides page views, referrers, countries, devices, and goals. Self-hostable. Fathom Analytics: Similar to Plausible with a focus on simplicity. EU data isolation available. Cloudflare Web Analytics: Free, no JavaScript required (edge-based), measures Core Web Vitals and page performance. No individual user tracking. ### What You Lose Without User Tracking Privacy-first analytics don't provide: user-level journeys (how individual visitors navigate your site), cross-device attribution, detailed demographics, or user segmentation. They provide aggregate data: total page views, top pages, referral sources, countries, and devices. For most websites, aggregate data is sufficient for making informed decisions. ### Server-Side Analytics An alternative approach logs analytics data server-side from access logs. No JavaScript required, no cookies, and complete data (no ad blockers can prevent logging). Parse nginx/Apache access logs to extract page views, user agents, referrers, and status codes. Tools like GoAccess provide real-time dashboards from access logs. ### Making the Transition Run Google Analytics and your privacy-first alternative in parallel for 30 days. Compare key metrics to calibrate your expectations — privacy-first tools typically show 20-40% fewer page views because they count unique sessions differently and aren't affected by analytics ad blockers. Document which metrics map between systems and which don't have equivalents. ### Cookie Consent Implications Without tracking cookies, you may not need a cookie consent banner at all (consult legal counsel for your jurisdiction). This alone can improve user experience and increase measured traffic, since … ### VPN vs Proxy vs Tor: Privacy Tool Comparison Compare VPNs, proxy servers, and the Tor network for different privacy and security needs. - URL: https://peasysafe.com/guides/vpn-vs-proxy-vs-tor-privacy-comparison/ - Category: Comparison - Reading time: 1 min - Words: 266 Key takeaways: - VPNs, proxies, and Tor all route your internet traffic through intermediary servers to mask your IP address, but they differ significantly in security, speed, and use cases. - A VPN creates an encrypted tunnel between your device and the VPN server, protecting all traffic from your ISP and local network. - Proxies route traffic at the application level — typically just your browser. - Tor routes traffic through three randomly selected relays, with each layer of encryption peeled at each hop. - For daily privacy and security on public Wi-Fi: VPN. ## Three Approaches to Online Privacy VPNs, proxies, and Tor all route your internet traffic through intermediary servers to mask your IP address, but they differ significantly in security, speed, and use cases. Understanding these differences is critical for choosing the right tool. ## VPN: Encrypted Tunnel A VPN creates an encrypted tunnel between your device and the VPN server, protecting all traffic from your ISP and local network. Modern VPNs use WireGuard or OpenVPN protocols with strong encryption. VPNs are the best general-purpose privacy tool — they protect all applications and are fast enough for streaming and downloads. ## Proxy: Application-Level Routing Proxies route traffic at the application level — typically just your browser. HTTP proxies handle web traffic but don't encrypt it. SOCKS5 proxies support any protocol but also lack encryption by default. Proxies are useful for bypassing geographic restrictions but provide minimal privacy. They're faster than VPNs since there's no encryption overhead. ## Tor: Maximum Anonymity Tor routes traffic through three randomly selected relays, with each layer of encryption peeled at each hop. No single relay knows both the source and destination. Tor provides the strongest anonymity but is significantly slower (latency of 200-1000ms+). It's essential for activists, journalists, and whistleblowers but overkill for general browsing. ## When to Use Each For daily privacy and security on public Wi-Fi: VPN. For bypassing a specific website's geographic restriction quickly: proxy. For anonymous browsing where speed doesn't matter: Tor. For maximum security (whistleblowing, sensitive research): Tor over VPN. Never use a free VPN or proxy — if you're not paying, your data is the product. ### Secure Random Number Generation: When Math.random() Isn't Enough Math.random() is fine for shuffling a playlist but dangerous for passwords, tokens, and cryptographic applications. Learn when and how to use cryptographically secure random generators. - URL: https://peasysafe.com/guides/secure-random-generation-guide/ - Category: Best Practice - Reading time: 1 min - Words: 241 ## The Problem with Math.random() JavaScript's Math.random() and similar standard library random functions use pseudorandom number generators (PRNGs). Given the seed, the entire sequence is predictable. This is fine for games, simulations, and UI effects, but disastrous for security-sensitive applications. ### When You Need CSPRNG Use a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) for: password generation, session tokens, API keys, encryption keys, CSRF tokens, one-time passwords, and any value an attacker could benefit from predicting. ### Platform-Specific APIs In browsers, use `crypto.getRandomValues()` which draws from the operating system's entropy pool. In Node.js, use `crypto.randomBytes()` or `crypto.randomUUID()`. In Python, use `secrets.token_hex()`, `secrets.token_urlsafe()`, or `secrets.choice()`. Never implement your own random number generator for security purposes. ### Common Mistakes Using Math.random() for token generation — an attacker can predict subsequent tokens after observing enough output. Seeding a PRNG with a predictable value (timestamp, PID) — the attacker can reproduce the seed. Reducing entropy by truncating random output — a 128-bit random value truncated to 32 bits has only 32 bits of security. Using modulo to restrict range — `random % n` introduces bias when n doesn't divide evenly into the PRNG's output range. ### Entropy Sources Operating systems gather entropy from hardware events: disk I/O timing, network packet timing, mouse movements, keyboard input. /dev/urandom (Linux) and CryptGenRandom (Windows) maintain entropy pools that CSPRNG functions draw from. On headless servers with minimal I/O, consider hardware random number generators (Intel RDRAND, ARM RNDR) for additional entropy. ### Browser Privacy Settings: Essential Configuration Guide Configure your browser for maximum privacy while maintaining website compatibility. - URL: https://peasysafe.com/guides/browser-privacy-settings-configuration-guide/ - Category: How-To - Reading time: 1 min - Words: 267 Key takeaways: - Modern browsers include extensive privacy features, but most are disabled by default to maximize compatibility. - Block third-party cookies — these are used almost exclusively for cross-site tracking. - Enable your browser's built-in tracker blocking (Firefox Enhanced Tracking Protection, Brave Shields, Safari Intelligent Tracking Prevention). - Browser fingerprinting identifies you based on your browser configuration, installed fonts, screen resolution, and hardware characteristics. - Switch from Google to a privacy-focused search engine: DuckDuckGo (no tracking), Brave Search (independent index), or Startpage (Google results without tracking). ## Browser Privacy Fundamentals Modern browsers include extensive privacy features, but most are disabled by default to maximize compatibility. Configuring these settings properly can block the majority of tracking without breaking websites. The goal is finding the right balance between privacy and usability. ## Cookie Management Block third-party cookies — these are used almost exclusively for cross-site tracking. Most modern browsers now block them by default. Keep first-party cookies enabled for site functionality (login sessions, preferences). Consider enabling automatic cookie clearing on browser close for sites you visit infrequently. ## Tracker Blocking Enable your browser's built-in tracker blocking (Firefox Enhanced Tracking Protection, Brave Shields, Safari Intelligent Tracking Prevention). Consider adding uBlock Origin as a comprehensive content blocker — it blocks trackers, ads, and malicious scripts. Avoid installing multiple ad blockers simultaneously as they can conflict. ## Fingerprint Resistance Browser fingerprinting identifies you based on your browser configuration, installed fonts, screen resolution, and hardware characteristics. Firefox's fingerprinting protection and Brave's randomized fingerprinting help combat this. Avoid installing uncommon browser extensions that make your fingerprint more unique. ## Search Engine Privacy Switch from Google to a privacy-focused search engine: DuckDuckGo (no tracking), Brave Search (independent index), or Startpage (Google results without tracking). Set your chosen engine as the default in browser settings. Disable search suggestions if they send keystrokes to the search engine as you type. ## DNS Privacy Change your DNS to a privacy-respecting provider: Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or NextDNS (customizable blocking). Enable DNS over HTTPS (DoH) in browser settings to encrypt DNS queries. This prevents your ISP from seeing which websites you visit through DNS monitoring. ### HTTP Header Security Best Practices Configure security headers including CSP, HSTS, X-Frame-Options, and permissions policy for web applications. - URL: https://peasysafe.com/guides/http-header-security-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 285 ## HTTP Security Headers Security headers tell browsers how to handle your content, preventing entire classes of attacks. A properly configured header set blocks XSS, clickjacking, MIME sniffing, and protocol downgrade attacks. ### Content-Security-Policy (CSP) CSP defines which sources can load scripts, styles, images, and other resources. Start with a restrictive policy: `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'`. Add sources as needed. `'unsafe-inline'` for scripts should be avoided — use nonces or hashes instead. CSP blocks inline scripts, which is the primary XSS mitigation. ### Strict-Transport-Security (HSTS) HSTS forces browsers to use HTTPS for all future requests to your domain. Set `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`. The max-age of one year is standard. includeSubDomains applies HSTS to all subdomains. preload submits your domain to browser preload lists, ensuring HTTPS-only access even on the first visit. ### X-Content-Type-Options `X-Content-Type-Options: nosniff` prevents browsers from MIME-type sniffing — interpreting file types based on content rather than the declared Content-Type. Without this header, a file served as text/plain but containing HTML/JavaScript could be executed by the browser. ### X-Frame-Options and frame-ancestors `X-Frame-Options: DENY` prevents your site from being embedded in iframes, blocking clickjacking attacks. The modern replacement is the CSP `frame-ancestors` directive: `frame-ancestors 'self'` allows framing only by your own domain. Use `frame-ancestors 'none'` for the same effect as DENY. ### Permissions-Policy Permissions-Policy (formerly Feature-Policy) controls which browser features your site can use: camera, microphone, geolocation, payment, fullscreen. Set `Permissions-Policy: camera=(), microphone=(), geolocation=()` to explicitly disable features you don't need, preventing them from being exploited if your site is compromised. ### Verification Use browser-based security header checkers to verify your configuration. Headers like CSP can break functionality if too restrictive — test in report-only mode first (`Content-Security-Policy-Report-Only`) before enforcing. ### How to Generate Secure Random Passwords Weak passwords remain the leading cause of account compromises. This guide explains the principles behind cryptographically secure password generation and how to create strong, memorable passwords for different use cases. - URL: https://peasysafe.com/guides/how-to-generate-secure-random-passwords/ - Category: How-To - Reading time: 2 min - Words: 488 Key takeaways: - A password's strength is measured by its entropy — the number of bits of randomness it contains. - Entropy per character depends on the size of the character set. - JavaScript's `Math.random()` uses a pseudo-random number generator (PRNG) that is not cryptographically secure. - The classic approach: generate a string of random characters from a defined character set. - For password manager master passwords, use a 5-6 word passphrase (minimum 64 bits entropy). ## Why Password Strength Matters A password's strength is measured by its entropy — the number of bits of randomness it contains. Each bit doubles the number of possible combinations. A 40-bit password has roughly one trillion possible values, while an 80-bit password has over a sextillion. Modern password-cracking hardware can test billions of combinations per second, so high entropy is essential. ## Understanding Entropy ### Character Set Size Entropy per character depends on the size of the character set. Lowercase letters only (26 characters) provide about 4.7 bits per character. Adding uppercase doubles the set to 52 characters (5.7 bits each). Including digits brings it to 62 characters (5.95 bits each). Adding symbols reaches 94+ characters (about 6.5 bits each). ### Length vs Complexity Length is more important than complexity. A 20-character lowercase password (94 bits) is stronger than a 12-character mixed-case-symbol password (78 bits). Longer passwords are also easier to type correctly and less likely to trigger frustrating 'invalid password' errors. ## Cryptographic Randomness ### Why Math.random() Is Not Enough JavaScript's `Math.random()` uses a pseudo-random number generator (PRNG) that is not cryptographically secure. Its output can be predicted if the internal state is known. For password generation, always use `crypto.getRandomValues()` (Web Crypto API), which draws from the operating system's cryptographically secure random number generator. ### Client-Side Generation Generating passwords in the browser means the password never travels over the network and never exists on a server. This is the most private approach — the password exists only in the user's browser memory and clipboard. Tools that process everything client-side provide this guarantee by design. ## Password Generation Strategies ### Random Character Strings The classic approach: generate a string of random characters from a defined character set. A 16-character string from the full printable ASCII set provides about 104 … ### How to Share Files Securely: A Complete Privacy Guide Step-by-step guide to sharing sensitive files without exposing your data to third parties. Covers client-side encryption, secure link generation, expiring downloads, and zero-knowledge file transfer services. - URL: https://peasysafe.com/guides/secure-file-sharing-privacy-guide/ - Category: How-To - Reading time: 1 min - Words: 270 Key takeaways: - When you upload a file to a conventional cloud service, the provider can access your data. - The safest approach encrypts files in your browser before any upload occurs. - For simpler scenarios, a password-protected ZIP or 7z archive provides decent protection. - Even encrypted files can leak information through metadata — file names, sizes, timestamps, and EXIF data in images. - For truly private sharing, encryption must happen before the file leaves your device. ## The Problem with Standard File Sharing When you upload a file to a conventional cloud service, the provider can access your data. Their servers decrypt, scan, and index your files for various purposes. Even with HTTPS protecting the transfer, the file sits unencrypted on their storage. For truly private sharing, encryption must happen before the file leaves your device. ## Client-Side Encryption Workflow The safest approach encrypts files in your browser before any upload occurs. The encryption key can be embedded in the URL fragment (after the `#` symbol), which browsers never send to the server. The recipient's browser extracts the key from the URL and decrypts locally. The server only ever sees encrypted bytes. ## Step-by-Step Secure Sharing 1. **Encrypt locally** — Use a client-side tool to encrypt with AES-256-GCM 2. **Generate a strong key** — 256-bit random key, never reused 3. **Set expiration** — Configure auto-deletion after download or time limit 4. **Share the link securely** — Send via encrypted messaging, not email 5. **Verify the recipient** — Confirm they received the correct file hash ## Password-Protected Archives For simpler scenarios, a password-protected ZIP or 7z archive provides decent protection. Use AES-256 encryption (7-Zip's default), not the legacy ZipCrypto algorithm which has known vulnerabilities. Share the archive through one channel and the password through a different channel — never together. ## Metadata Leaks to Watch For Even encrypted files can leak information through metadata — file names, sizes, timestamps, and EXIF data in images. Strip metadata before sharing sensitive documents. The Peasy privacy tools can help you inspect and remove metadata from files entirely within your browser. ### Digital Privacy Checklist: 15 Steps to Protect Your Online Identity A comprehensive checklist covering browser settings, account security, device configuration, and data hygiene practices. Prioritized by impact — start with the highest-value actions and work through systematically. - URL: https://peasysafe.com/guides/digital-privacy-checklist-15-steps/ - Category: Best Practice - Reading time: 1 min - Words: 226 ## High Impact (Do These First) 1. **Enable 2FA on critical accounts** — Email, banking, cloud storage 2. **Use a password manager** — Generate unique 16+ character passwords 3. **Update all software** — Enable automatic updates everywhere 4. **Enable full-disk encryption** — BitLocker (Windows), FileVault (macOS) 5. **Review app permissions** — Revoke camera/microphone/location for unused apps ## Medium Impact (Significant Improvements) 6. **Configure DNS-over-HTTPS** — Use 1.1.1.1 or 9.9.9.9 7. **Install a content blocker** — uBlock Origin blocks trackers and ads 8. **Disable third-party cookies** — All major browsers support this 9. **Audit connected apps** — Review OAuth permissions on Google/GitHub/Apple 10. **Use encrypted messaging** — Signal for sensitive conversations ## Ongoing Maintenance 11. **Check breach databases** — HaveIBeenPwned.com quarterly 12. **Review privacy settings** — Social media defaults change frequently 13. **Clear unused accounts** — Delete dormant accounts that hold personal data 14. **Use email aliases** — Different addresses for different service categories 15. **Back up encryption keys** — Securely store recovery codes offline ## Tracking Your Progress Privacy is not a one-time setup — it requires ongoing attention as services change their policies and new threats emerge. Revisit this checklist quarterly. Start with items 1-5 if you are beginning your privacy journey; they provide the greatest protection-to-effort ratio. Use the Peasy privacy tools to analyze your current exposure and identify the most impactful next steps. ### WiFi QR Codes: Connecting Guests Without Sharing Passwords WiFi QR codes let guests connect to a network with a single scan, eliminating the need to dictate complex passwords. The encoding format is standardized and supported natively by iOS and Android camera apps. - URL: https://peasysafe.com/guides/wifi-qr-codes-guest-networks/ - Category: How-To - Reading time: 2 min - Words: 305 Key takeaways: - WiFi QR codes use a standardized plain-text format that smartphone cameras recognize automatically: - The WiFi password is encoded in plain text inside the QR code. - Hospitality:** Hotels, Airbnb rentals, cafes — print and frame near the entrance - Print the QR code on a small card or sticker alongside the network name and password in text form. - The most common failure is an SSID mismatch — the SSID in the QR code must exactly match the router's broadcast name, including capitalization and spaces. ## The WiFi QR Format WiFi QR codes use a standardized plain-text format that smartphone cameras recognize automatically: ``` WIFI:T:WPA;S:MyNetworkName;P:MyPassword123;H:false;; ``` | Field | Value | Notes | |-------|-------|-------| | T | WPA, WEP, or nopass | Security type | | S | Network SSID | Case-sensitive | | P | Password | Plain text (security consideration) | | H | true/false | Whether SSID is hidden | ## Security Considerations The WiFi password is encoded in plain text inside the QR code. Anyone with a QR scanner can extract it. This is acceptable for guest networks but not for primary networks carrying sensitive traffic. **Best practice:** Create a dedicated guest network isolated from your main network. Set bandwidth limits on the guest network. Rotate the guest password periodically and regenerate the QR code. ## Use Cases - **Hospitality:** Hotels, Airbnb rentals, cafes — print and frame near the entrance - **Offices:** Visitor guest network in reception areas and meeting rooms - **Events:** Conference WiFi on event badges or signage - **Retail:** Customer WiFi in stores to encourage dwell time - **Home:** Guest bathroom or living room for visitors ## Presentation Tips Print the QR code on a small card or sticker alongside the network name and password in text form. Not all guests will know how to scan QR codes, and some devices may have older camera apps that do not support WiFi QR codes. The text fallback ensures universal access. ## Troubleshooting Scan Failures The most common failure is an SSID mismatch — the SSID in the QR code must exactly match the router's broadcast name, including capitalization and spaces. Special characters in the password (semicolons, colons, backslashes) must be escaped with a backslash in the encoded string. Test the QR code on a device that is not … ### VPN vs Proxy vs Tor: Which Privacy Tool Should You Use? Compare VPNs, proxy servers, and the Tor network across speed, anonymity, cost, and use cases. Understand the threat models each tool addresses and when to combine them for maximum privacy. - URL: https://peasysafe.com/guides/vpn-vs-proxy-vs-tor-comparison/ - Category: Comparison - Reading time: 1 min - Words: 284 Key takeaways: - VPNs, proxies, and Tor each address distinct privacy concerns. - A VPN encrypts all traffic between your device and the VPN server. - Proxies route traffic for specific applications without encrypting the connection by default. - Tor routes traffic through three volunteer relays, each knowing only the previous and next hop. - Tor is essential for journalists, activists, and anyone facing serious threats. ## Different Tools for Different Threats VPNs, proxies, and Tor each address distinct privacy concerns. Choosing the right tool requires understanding your threat model — who you are hiding from and what information you need to protect. Using the wrong tool creates a false sense of security. ## Comparison Table | Feature | VPN | Proxy (SOCKS5) | Tor | | --- | --- | --- | --- | | Encryption | Full tunnel | None/optional | Triple-layer | | Speed | 80-95% of base | 90-100% | 10-30% | | Anonymity | Low-medium | None | High | | Cost | $3-12/mo | Free-$5/mo | Free | | All traffic | Yes | Per-app | Browser only | | Trust required | VPN provider | Proxy operator | None | ## VPN: Hide From Your ISP A VPN encrypts all traffic between your device and the VPN server. Your ISP sees only encrypted data flowing to one IP address. However, the VPN provider can see all your traffic — you are shifting trust from your ISP to the VPN company. No-log policies are difficult to verify independently. ## Proxy: Application-Level Routing Proxies route traffic for specific applications without encrypting the connection by default. SOCKS5 proxies support any protocol but provide no encryption. HTTP proxies only handle web traffic. Proxies are useful for bypassing geographic restrictions but offer minimal privacy against network observers. ## Tor: Maximum Anonymity Tor routes traffic through three volunteer relays, each knowing only the previous and next hop. No single relay can identify both the user and the destination. The tradeoff is significant speed reduction and occasional CAPTCHA challenges. Tor is essential for journalists, activists, and anyone facing serious threats. ### Event Ticket QR Codes: Generation, Validation, and Security QR codes on event tickets must balance ease of scanning with resistance to duplication and fraud. A well-designed ticket QR system validates entry in under one second while preventing unauthorized copies. - URL: https://peasysafe.com/guides/event-ticket-qr-codes-guide/ - Category: Best Practice - Reading time: 2 min - Words: 303 Key takeaways: - Each ticket QR code encodes a unique identifier — typically a UUID or cryptographically signed token. - Unique per ticket:** Never encode the same data in multiple QR codes - Scanner reads QR → sends identifier to server → server checks validity and marks as used → returns allow/deny. - The simplest fraud is screenshotting a QR code and sharing it. - At events with 1,000+ attendees, scan speed determines entry throughput. ## Ticket QR Code Architecture Each ticket QR code encodes a unique identifier — typically a UUID or cryptographically signed token. The identifier maps to a record in the event management database containing the ticket holder's information, ticket type, and validation status. ## Generation Best Practices - **Unique per ticket:** Never encode the same data in multiple QR codes - **Cryptographic signing:** Embed a digital signature that the scanner verifies offline, preventing forged QR codes - **Error correction level H:** Events involve physical handling (folding, pockets, rain) — maximum error correction prevents scan failures - **Minimum size:** 3×3 cm for reliable scanning at arm's length under variable lighting conditions ## Validation Workflow ### Online Validation Scanner reads QR → sends identifier to server → server checks validity and marks as used → returns allow/deny. Latency must be under 500ms to maintain entry throughput. Requires network connectivity at the venue. ### Offline Validation For venues without reliable connectivity, embed a cryptographic signature in the QR data itself. The scanner verifies the signature against a pre-shared public key without contacting the server. Trade-off: offline validation cannot detect duplicate use in real time. ## Preventing Fraud ### Screenshot Duplication The simplest fraud is screenshotting a QR code and sharing it. Mitigate with first-scan-wins policy (the first person to scan enters, duplicates are rejected) and rotating QR codes that change every 30 seconds in the ticket app. ### Counterfeit Tickets Without cryptographic signing, anyone who knows the QR format can generate valid-looking codes. Always sign the ticket data so scanners can verify authenticity. ## Scaling for Large Events At events with 1,000+ attendees, scan speed determines entry throughput. Aim for sub-second validation per ticket. Pre-download the attendee database to scanner devices for offline capability. Deploy multiple scanning lanes with independent devices to avoid single … ### Secure Password Generation: Algorithms and Best Practices Explore the cryptographic random number generators behind secure password creation. Learn why Math.random() is never sufficient, how CSPRNG works, and the best practices for generating passwords in the browser. - URL: https://peasysafe.com/guides/secure-password-generation-algorithms/ - Category: Best Practice - Reading time: 1 min - Words: 244 Key takeaways: - JavaScript's `Math.random()` uses a pseudorandom number generator (PRNG) that is fast but predictable. - The Web Crypto API provides `crypto.getRandomValues()`, which draws from the operating system's entropy pool. - Always use `crypto.getRandomValues()` or equivalent CSPRNG ## Why Math.random() Is Dangerous JavaScript's `Math.random()` uses a pseudorandom number generator (PRNG) that is fast but predictable. Its internal state can be recovered from a small number of observed outputs, allowing an attacker to predict future values. Never use `Math.random()` for security-sensitive operations like password or token generation. ## Cryptographically Secure Alternatives The Web Crypto API provides `crypto.getRandomValues()`, which draws from the operating system's entropy pool. On Linux this reads from `/dev/urandom`, on Windows from `BCryptGenRandom`, and on macOS from `SecRandomCopyBytes`. These sources collect entropy from hardware events — disk timing, mouse movements, and interrupt timing. ## Password Generation Strategies | Strategy | Entropy (typical) | Memorability | Example | | --- | --- | --- | --- | | Random characters (16) | ~105 bits | Very low | `kX9#mP2$vL7@nQ4&` | | Diceware (5 words) | ~64 bits | High | `table-crane-amber-frost-violin` | | Diceware (7 words) | ~90 bits | Medium | longer phrase | | Pronounceable (16) | ~60 bits | Medium | `boquimaletopusan` | ## Best Practices - Always use `crypto.getRandomValues()` or equivalent CSPRNG - Generate passwords of at least 16 characters or 5+ diceware words - Include characters from multiple Unicode categories when possible - Never truncate or modify generated passwords — it reduces entropy - Store generated passwords in a password manager immediately The Peasy password generator uses the Web Crypto API to create passwords entirely in your browser — no server communication, no logging, no storage. ### How to Block Cookies and Trackers Without Breaking Websites Practical guide to configuring cookie and tracker blocking that protects your privacy without causing website breakage. Covers browser settings, extension configuration, and troubleshooting common issues. - URL: https://peasysafe.com/guides/block-cookies-trackers-without-breaking-sites/ - Category: Troubleshooting - Reading time: 1 min - Words: 252 Key takeaways: - Aggressive privacy settings often break website functionality. - Start with your browser's built-in protections before adding extensions: - Install uBlock Origin with default filter lists — it blocks most tracking without site breakage. - When a site malfunctions after enabling blocking, open the browser console and look for blocked resource errors. - Never whitelist known tracking domains like doubleclick. ## The Blocking Dilemma Aggressive privacy settings often break website functionality. Login forms fail, shopping carts empty themselves, and interactive features stop working. The key is selective blocking — targeting tracking cookies and scripts while preserving the functional ones that websites genuinely need. ## Cookie Categories | Type | Purpose | Block? | | --- | --- | --- | | Session cookies | Login state, cart | No | | First-party persistent | Preferences, language | Usually no | | Third-party tracking | Cross-site profiling | Yes | | Supercookies (HSTS, ETags) | Persistent tracking | Yes | | Fingerprinting scripts | Device identification | Yes | ## Recommended Browser Configuration Start with your browser's built-in protections before adding extensions: - **Firefox**: Enable Enhanced Tracking Protection (Strict mode) - **Safari**: Intelligent Tracking Prevention is enabled by default - **Chrome**: Block third-party cookies in incognito, or use the Privacy Sandbox - **Brave**: Shields block trackers and fingerprinting out of the box ## Extension Strategy Install uBlock Origin with default filter lists — it blocks most tracking without site breakage. Avoid stacking multiple blocking extensions, which causes conflicts and unpredictable behavior. If a site breaks, temporarily disable uBlock for that domain rather than weakening your global settings. ## Troubleshooting Breakage When a site malfunctions after enabling blocking, open the browser console and look for blocked resource errors. Whitelist only the specific domains required for functionality — typically the site's own CDN and authentication provider. Never whitelist known tracking domains like doubleclick.net or facebook.net. ### Archive Format Guide: ZIP, TAR, 7z, and RAR Compared Compare archive formats for compression ratio, speed, encryption, and cross-platform compatibility. Understand the difference between archiving and compression, and when each format excels. - URL: https://peasysafe.com/guides/archive-format-zip-tar-7z-rar-compared/ - Category: How-To - Reading time: 1 min - Words: 262 Key takeaways: - Archiving bundles multiple files into one container. - ZIP: Universal interchange — every OS opens ZIP without extra software. - ZIP's legacy encryption (ZipCrypto) is trivially broken — always use AES-256 when encrypting ZIP archives. - ## Encryption Warnings ZIP's legacy encryption (ZipCrypto) is trivially broken — always use AES-256 when encrypting ZIP archives. ## Archiving vs Compression Archiving bundles multiple files into one container. Compression reduces file size. Some formats do both (ZIP, 7z), while TAR is archive-only — it is typically combined with a separate compressor (gzip → .tar.gz, bzip2 → .tar.bz2, zstd → .tar.zst). Understanding this distinction explains why TAR+GZIP often compresses better than ZIP — it can find redundancy across files. ## Format Comparison | Format | Compression | Speed | Encryption | Cross-Platform | | --- | --- | --- | --- | --- | | ZIP | Medium | Fast | AES-256 (optional) | Universal | | TAR.GZ | Medium | Fast | Via GPG only | Unix native | | TAR.ZST | High | Very fast | Via GPG only | Growing | | 7z | Very high | Slow | AES-256 | Requires 7-Zip | | RAR | High | Medium | AES-256 | Requires WinRAR | ## When to Use Each **ZIP**: Universal interchange — every OS opens ZIP without extra software. Use for files shared with non-technical users. **TAR.GZ**: Unix/Linux standard. Use for code archives, backups, and deployment packages. Preserves Unix permissions and symlinks. **7z**: Maximum compression ratio. Use when file size matters more than speed or universal compatibility. **TAR.ZST**: Modern alternative to TAR.GZ with better compression at higher speed. Gaining adoption in Linux distributions. ## Encryption Warnings ZIP's legacy encryption (ZipCrypto) is trivially broken — always use AES-256 when encrypting ZIP archives. RAR and 7z encryption is strong by default. For TAR archives, encrypt the entire archive with GPG rather than relying on the archiver. ### End-to-End Encryption: How It Works and Why It Matters A clear explanation of end-to-end encryption for non-technical users. Understand key exchange, the Signal protocol, and why E2EE prevents service providers from reading your messages. - URL: https://peasysafe.com/guides/end-to-end-encryption-explained/ - Category: How-To - Reading time: 1 min - Words: 242 Key takeaways: - Standard encryption protects data in transit — between your device and the server. - E2EE requires both parties to share a secret without ever sending it over the network. - Used by Signal, WhatsApp, and Google Messages, this protocol provides forward secrecy — compromising today's key does not decrypt past messages. - E2EE secures content in transit and at rest on servers, but it does not protect against compromised endpoints. ## What Makes Encryption End-to-End? Standard encryption protects data in transit — between your device and the server. The server decrypts the data, processes it, and re-encrypts when sending it forward. End-to-end encryption (E2EE) is fundamentally different: only the sender and recipient hold the decryption keys. The server transports encrypted blobs it cannot read, even under legal compulsion. ## The Key Exchange Problem E2EE requires both parties to share a secret without ever sending it over the network. The Diffie-Hellman key exchange solves this mathematically: each party generates a private key and shares only the public component. Both sides compute the same shared secret independently. Modern implementations use elliptic curve variants (X25519) for efficiency. ## The Signal Protocol Used by Signal, WhatsApp, and Google Messages, this protocol provides forward secrecy — compromising today's key does not decrypt past messages. It uses a ratcheting mechanism that generates new encryption keys for each message. Even if an attacker captures every encrypted message and later obtains the current key, they cannot decrypt historical conversations. ## What E2EE Cannot Protect E2EE secures content in transit and at rest on servers, but it does not protect against compromised endpoints. If malware is installed on your device, it can read messages after decryption. Screenshots, backups to unencrypted cloud storage, and physical access to unlocked devices all bypass E2EE protections. Metadata — who you communicate with, when, and how often — may also remain visible to the service provider. ### Secure Messaging Apps Compared: Signal, WhatsApp, Telegram, and More An objective comparison of popular messaging apps focusing on encryption protocols, metadata handling, open-source status, and jurisdiction. Understand the real-world security differences beyond marketing claims. - URL: https://peasysafe.com/guides/secure-messaging-apps-compared/ - Category: Best Practice - Reading time: 1 min - Words: 279 Key takeaways: - Most major messaging apps now offer end-to-end encryption, but their security postures differ dramatically in metadata collection, backup encryption, group chat implementation, and corporate incentive structures. - Signal collects only your phone number and registration date. - Telegram is often perceived as a secure messenger, but standard chats are not end-to-end encrypted — they use client-server encryption. - For maximum security, use Signal. ## Encryption Is Not the Whole Story Most major messaging apps now offer end-to-end encryption, but their security postures differ dramatically in metadata collection, backup encryption, group chat implementation, and corporate incentive structures. A messaging app that encrypts messages but stores contact graphs and timestamps still reveals significant information. ## Feature Comparison | Feature | Signal | WhatsApp | Telegram | iMessage | | --- | --- | --- | --- | --- | | E2EE default | Yes | Yes | No (opt-in) | Yes | | Protocol | Signal | Signal | MTProto | Custom | | Open source | Full | Client only | Client only | No | | Metadata collected | Minimal | Extensive | Moderate | Moderate | | Backup encryption | Yes | Optional | Server-side | iCloud | | Group E2EE | Yes | Yes | No | Yes | ## Signal: The Gold Standard Signal collects only your phone number and registration date. Message content, contact lists, group memberships, and profile information are all encrypted. The server code is open source and regularly audited. Signal is operated by a nonprofit foundation with no advertising business model. ## The Telegram Misconception Telegram is often perceived as a secure messenger, but standard chats are not end-to-end encrypted — they use client-server encryption. Only Secret Chats enable E2EE, and these do not work in groups. Telegram stores message content on its servers, accessible with the encryption keys it holds. ## Making Your Choice For maximum security, use Signal. For convenience with adequate security, WhatsApp with encrypted backups is a reasonable compromise. Avoid relying on Telegram for sensitive communications unless using Secret Chats exclusively. ### Privacy-Focused Browser Settings: A Configuration Guide Detailed configuration guides for Firefox, Chrome, Safari, and Brave with specific settings to maximize privacy while maintaining usability. Includes about:config tweaks and extension recommendations. - URL: https://peasysafe.com/guides/privacy-focused-browser-settings-guide/ - Category: How-To - Reading time: 1 min - Words: 226 Key takeaways: - Firefox offers the deepest privacy customization of any mainstream browser. - Chrome is built by an advertising company, so privacy requires active effort. - Safari's Intelligent Tracking Prevention blocks cross-site tracking automatically. ## Firefox: The Privacy Champion Firefox offers the deepest privacy customization of any mainstream browser. Start with Enhanced Tracking Protection set to Strict mode. Then navigate to `about:config` for advanced hardening: - `privacy.resistFingerprinting` = true (spoofs many fingerprint vectors) - `network.http.sendRefererHeader` = 1 (send referrer to same origin only) - `dom.event.clipboardevents.enabled` = false (prevent clipboard snooping) - `media.peerconnection.enabled` = false (disable WebRTC IP leak) ## Chrome: Damage Limitation Chrome is built by an advertising company, so privacy requires active effort. Disable the following in Settings > Privacy and Security: - Turn off Preload pages, URL predictions, and search suggestions - Block third-party cookies - Disable the Privacy Sandbox (unless you prefer it to raw tracking) - Use uBlock Origin to supplement Chrome's limited built-in protections ## Safari: Good Defaults Safari's Intelligent Tracking Prevention blocks cross-site tracking automatically. Ensure these are enabled: Prevent Cross-Site Tracking, Hide IP Address, and Advanced Tracking and Fingerprinting Protection. Safari's limitations are in extension availability — fewer privacy tools are available compared to Firefox. ## Essential Extensions | Extension | Purpose | Browsers | | --- | --- | --- | | uBlock Origin | Ad/tracker blocking | Firefox, Chrome | | Privacy Badger | Tracker learning | All | | HTTPS Everywhere | Force encryption | Firefox (built into others) | | Decentraleyes | CDN request interception | Firefox, Chrome | ### QR Code Security: Risks, Attacks, and Mitigation Strategies QR codes are inherently trusted by users — most people scan without hesitation. This trust creates attack vectors including phishing, malware distribution, and payment fraud that require awareness and mitigation. - URL: https://peasysafe.com/guides/qr-code-security-considerations/ - Category: Troubleshooting - Reading time: 2 min - Words: 338 Key takeaways: - When a user scans a QR code, they cannot inspect the encoded URL before their phone opens it. - Attackers place a sticker with a malicious QR code over a legitimate one — on parking meters, restaurant tables, or public transit. - Use HTTPS URLs exclusively** — Browsers warn on HTTP, providing a safety net - Check the URL preview** before opening — most phone cameras show the URL before navigating - Organizations deploying QR codes at scale should inventory all deployed codes, regularly audit physical placements for tampering, use dynamic codes (allowing rapid destination changes if compromised), and implement monitoring to detect anomalous scan patterns. ## The Trust Problem When a user scans a QR code, they cannot inspect the encoded URL before their phone opens it. Unlike clicking a link in an email (where the URL is visible), a QR code is a black box. This makes QR codes an effective phishing vector — a malicious QR code on a legitimate-looking poster can redirect to a credential harvesting page. ## Attack Vectors ### QR Code Overlay (Quishing) Attackers place a sticker with a malicious QR code over a legitimate one — on parking meters, restaurant tables, or public transit. The user believes they are scanning a trusted code. This is the most common real-world QR attack. ### Phishing via QR Email-based phishing using QR codes ('quishing') bypasses traditional URL scanning in email security tools because the malicious URL is encoded in an image rather than as a text link. ### Malicious App Downloads A QR code linking to a sideloaded APK or a convincing fake app store page can trick users into installing malware. ## Mitigation for QR Code Creators - **Use HTTPS URLs exclusively** — Browsers warn on HTTP, providing a safety net - **Use branded short URLs** — `qr.yourbrand.com/abc` is visually trustworthy on the preview screen - **Sign your codes** — For high-value applications (payments, tickets), embed a cryptographic signature - **Monitor redirect analytics** — Sudden traffic spikes from unexpected locations may indicate a cloned code ## Mitigation for QR Code Scanners (Users) - **Check the URL preview** before opening — most phone cameras show the URL before navigating - **Look for tamper signs** — stickers placed over existing codes, misaligned prints, different paper quality - **Avoid scanning codes from untrusted sources** — unsolicited flyers, random stickers in public places - **Use a scanner app that previews URLs** rather than auto-opening them … ### Text Hashing Explained: MD5, SHA-256, and When to Use Each Compare cryptographic and non-cryptographic hash functions. Understand when MD5 is acceptable, when SHA-256 is necessary, and why hash functions are not encryption. - URL: https://peasysafe.com/guides/text-hashing-md5-sha256-comparison/ - Category: Comparison - Reading time: 1 min - Words: 280 Key takeaways: - Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest). - MD5 is cryptographically broken — collisions can be constructed in seconds. - SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations. - Never use SHA-256 or MD5 directly for password storage. - ## Password Hashing Is Different Never use SHA-256 or MD5 directly for password storage. ## Hashing Is Not Encryption Hash functions are one-way transformations — they convert input of any size into a fixed-size output (digest). Unlike encryption, hashing is irreversible by design. You cannot recover the original data from a hash. This makes hashing ideal for integrity verification, password storage, and deduplication. ## Algorithm Comparison | Algorithm | Output Size | Speed | Security | Use Case | | --- | --- | --- | --- | --- | | MD5 | 128 bits | Very fast | Broken | Checksums, dedup (non-security) | | SHA-1 | 160 bits | Fast | Broken | Legacy systems only | | SHA-256 | 256 bits | Medium | Strong | File integrity, certificates | | SHA-3 | 256+ bits | Medium | Strong | Future-proof applications | | BLAKE3 | 256 bits | Very fast | Strong | High-performance hashing | | xxHash | 64/128 bits | Extreme | Non-crypto | Hash tables, caching | ## MD5: Still Useful, Not for Security MD5 is cryptographically broken — collisions can be constructed in seconds. However, it remains useful for non-adversarial checksums: verifying file downloads, detecting accidental corruption, and content-based deduplication where deliberate collision attacks are not a concern. ## SHA-256: The Standard Choice SHA-256 provides 128-bit collision resistance — finding two inputs with the same hash requires approximately 2^128 operations. It is the standard for digital signatures, certificate chains, and any context where an attacker might try to create hash collisions. ## Password Hashing Is Different Never use SHA-256 or MD5 directly for password storage. Use dedicated password hashing functions (bcrypt, scrypt, Argon2) that are intentionally slow and include salt values to prevent rainbow table attacks. ### Secure Cloud Storage: Best Practices for Protecting Your Files Evaluate cloud storage security models and learn how to protect sensitive files before uploading. Covers zero-knowledge providers, client-side encryption, and hybrid local-cloud backup strategies. - URL: https://peasysafe.com/guides/secure-cloud-storage-best-practices/ - Category: How-To - Reading time: 1 min - Words: 278 Key takeaways: - Standard cloud storage providers encrypt your data in transit and at rest, but they hold the encryption keys. - Zero-knowledge cloud storage encrypts everything client-side before upload. - If you prefer mainstream providers, encrypt sensitive files before uploading. - Maintain three copies of important data on two different media types, with one copy offsite. - ## The 3-2-1 Backup Rule Maintain three copies of important data on two different media types, with one copy offsite. ## The Cloud Trust Problem Standard cloud storage providers encrypt your data in transit and at rest, but they hold the encryption keys. This means the provider — and anyone who compromises them — can access your files. Government subpoenas compel providers to decrypt and hand over data. For truly private storage, the encryption keys must remain exclusively with you. ## Zero-Knowledge Providers Zero-knowledge cloud storage encrypts everything client-side before upload. The provider cannot decrypt your files even if compelled by law. The tradeoff is that password recovery is impossible — lose your key, lose your data. | Provider | Zero-Knowledge | Free Tier | Max Storage | | --- | --- | --- | --- | | Tresorit | Yes | 3 GB | 2 TB | | Proton Drive | Yes | 1 GB | 3 TB | | Sync.com | Yes | 5 GB | Unlimited | | Google Drive | No | 15 GB | 30 TB | | iCloud | Partial (Advanced) | 5 GB | 12 TB | ## Encrypting Before Upload If you prefer mainstream providers, encrypt sensitive files before uploading. Tools like Cryptomator create encrypted vaults that sync transparently with any cloud service. Individual files can be encrypted with 7-Zip using AES-256. The Peasy encryption tools let you encrypt files directly in your browser without installing any software. ## The 3-2-1 Backup Rule Maintain three copies of important data on two different media types, with one copy offsite. Cloud storage satisfies the offsite requirement but should not be your only backup. Combine encrypted cloud storage with a local external drive for comprehensive protection against both data loss and unauthorized access. ### GDPR Basics for Individuals: Your Data Rights Explained Understand your rights under GDPR and similar privacy regulations. Learn how to exercise data access requests, request deletion, and identify when companies violate your privacy rights. - URL: https://peasysafe.com/guides/gdpr-basics-data-rights-explained/ - Category: How-To - Reading time: 1 min - Words: 263 Key takeaways: - The General Data Protection Regulation grants EU residents (and increasingly, citizens worldwide through similar laws) eight fundamental data rights: - Send an email to the company's Data Protection Officer (check their privacy policy for the contact address) stating: your full name, any identifiers they might use (account ID, email), and that you are making a Subject Access Request under GDPR Article 15. - If a company ignores your request or provides an inadequate response, file a complaint with your national data protection authority. - Similar regulations now exist worldwide: CCPA/CPRA in California, LGPD in Brazil, PIPA in South Korea, and PIPL in China. - Right to be informed — Companies must explain what data they collect 2. ## Your Eight Core Rights The General Data Protection Regulation grants EU residents (and increasingly, citizens worldwide through similar laws) eight fundamental data rights: 1. **Right to be informed** — Companies must explain what data they collect 2. **Right of access** — You can request a copy of all data held about you 3. **Right to rectification** — Correct inaccurate personal data 4. **Right to erasure** — Request deletion of your data (right to be forgotten) 5. **Right to restrict processing** — Limit how your data is used 6. **Right to data portability** — Receive your data in a machine-readable format 7. **Right to object** — Opt out of direct marketing and profiling 8. **Rights related to automated decisions** — Challenge algorithmic decisions ## Filing a Data Access Request Send an email to the company's Data Protection Officer (check their privacy policy for the contact address) stating: your full name, any identifiers they might use (account ID, email), and that you are making a Subject Access Request under GDPR Article 15. They must respond within 30 days, free of charge. ## When Companies Do Not Comply If a company ignores your request or provides an inadequate response, file a complaint with your national data protection authority. In the EU, each country has a supervisory authority. GDPR fines can reach 4% of global annual revenue, so companies take complaints seriously. ## Beyond GDPR Similar regulations now exist worldwide: CCPA/CPRA in California, LGPD in Brazil, PIPA in South Korea, and PIPL in China. While specifics differ, the trend toward individual data rights is accelerating globally. ### Fake Data Generation for Development and Demos Realistic fake data populates development databases, demo environments, and test suites without exposing real user information. This guide covers tools, strategies, and privacy considerations. - URL: https://peasysafe.com/guides/fake-data-generation-development/ - Category: How-To - Reading time: 1 min - Words: 266 Key takeaways: - Using production data in development environments violates privacy regulations (GDPR, CCPA), creates security risks if laptops are stolen, and can cause embarrassment if test emails are sent to real customers. - Faker (available for Python, JavaScript, Ruby, PHP, and Java) is the de facto standard. - Isolated fake data is insufficient. - Generate data at production scale to catch performance issues early: - Even fake data should be realistic enough to test privacy features: data export, deletion requests, and anonymization. ## Why Not Use Real Data Using production data in development environments violates privacy regulations (GDPR, CCPA), creates security risks if laptops are stolen, and can cause embarrassment if test emails are sent to real customers. Fake data eliminates all these risks. ## What to Generate | Data Type | Considerations | |-----------|---------------| | Names | Diverse: include various cultures and name lengths | | Emails | Use domains like @example.com (RFC 2606 reserved) | | Addresses | Realistic but non-existent (use valid formats) | | Phone numbers | Use +1-555-xxxx range (reserved for fiction) | | Dates | Cover edge cases: leap years, timezone boundaries | | Financial | Use test card numbers (Stripe: 4242..., PayPal sandbox) | ## Faker Library Faker (available for Python, JavaScript, Ruby, PHP, and Java) is the de facto standard. It generates locale-aware data for 50+ languages. Key providers: `name`, `address`, `company`, `text`, `internet`, `date_time`, `phone_number`. Seed the generator for reproducible output across runs. Same seed always produces the same sequence. ## Data Relationships Isolated fake data is insufficient. Real databases have relationships: users have orders, orders have products, products have categories. Generate data top-down: create categories first, then products referencing categories, then orders referencing products. ## Volume Testing Generate data at production scale to catch performance issues early: - 10,000+ users for pagination and search testing - 100,000+ records for query optimization - Large text blobs (10KB+) for storage and rendering testing ## Privacy Considerations Even fake data should be realistic enough to test privacy features: data export, deletion requests, and anonymization. Generate data that exercises these code paths. ### Best Practices for Handling Sensitive Data in the Browser Guidelines for safely processing passwords, keys, and personal data in client-side JavaScript. Covers memory handling, clipboard security, and preventing data leaks through browser APIs. - URL: https://peasysafe.com/guides/handling-sensitive-data-browser-best-practices/ - Category: Best Practice - Reading time: 1 min - Words: 264 Key takeaways: - Processing sensitive data in the browser eliminates server-side exposure but introduces unique challenges. - JavaScript does not offer direct memory management, but you can minimize exposure. - The Clipboard API is convenient for password tools but requires caution: - Never store passwords, encryption keys, or tokens in `localStorage` — it persists across sessions and is accessible to any JavaScript running on the same origin. - Browser extensions run with elevated privileges and can intercept any data on the page. ## The Client-Side Security Model Processing sensitive data in the browser eliminates server-side exposure but introduces unique challenges. JavaScript runs in a shared memory space, browser extensions can inject scripts, and APIs like clipboard and localStorage persist data beyond the session. Careful handling prevents accidental leaks. ## Memory Handling JavaScript does not offer direct memory management, but you can minimize exposure. Overwrite sensitive variables with empty strings or random data when no longer needed. Avoid storing secrets in global variables — use closures or WeakRefs to limit scope and enable garbage collection. Never log sensitive values to the console, even during development. ## Clipboard Security The Clipboard API is convenient for password tools but requires caution: - Clear the clipboard after a timeout (30-60 seconds) - Use `navigator.clipboard.writeText()` instead of `document.execCommand('copy')` - Warn users before copying sensitive data - Never read from the clipboard without explicit user action ## Storage Considerations Never store passwords, encryption keys, or tokens in `localStorage` — it persists across sessions and is accessible to any JavaScript running on the same origin. Use `sessionStorage` for temporary data that should not survive tab closure. For encryption keys that must persist, use the Web Crypto API's `CryptoKey` objects with `extractable: false` to prevent the key from being read by JavaScript. ## Extension and DevTools Risks Browser extensions run with elevated privileges and can intercept any data on the page. Advise users processing highly sensitive data to use a clean browser profile with no extensions installed. DevTools memory snapshots can also expose in-memory secrets — this is a known limitation of client-side processing. ### Security Headers: Why Your Website Needs Them and How to Fix Missing Ones Troubleshooting guide for common security header issues. Learn what each header does, how to test your site's header configuration, and how to fix missing or misconfigured security headers. - URL: https://peasysafe.com/guides/security-headers-fix-missing-guide/ - Category: Troubleshooting - Reading time: 1 min - Words: 259 Key takeaways: - HTTP security headers instruct browsers to enforce protection mechanisms that prevent common attacks — cross-site scripting (XSS), clickjacking, data injection, and protocol downgrade attacks. - Test your site at securityheaders.com or observatory.mozilla.org. - CSP blocks legitimate resources: Start with `Content-Security-Policy-Report-Only` to collect violations without breaking functionality. ## Why Security Headers Matter HTTP security headers instruct browsers to enforce protection mechanisms that prevent common attacks — cross-site scripting (XSS), clickjacking, data injection, and protocol downgrade attacks. Missing headers leave your site vulnerable to attacks that are trivially prevented by a few lines of server configuration. ## Essential Headers | Header | Purpose | Recommended Value | | --- | --- | --- | | Content-Security-Policy | Prevent XSS, injection | Restrict sources per type | | X-Content-Type-Options | Prevent MIME sniffing | `nosniff` | | X-Frame-Options | Prevent clickjacking | `DENY` or `SAMEORIGIN` | | Strict-Transport-Security | Force HTTPS | `max-age=63072000; includeSubDomains` | | Referrer-Policy | Control referrer leakage | `strict-origin-when-cross-origin` | | Permissions-Policy | Disable unused APIs | Disable camera, microphone, geolocation | ## Diagnosing Missing Headers Test your site at securityheaders.com or observatory.mozilla.org. Both provide letter grades and specific recommendations. You can also inspect headers directly with `curl -I https://yoursite.com` and check for the presence of each header listed above. ## Common Issues and Fixes **CSP blocks legitimate resources**: Start with `Content-Security-Policy-Report-Only` to collect violations without breaking functionality. Add approved sources incrementally until the policy is clean. **HSTS breaks HTTP development**: Only add HSTS in production. Use a short `max-age` initially (86400) and increase after confirming HTTPS works correctly. **X-Frame-Options conflicts with embeds**: If your site intentionally appears in iframes on specific partner sites, use CSP `frame-ancestors` instead — it supports multiple allowed origins. Use the Peasy security header analyzer to scan your site and get actionable recommendations for each missing or misconfigured header. ### Hash Generation and Verification: MD5, SHA, and Beyond Hash functions produce fixed-size fingerprints of data for integrity verification, password storage, and deduplication. This guide covers the most common algorithms and their appropriate uses. - URL: https://peasysafe.com/guides/hash-generation-verification-guide/ - Category: How-To - Reading time: 1 min - Words: 289 Key takeaways: - When downloading software, compare the published hash with the hash of your downloaded file. - macOS/Linux: `shasum -a 256 file.txt` - Important: Compare hashes in constant time to prevent timing attacks in security contexts. - If they match exactly, the file is unmodified Important: Compare hashes in constant time to prevent timing attacks in security contexts. ## Common Hash Algorithms | Algorithm | Output | Speed | Status | |-----------|--------|-------|--------| | MD5 | 128-bit (32 hex chars) | Very fast | Broken (do not use for security) | | SHA-1 | 160-bit (40 hex chars) | Fast | Deprecated (collision attacks exist) | | SHA-256 | 256-bit (64 hex chars) | Moderate | Secure (current standard) | | SHA-512 | 512-bit (128 hex chars) | Moderate | Secure (longer output) | | BLAKE3 | 256-bit (64 hex chars) | Very fast | Secure (newest) | ## When to Use Each ### File Integrity (Checksums) When downloading software, compare the published hash with the hash of your downloaded file. SHA-256 is the standard for this purpose. MD5 is still used for legacy compatibility but should not be relied upon for security. ### Content Deduplication Hash file contents to detect duplicates. If two files produce the same SHA-256 hash, they are identical (with overwhelming probability). This is how Git identifies unchanged files. ### Data Integrity in Transit HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to verify both integrity and authenticity of data in transit. APIs use HMAC-SHA256 for webhook signature verification. ## Generating Hashes ### Command Line - macOS/Linux: `shasum -a 256 file.txt` - Windows: `certutil -hashfile file.txt SHA256` ### In Code Every major language has a built-in library: `hashlib` (Python), `crypto` (Node.js), `MessageDigest` (Java), `sha2` crate (Rust). ## Verification Process 1. Obtain the expected hash from a trusted source 2. Compute the hash of the received file 3. Compare the two strings 4. If they match exactly, the file is unmodified **Important**: Compare hashes in constant time to prevent timing attacks in security contexts. Use `hmac.compare_digest()` in Python, not `==`. ### Image Metadata and EXIF Data: Reading, Editing, and Removing Every photo carries hidden metadata — camera settings, GPS coordinates, timestamps, and software information. Understanding how to read, edit, and strip this data is essential for privacy, SEO, and digital asset management. - URL: https://peasysafe.com/guides/image-metadata-exif-editing-guide/ - Category: How-To - Reading time: 2 min - Words: 339 Key takeaways: - EXIF (Exchangeable Image File Format) is a standard for storing metadata inside image files. - Photos taken at home embed your home address as GPS coordinates. - Remove EXIF data before sharing images publicly — especially GPS coordinates, timestamps, and device information. - Keep EXIF data when archiving photos for personal use, submitting to stock photography platforms (they use camera data for categorization), or maintaining a professional portfolio where camera settings demonstrate technical skill. - The best approach is often selective: remove GPS and personal data while preserving copyright notices and technical camera settings. ## What Is EXIF Data? EXIF (Exchangeable Image File Format) is a standard for storing metadata inside image files. When you take a photo with a smartphone or DSLR, the camera embeds dozens of data fields: shutter speed, aperture, ISO, focal length, date/time, GPS coordinates, camera make and model, and even the lens serial number. ## Common EXIF Fields | Field | Example Value | Privacy Risk | |-------|--------------|-------------| | GPS Latitude/Longitude | 37.7749, -122.4194 | High | | DateTime Original | 2026:03:10 14:30:00 | Medium | | Camera Make/Model | Apple iPhone 16 Pro | Low | | Software | Adobe Photoshop 2026 | Low | | Author/Copyright | John Doe Photography | Low | | Thumbnail | Embedded preview | Medium | ## Privacy Concerns ### GPS Data Risks Photos taken at home embed your home address as GPS coordinates. Sharing these photos on forums, marketplaces, or personal websites can inadvertently reveal your location. Most social media platforms strip EXIF data on upload, but direct file sharing (email, Slack, cloud storage links) preserves it. ### Embedded Thumbnails Some image editors update the main image but leave the original embedded thumbnail unchanged. If you crop a photo to remove sensitive content, the uncropped version may still be visible in the EXIF thumbnail. ## When to Strip EXIF Remove EXIF data before sharing images publicly — especially GPS coordinates, timestamps, and device information. Strip all metadata from images uploaded to websites to reduce file size (EXIF data can add 10-50 KB per image). ## When to Preserve EXIF Keep EXIF data when archiving photos for personal use, submitting to stock photography platforms (they use camera data for categorization), or maintaining a professional portfolio where camera settings demonstrate technical skill. Copyright and attribution fields should be preserved whenever possible. ## Selective … ### Random Name and Identity Generation for Testing Generating realistic fake identities for testing requires cultural diversity, consistent data relationships, and awareness of privacy regulations. - URL: https://peasysafe.com/guides/random-name-identity-generation/ - Category: How-To - Reading time: 1 min - Words: 289 Key takeaways: - Testing a user registration flow with 'Test User 1' and 'Test User 2' misses internationalization bugs, name-length edge cases, and cultural formatting differences. - A useful test identity includes coordinated data: - Create locale-specific identities with `Faker('ja_JP')` for Japanese, `Faker('de_DE')` for German, etc. - Single-character first or last names - Never use combinations that match real people. ## Why Realistic Identities Matter Testing a user registration flow with 'Test User 1' and 'Test User 2' misses internationalization bugs, name-length edge cases, and cultural formatting differences. Realistic test identities catch these issues early. ## Name Diversity Considerations | Culture | Name Pattern | Edge Case | |---------|-------------|----------| | Western | First Last | Very long names (>50 chars) | | Hispanic | First Paternal Maternal | Two last names | | Chinese | Family Given | Family name first | | Icelandic | Given Patronymic | No family name | | Mononymous | Single name | No last name at all | ## Consistent Identity Packages A useful test identity includes coordinated data: - Name matching the locale - Email based on the name - Phone number with country code - Address in the correct format for the locale - Date of birth producing a valid age - Username derived from the name ## Tools ### Faker (Python) Create locale-specific identities with `Faker('ja_JP')` for Japanese, `Faker('de_DE')` for German, etc. Each locale generates culturally appropriate names, addresses, and phone formats. ### RandomUser.me API A free API that returns complete random user profiles with photos, multiple nationalities, and consistent data relationships. Ideal for populating UI prototypes. ## Edge Cases to Generate - Single-character first or last names - Names with hyphens, apostrophes, and spaces (O'Brien, Mary-Jane, de la Cruz) - Very long names (test truncation and overflow) - Names with diacritics (Müller, Jiménez, Nguyễn) - Names in non-Latin scripts (Arabic, Chinese, Korean, Cyrillic) ## Privacy Warning Never use combinations that match real people. Some Faker outputs may accidentally generate a real name + real address combination. For published demos, use obviously fake names or append 'Test' to prevent confusion. ### Video Metadata and EXIF Data: What Your Files Contain Video files embed metadata about creation date, camera settings, GPS location, and encoding parameters. Understanding this data helps with organization, privacy, and troubleshooting. - URL: https://peasysafe.com/guides/video-metadata-exif-data-explained/ - Category: How-To - Reading time: 1 min - Words: 223 Key takeaways: - Stored in the file container (MP4, MOV, MKV). - Videos from smartphones contain GPS coordinates by default. - Phone videos often have a rotation tag (0, 90, 180, 270 degrees) instead of physically rotated pixels. - Critical for format compatibility troubleshooting. ## Types of Video Metadata ### Container Metadata Stored in the file container (MP4, MOV, MKV). Includes title, artist, creation date, and chapter markers. This is what media players and file managers display. ### Stream Metadata Technical properties of video/audio streams: codec, bitrate, resolution, frame rate, color space, and sample rate. Critical for format compatibility troubleshooting. ### EXIF Data Camera-specific metadata embedded during recording. Includes GPS coordinates, camera model, lens info, exposure settings, and orientation. ## Privacy Concerns Videos from smartphones contain GPS coordinates by default. Before sharing publicly: - Strip GPS metadata using a metadata editor - Check for embedded thumbnails (may show original uncropped frame) - Remove creation timestamps if timing is sensitive - Social platforms strip most metadata on upload, but direct file sharing does not ## Useful Metadata Fields | Field | Location | Use | |-------|----------|-----| | Duration | Container | Display/organization | | Resolution | Stream | Compatibility check | | Codec | Stream | Playback troubleshooting | | GPS | EXIF | Location tagging | | Creation Date | Container/EXIF | Sorting/archiving | | Rotation | Container | Orientation correction | ## Rotation Tag Phone videos often have a rotation tag (0, 90, 180, 270 degrees) instead of physically rotated pixels. Some players ignore this tag, causing sideways playback. Re-encoding with physical rotation fixes this permanently. ### JWT Token Generation and Structure Explained JSON Web Tokens (JWT) are the standard for stateless authentication. Understanding their structure, signing algorithms, and security considerations prevents common vulnerabilities. - URL: https://peasysafe.com/guides/jwt-token-generation-structure/ - Category: Comparison - Reading time: 1 min - Words: 264 Key takeaways: - A JWT consists of three Base64URL-encoded parts separated by dots: - Always validate the `exp` claim server-side - If the server accepts `alg: none`, an attacker can forge tokens without a signature. - Always whitelist accepted algorithms server-side. - Always transmit tokens in the Authorization header or HTTP-only cookies. ## JWT Structure A JWT consists of three Base64URL-encoded parts separated by dots: `header.payload.signature` ### Header ```json {"alg": "HS256", "typ": "JWT"} ``` Specifies the signing algorithm and token type. ### Payload (Claims) ```json { "sub": "1234567890", "name": "John Doe", "iat": 1741564800, "exp": 1741568400 } ``` Standard claims: `iss` (issuer), `sub` (subject), `exp` (expiration), `iat` (issued at), `aud` (audience), `nbf` (not before). ### Signature `HMAC-SHA256(base64(header) + '.' + base64(payload), secret)` ## Signing Algorithms | Algorithm | Type | Key | Use Case | |-----------|------|-----|----------| | HS256 | Symmetric | Shared secret | Single-server apps | | RS256 | Asymmetric | RSA key pair | Microservices, third-party verification | | ES256 | Asymmetric | ECDSA key pair | Mobile apps (smaller keys) | | none | No signature | — | NEVER use (vulnerability) | ## Security Best Practices - Always validate the `exp` claim server-side - Use short expiration times (15 minutes for access tokens) - Use refresh tokens for re-authentication - Never store sensitive data in the payload (it is only Base64 encoded, not encrypted) - Reject tokens with `alg: none` - Validate the `iss` and `aud` claims ## Common Vulnerabilities ### Algorithm Confusion If the server accepts `alg: none`, an attacker can forge tokens without a signature. Always whitelist accepted algorithms server-side. ### Excessive Token Lifetime Long-lived tokens (hours or days) give attackers a wide window if stolen. Use short-lived access tokens + refresh token rotation. ### Token in URL Parameters JWTs in URLs appear in server logs, browser history, and Referer headers. Always transmit tokens in the Authorization header or HTTP-only cookies. ## Glossary (45 terms) ### 2FA (Two-Factor Authentication) A security process requiring two distinct forms of identification — typically a password and a code from a separate device. - URL: https://peasysafe.com/glossary/2fa/ ### AES (Advanced Encryption Standard) A symmetric block cipher used worldwide for encrypting sensitive data, with key sizes of 128, 192, or 256 bits. - URL: https://peasysafe.com/glossary/aes/ ### Argon2 (Argon2 Key Derivation Function) The winner of the Password Hashing Competition, designed to be memory-hard and resistant to GPU cracking attacks. - URL: https://peasysafe.com/glossary/argon2/ ### Certificate Pinning (TLS Certificate Pinning) A technique that associates a host with its expected certificate, preventing man-in-the-middle attacks with forged certificates. - URL: https://peasysafe.com/glossary/certificate-pinning/ ### Checksum (File Checksum) A value computed from file data used to verify that the file hasn't been altered or corrupted. - URL: https://peasysafe.com/glossary/checksum/ ### Clickjacking (UI Redress Attack) An attack that tricks users into clicking hidden elements by overlaying invisible frames on top of legitimate page content. - URL: https://peasysafe.com/glossary/clickjacking/ ### Command Injection (OS Command Injection) An attack passing arbitrary operating system commands through a vulnerable application to the host system. - URL: https://peasysafe.com/glossary/command-injection/ ### CORS Misconfiguration (CORS Security Misconfiguration) Overly permissive CORS headers allowing unauthorized origins to read sensitive API responses in the browser. - URL: https://peasysafe.com/glossary/cors-misconfiguration/ ### CSRF (Cross-Site Request Forgery) An attack tricking an authenticated user into submitting unintended requests to a web application. - URL: https://peasysafe.com/glossary/csrf/ ### CVE (Common Vulnerabilities and Exposures) A standardized catalog of publicly known security vulnerabilities, each assigned a unique CVE-YYYY-NNNNN identifier. - URL: https://peasysafe.com/glossary/cve/ ### DDoS (Distributed Denial of Service) An attack that overwhelms a server or network with traffic from many distributed sources, making it unavailable to legitimate users. - URL: https://peasysafe.com/glossary/ddos/ ### Defense in Depth (Defense in Depth Strategy) A security approach using multiple layers of protection so that if one layer fails, others still provide defense. - URL: https://peasysafe.com/glossary/defense-in-depth/ ### E2EE (End-to-End Encryption) A communication system where only the sender and recipient can read messages, with encryption keys never accessible to intermediary servers. - URL: https://peasysafe.com/glossary/e2ee/ ### Entropy (Password Entropy) A measure of randomness or unpredictability in a password, expressed in bits, indicating resistance to guessing. - URL: https://peasysafe.com/glossary/entropy/ ### FIDO2 (Fast Identity Online 2) An authentication standard enabling passwordless login through hardware security keys or biometrics using public key cryptography. - URL: https://peasysafe.com/glossary/fido2/ ### HMAC (Hash-based Message Authentication Code) A mechanism combining a cryptographic hash with a secret key to verify data integrity and authenticity. - URL: https://peasysafe.com/glossary/hmac/ ### HSTS (HTTP Strict Transport Security) An HTTP header instructing browsers to only connect via HTTPS, preventing protocol downgrade attacks. - URL: https://peasysafe.com/glossary/hsts/ ### Insecure Deserialization (Insecure Deserialization) A vulnerability where untrusted data is deserialized without validation, potentially enabling remote code execution. - URL: https://peasysafe.com/glossary/insecure-deserialization/ ### Key Derivation (Key Derivation Function) A function that derives one or more secret keys from a password or passphrase using a pseudorandom function. - URL: https://peasysafe.com/glossary/key-derivation/ ### Nonce (Number Used Once) A random or sequential value used exactly once in cryptographic operations to prevent replay attacks and ensure message freshness. - URL: https://peasysafe.com/glossary/nonce/ ### OWASP Top 10 (OWASP Top Ten Web Risks) A regularly updated list of the ten most critical web application security risks, published by the Open Web Application Security Project. - URL: https://peasysafe.com/glossary/owasp-top-10/ ### Password Hashing (Password Hashing) Converting passwords into fixed-length hashes using algorithms like bcrypt or Argon2 for secure storage. - URL: https://peasysafe.com/glossary/password-hashing/ ### Path Traversal (Directory Traversal Attack) Exploiting insufficient input validation to access files outside the intended directory using ../ sequences. - URL: https://peasysafe.com/glossary/path-traversal/ ### Penetration Testing (Penetration Testing (Pentest)) Simulating real-world attacks against a system to identify security vulnerabilities before malicious actors do. - URL: https://peasysafe.com/glossary/penetration-testing/ ### PGP (Pretty Good Privacy) An encryption program providing cryptographic privacy and authentication for data communication. - URL: https://peasysafe.com/glossary/pgp/ ### PKI (Public Key Infrastructure) A framework of certificate authorities, digital certificates, and key pairs that enables secure encrypted communication and identity verification. - URL: https://peasysafe.com/glossary/pki/ ### Public Key (Public Key Cryptography) A cryptographic system using paired keys where the public key encrypts and only the private key can decrypt. - URL: https://peasysafe.com/glossary/public-key/ ### QR Code (Quick Response Code) A two-dimensional barcode that stores data (URLs, text, contact info) readable by cameras and scanners. - URL: https://peasysafe.com/glossary/qr-code/ ### RBAC (Role-Based Access Control) An authorization model that assigns permissions to roles rather than individual users, simplifying access management at scale. - URL: https://peasysafe.com/glossary/rbac/ ### RSA (Rivest-Shamir-Adleman) An asymmetric cryptographic algorithm using public/private key pairs for encryption and digital signatures. - URL: https://peasysafe.com/glossary/rsa/ ### Salt (Cryptographic Salt) Random data added to a password before hashing to ensure identical passwords produce different hashes. - URL: https://peasysafe.com/glossary/salt/ ### Sandbox (Security Sandbox) An isolated execution environment that restricts a program's access to system resources, limiting the impact of malicious code. - URL: https://peasysafe.com/glossary/sandbox/ ### Sensitive Data Exposure (Sensitive Data Exposure) A vulnerability where applications fail to adequately protect sensitive data like passwords, tokens, or PII in transit or at rest. - URL: https://peasysafe.com/glossary/sensitive-data-exposure/ ### SHA-256 (Secure Hash Algorithm 256-bit) A cryptographic hash function producing a 256-bit digest, widely used for data integrity verification. - URL: https://peasysafe.com/glossary/sha-256/ ### SQL Injection (SQL Injection Attack) Inserting malicious SQL code into application queries to access, modify, or delete database data. - URL: https://peasysafe.com/glossary/sql-injection/ ### SRI (Subresource Integrity) An HTML attribute providing a cryptographic hash to verify that fetched resources have not been tampered with. - URL: https://peasysafe.com/glossary/sri/ ### SSL/TLS (Secure Sockets Layer / Transport Layer Security) Cryptographic protocols providing secure communication over networks, used for HTTPS. - URL: https://peasysafe.com/glossary/ssltls/ ### SSRF (Server-Side Request Forgery) An attack making the server send requests to unintended internal or external resources on behalf of the attacker. - URL: https://peasysafe.com/glossary/ssrf/ ### Steganography (Digital Steganography) The practice of hiding secret data within ordinary files (images, audio) without visible change. - URL: https://peasysafe.com/glossary/steganography/ ### Threat Modeling (Security Threat Modeling) A structured process for identifying potential threats, attack vectors, and mitigations during system design. - URL: https://peasysafe.com/glossary/threat-modeling/ ### TOTP (Time-based One-Time Password) A temporary passcode generated from a shared secret and the current time, used in two-factor authentication. - URL: https://peasysafe.com/glossary/totp/ ### WAF (Web Application Firewall) A security layer that filters HTTP traffic between a web application and the internet, blocking common attacks like SQL injection and XSS. - URL: https://peasysafe.com/glossary/waf/ ### XSS (Cross-Site Scripting) An attack injecting malicious scripts into web pages viewed by other users, stealing data or session tokens. - URL: https://peasysafe.com/glossary/xss/ ### XXE (XML External Entity Attack) An attack exploiting XML parsers to access local files, perform SSRF, or cause denial of service via entity expansion. - URL: https://peasysafe.com/glossary/xxe/ ### Zero-Day (Zero-Day Vulnerability) A software vulnerability unknown to the vendor and without a patch, actively exploited before a fix is available. - URL: https://peasysafe.com/glossary/zero-day/ ## API Base URL: https://peasysafe.com/api/v1/ | Endpoint | Description | |----------|-------------| | GET /api/v1/tools/ | List all tools (filterable by category) | | GET /api/v1/tools/{slug}/ | Tool detail with description, steps, FAQ | | GET /api/v1/categories/ | Tool categories | | GET /api/v1/formats/ | File formats reference | | GET /api/v1/formats/{slug}/ | Format detail with history, pros/cons | | GET /api/v1/conversions/ | Format conversion guides | | GET /api/v1/glossary/ | Terminology with definitions | | GET /api/v1/glossary/{slug}/ | Term with simple + technical explanations, code examples, references | | GET /api/v1/guides/ | Educational guides (filterable by category, audience_level) | | GET /api/v1/guides/{slug}/ | Full guide with content, takeaways, ToC, related guides | | GET /api/v1/use-cases/ | Real-world use cases by industry | | GET /api/v1/search/?q={query} | Cross-model search | | GET /api/v1/sites/ | All 16 Peasy sites | OpenAPI spec: https://peasysafe.com/api/openapi.json ## Content Negotiation All pages support Markdown output for AI agents: - Add `?format=md` to any page URL - Or send `Accept: text/markdown` header ## Platform Stats - 251 tools across 16 sites - 131 file formats documented - 1484 format conversion guides - 695 glossary terms (with simple + technical explanations) - 645 educational guides (avg 1,308 words) - 302 real-world use cases