Your Google Authenticator export QR code is not encrypted
The "Transfer accounts" QR is base64 protobuf — every 2FA seed in plain sight. Here is the format, the risk, and a browser-only decoder that reads it.
Tag
crypto
6posts
The real risk of online JWT decoders that log your secrets
A remote JWT decoder does not need to be malicious to leak your token. Here is what its log pipeline captures, what an attacker does with it, and how to test for it.
JWT vs OAuth2 tokens: why claims matter for backend security
OAuth2 is a flow, JWT is a format — and neither one authorises anything. The claims your backend verifies and validates are what actually decide access.
How to spot a misconfigured RS256 signature before deployment
RS256 fails quietly — the happy path verifies while the key, the PEM format or the algorithm allowlist is wrong. Here is how to catch it before it ships.
The KitBoxDev privacy-first manifesto: local processing, zero egress
Data-egress policy made third-party utility sites a compliance problem. Our answer is architectural — every tool runs in your browser, so credentials never leave the machine.
How to Use Browser-Private Tools for Cron, CIDR, YAML, JWT and Kubernetes
A step-by-step DevOps workflow built on client-side-only tools — cron parsing, CIDR maths, YAML and .env conversion, JWT debugging and Kubernetes resources.