Most security advice is either fear-mongering or jargon. The useful middle ground is a clear threat model: what are you actually protecting, from whom, and which boringly-effective habit closes the gap. This hub takes the four threats that touch normal people most — weak or reused passwords, files that leak hidden metadata, encryption people don't trust because they don't understand it, and phishing that now arrives as a QR square — and explains each in plain language.
Every tool here runs in your browser, which is itself a security property: a password minted locally, or a file encrypted in your tab, never passes through a server that could log it.
Passwords and encryption, understood
The two foundations are choosing secrets and protecting data. Password security in 2026 explains why length beats complexity and why reuse — not weakness — is the real risk, and the password generator mints uniques from the browser's CSPRNG. When you need a file itself to be unreadable without a key, how AES-GCM encryption works demystifies authenticated encryption, and AES Encryption applies it locally.
The leaks you don't see coming
- Metadata — documents and photos carry author names, GPS coordinates, device models and edit history. Privacy-cleaning a file before you share it shows what to strip, using Remove EXIF for images.
- Phishing by QR code ('quishing') — a square hides its destination from human eyes. The QR Code Inspector decodes and risk-checks one before you ever point a phone at it.
- Tokens that are readable by anyone — a JWT is encoded, not encrypted. JWTs explained covers what's safe to put in one (and what never is).
Guides in this hub
Privacy
Password security in 2026 — what actually matters and what's mostly theatre
10 min read
Developer
AES-256-GCM encryption explained — what GCM mode actually buys you
11 min read
Privacy
How to privacy-clean a file before you share it
5 min read
Developer
JWT explained — anatomy, security pitfalls, and what to check in a token
11 min read
Tools to put it into practice
Cryptographically-strong passwords + strength checker.
Encrypt and decrypt text with AES-256-GCM. Passphrase only.
Scan a QR image and analyse its payload for phishing red flags — Punycode, shorteners, mixed scripts.
Strip camera, GPS and other metadata from photos before sharing.
Decode any JSON Web Token, inspect header, payload, expiry.
Frequently asked questions
What actually makes a password strong?
Length and uniqueness, not a zoo of symbols. A long random password (or passphrase) you've never used anywhere else beats a short 'complex' one that's reused across sites.
Is browser-based encryption safe?
The cryptography is the same AES-GCM your bank uses — the difference is where it runs. Doing it in your tab means the plaintext and the key never reach a server, which removes an entire class of risk that upload-based tools carry.
What's the most overlooked privacy leak?
Metadata. People redact the visible content of a file and forget the invisible author, GPS and timestamp fields riding along inside it. Stripping metadata before sharing is the habit most people skip.