Web Security Essentials for Developers

Most security bugs aren't exotic — they come from a handful of fundamentals done wrong: passwords stored badly, tokens trusted blindly, secrets sent in the clear. This guide walks the essentials so you know what "doing it right" looks like, and where to go deeper.

Prefer a focused read? Jump to How JWT Authentication Works for tokens, How to Store Passwords Securely for password storage, or Encoding vs Encryption vs Hashing for the concepts underneath.

Authentication: proving who you are

After a user logs in, the server needs to recognize them on later requests. Two broad approaches: sessions (the server stores session state and hands out an ID) and tokens (the server hands out a signed token the client sends back, and verifies it without storing state). JSON Web Tokens are the common token format — see How JWT Authentication Works.

The key security rule for any token: verify it on every request (check the signature and expiry), send it only over HTTPS, and never put secrets in a JWT payload — it's readable by anyone holding the token.

Storing passwords

Never store passwords as plaintext, and never encrypt them — encryption is reversible, which is exactly what you don't want. Instead, store a salted hash from a slow algorithm (bcrypt, scrypt, or Argon2). On login you hash the attempt and compare. Full details in How to Store Passwords Securely.

Transport security: HTTPS everywhere

HTTPS wraps HTTP in TLS so data can't be read or tampered with in transit. Without it, tokens, passwords, and cookies travel in the clear over the network. There's no real reason not to use HTTPS everywhere today — treat plain HTTP as "anyone on the path can read this."

Encoding is not security

A recurring source of bugs: treating Base64 as if it hides data. It doesn't — anyone can decode it. Encoding is for compatibility, encryption is for secrecy, and hashing is for verification. If you only remember one thing here, make it that distinction — spelled out in Encoding vs Encryption vs Hashing.

A word on the usual risks

Beyond these fundamentals, most breaches trace back to a short list worth knowing: injection (validate and parameterize inputs), cross-site scripting (escape output), leaked secrets (keep keys out of source control), and missing authorization checks. Awareness of the categories is half the battle.

Inspect a token with the JWT Decoder, generate a strong secret with the Password Generator, or compute a digest with the Hash Generator — all client-side, nothing uploaded.

Try it

Paste a JWT into the decoder to see its header, payload, and claims — a hands-on way to see why a token's contents are readable, not secret.