From SQL injection audits to WireGuard VPN infrastructure and hardened Linux servers — I close the gaps before anyone finds them.
Anyone who promises unbreakable security is selling something. Real security is defense-in-depth: assume breach, make every layer expensive to get through, and shrink the blast radius when something slips.
Everything below is real and runs locally on your device — genuine cryptography via the Web Crypto API, real attack payloads neutralised in front of you. Nothing is sent anywhere.
Type a password — see its entropy, character set, and a real estimate of how long it'd take to crack offline. (It never leaves this page.)
showReal AES‑GCM encryption and SHA‑256 hashing in your browser. I store hashes, never plaintext — and encrypt data in transit and at rest.
Throw a real attack payload at it. Watch the naive version get exploited, and the hardened version shut it down — side by side.
A real RFC‑6238 authenticator code, generated in your browser from a shared secret and the current time — exactly like Google Authenticator. Refreshes every 30 seconds.
The industry-standard list of what actually breaks web apps. Click any to see the risk and exactly how I defend against it.
Building something that handles real users or real money? Let's harden it — audit, fix, and keep it patched with the newest methods.