DEV Community: Andres Fernandez

Cryptography for developers

Andres Fernandez — Wed, 29 Oct 2025 22:27:22 +0000

🔐 The Invisible Backbone of the Digital World

I’d dare to say that cryptography is the backbone of the digital era. Without it, the Internet would be a chaotic and insecure place. Thanks to the relentless work of scientists, mathematicians, and engineers who have perfected the cryptographic algorithms we use today, it’s possible to transfer money, protect conversations, authenticate identities, and ensure privacy in every corner of our connected world.

Without cryptography, there would be no secure banking transactions, no blockchain, and no trust in digital communication. Every message, every payment, and every login would be a risk. In short, cryptography doesn’t just protect data — it protects our very way of life in the 21st century.

As developers, we constantly interact with cryptographic systems — even if we don’t realize it. Every time we call an API over HTTPS, hash a password, or sign a JWT, we’re relying on cryptographic guarantees. Understanding how these mechanisms work helps us build safer, more reliable applications — and avoid dangerous mistakes that attackers can exploit.

🔑 Key Concepts Every Developer Should Know

Before diving deeper into cryptography, it’s essential to understand a few core concepts that form its foundation:

Hashing

A one-way transformation of data used mainly for password storage and integrity checks. Once data is hashed, it cannot be reversed.

Encryption

The process of protecting information using a key, so that only authorized parties can read it. It’s what keeps HTTPS and encrypted files secure.

Symmetric Keys

Systems where the same key is used to encrypt and decrypt data. A common example is the AES algorithm.

Asymmetric Keys

Involve a pair of keys — one public and one private — used for encryption, decryption, and digital signatures. RSA and ECC are classic examples.

Digital Signatures

Allow verification of authenticity and data integrity. They’re widely used in JWTs, API authentication, and blockchain transactions.

Certificates (PKI)

Part of the Public Key Infrastructure, certificates ensure identity verification and trust online — for example, in TLS/SSL connections.

⚠️ Common Mistakes Developers Make with Cryptography

Even experienced developers can fall into subtle security traps. Avoiding these mistakes will save you from serious vulnerabilities later on:

Rolling your own encryption algorithm

(“Never roll your own crypto.”) Cryptography is complex — use well-established, peer-reviewed libraries instead.

Storing passwords without hashing or using weak algorithms like MD5

Always hash passwords using modern algorithms such as bcrypt, scrypt, or Argon2.

Skipping signature validation in tokens

Never trust unsigned or unchecked JWTs. Always verify their signatures before accepting user data or access claims.

Hardcoding symmetric keys in source code

Keep secrets out of your repository. Use environment variables or secret managers instead.

🚀 Final Thoughts & Call to Action

Cryptography isn’t just for mathematicians — it’s a toolkit every modern developer should master.

From securing APIs to verifying identities and ensuring data integrity, cryptography defines how we build trust online.

In the next articles, we’ll explore how to apply cryptographic principles in real-world Node.js and Rust applications, and how to avoid the pitfalls that can silently compromise your security.

🗺️ What’s Next: Upcoming Topics in This Series

Here’s a sneak peek of what’s coming next:

🔹 Understanding Hash Functions — SHA-256, bcrypt, Argon2
🔹 Encryption in Node.js — symmetric & asymmetric keys
🔹 JWTs, Signatures, and Verifying Trust
🔹 TLS, HTTPS, and Real-World Data Protection
🔹 Building Secure APIs Using Modern Cryptography

Stay tuned — this is just the beginning of mastering the invisible backbone of the digital world.

A Guide to JWTs: Signing with RS256 Made Simple.

Andres Fernandez — Wed, 24 Jul 2024 16:11:11 +0000

Introduction.

In our previous guide JWT for Developers: Behind the Scenes, we talked about JWTs signed with HMAC using SHA256. This time, we'll focus on the RS256 algorithm, which uses the PKCS#1 RSASSA v1.5 specification with SHA256. Don't worry about these complicated names; just remember it's called RS256 😌.

What is RS256 🔒?

RS256 is a digital signature algorithm that uses public key cryptography. This algorithm is part of the RSA family and uses SHA-256 as hash function. In practice, RS256 generates a pair of keys: one public and one private. Here is a breakdown of how it works:

Private Key: The private key is used to create and sign messages. Only the owner of the private key can generate valid signatures for messages.

A private key in format PEM looks like this 🔑:

Public Key: The public key is freely distributable and is used exclusively to verify the authenticity of messages signed with the private key. This ensures that anyone in possession of the public key can confirm that a message was signed by the owner of the private key, thus guaranteeing its integrity and authenticity.

A public keyin format PEM looks like this 🔑:

Use case 🧰.

There are many use cases for public key signing, but we will focus on the case of OAuth2.0 with an Azure AD server. When the server issues an access token, it also provides a public URL with the public key. This allows us to validate the token's authenticity in our resources.

The private key must be stored very carefully to avoid exposure.

In our case, we saw how a developer tried to modify the token's content but failed the verification check.

Other developers enjoy a stress-free life by using the public key solely to verify the authenticity of the token received from Azure.

Benefits ✅.

This approach is fantastic because it allows us to validate tokens, but not create them on behalf of the Azure server. If a malicious actor tried to alter our token while it is in transit, we could immediately detect and verify that the token has been tampered with and reject it.

Take a Moment to Read the Above Section ☕.

If you've made it this far, you're ready to create your own token signing system using a public key algorithm. I hope you're excited 🙋🏻!

Let's Get Started

First things first: we're going to use Node.js's native crypto module. If you're familiar with other programming languages, feel free to use their native cryptography modules; they probably have one.

Generate RSA Keys: We use generateKeyPairSync to generate an RSA key pair. The private key is encrypted with a passphrase for secure storage.

const { generateKeyPairSync, createSign, createVerify } = require('crypto');

// 1. Generate Keys RSA
const { publicKey, privateKey } = generateKeyPairSync('rsa', {
  modulusLength: 2048, // key Size
  publicKeyEncoding: {
    type: 'spki',
    format: 'pem'
  },
  privateKeyEncoding: {
    type: 'pkcs8',
    format: 'pem',
    cipher: 'aes-256-cbc',
    passphrase: 'top secret'
  }
});

Creating our funtion to make signed tokens

function createToken(payload, privateKey) {
  const header = {
    alg: 'RS256',
    typ: 'JWT'
  };

  const encodedHeader = Buffer.from(JSON.stringify(header)).toString('base64').replace(/=/g, '');
  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64').replace(/=/g, '');

  const token = `${encodedHeader}.${encodedPayload}`;

  const sign = createSign('RSA-SHA256');
  sign.update(token);
  sign.end();

  const signature = sign.sign(privateKey, 'base64').replace(/=/g, '');

  return `${token}.${signature}`;
}

Now we will verify the tokens signed by us.

function verifyToken(token, publicKey) {
  const [encodedHeader, encodedPayload, signature] = token.split('.');

  const verify = createVerify('RSA-SHA256');
  verify.update(`${encodedHeader}.${encodedPayload}`);
  verify.end();

  const isValid = verify.verify(publicKey, signature, 'base64');

  if (isValid) {
    const payload = JSON.parse(Buffer.from(encodedPayload, 'base64').toString('utf8'));
    return payload;
  } else {
    throw new Error('Token verification failed');
  }
}

Remember, security is a journey, not a destination. There is always more to learn and new techniques to explore.

Thank you for following along. Happy coding, and keep learning! Your journey in the fascinating world of cryptography has just begun. 🚀

JWT for Developers: Behind the Scenes.

Andres Fernandez — Wed, 03 Jul 2024 03:58:03 +0000

90% of developers just use the jsonwebtoken library without really understanding what’s happening behind the scenes. Be part of the percentage that does. Grab a coffee and enjoy the learning journey ☕🤯.

Technical definition JWT:

The Internet Engineering Task Force (IETF) is a globally recognized organization responsible for the creation and promotion of internet standards. In its document RFC 7519, the IETF defines JWT (JSON Web Tokens) as:

"A compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted."

Up to this point, we know the basics of JWTs ✅:

A JWT consists of three parts:

Header.
Payload.
Signature.

Library Trust: We trust that the jsonwebtoken library works well to keep our app secure.

Format: flow to get a JWT looks something like this:

Uses of JWTs 🦾

JWTs signed with an algorithm and a secret key are known as JWS (JSON Web Signature). You have probably encountered them, and their use goes beyond merely assigning permissions for applications to access certain resources. Some of their most common uses include:

Authentication: Verifying the identity of a user.

Authorization: Granting or denying access to resources.

Federated Identity: Allowing multiple systems to share identity information.

Client-Side Sessions: Storing session information on the client side.

Client-Side Secrets: Keeping secrets on the client side without server storage.

Let's emphasize authorization. After the proper validation of a user's authentication, we need to assign a ticket for them to access certain protected resources of our applications.

JWT breakdown (Signed with SHA256 algorithm)

We are going to focus on creating a signed JWT (JSON Web Token), commonly known as a JWT with a Signature, to establish secure communication between two parties that can validate its authenticity. There are two types of signed JWTs: the first is signed using the SHA algorithm, and the second is signed using the RSA algorithm (the latter will be covered in another guide).

Let's start building our JWT (Signature). We need a few things first.

Function to convert JWT parts to Base64URL format ✔️.
Secret Key ✔️.
We use the native Node.js crypto module to sign it ✔️.

Why use Base64-URL?

This process ensures that the result is a valid text in URLs.

Convert binary data to Base64, Modify Special Characters, Replace + with -,Replace / with _, Remove any padding characters (=).

const crypto = require("crypto");

function base64urlEncode(data: string) {
  return Buffer.from(data)
    .toString("base64")
    .replace(/=/g, "")
    .replace(/\+/g, "-")
    .replace(/\//g, "_");
}
}

Generate Secret Key 🔑

Now we will create our Secret Key, this must be stored securely, it is used to validate the signature, not to share. Avoid choosing short or obvious combinations. It is recommended to generate secure bytes like this one:

const crypto = require('crypto');

// Generate a 256-bit (32-character) secret key
const secretKey = crypto.randomBytes(32).toString('hex');

Signature 🔏.

In this section, we explore the backbone of cybersecurity: cryptography!

The standard recommends using the HMAC function with SHA-256, known as HS256 in the JWA spec.

It also recommends RSA for tokens signed with private keys, a topic we will cover in another guide:

HMAC (Hash-based Message Authentication Code).

HMAC in Node.js uses a secret key and a hash function to create a unique code (MAC) that verifies the integrity and authenticity of a message. Here's a simplified explanation of what happens behind the scenes:

Combine Key and Message: The secret key and the message are combined in a specific way.
Apply Hash Function: This combination is then passed through a hash function (like SHA-256) twice.
Generate Code: The result is a fixed-size code that is unique to the given message and key.

This code ensures that the message cannot be altered by a cybercriminal without invalidating the signature. If even a single bit in the message changes, the HMAC code will be different, indicating unauthorized tampering. In this way, HMAC protects against malicious modification attempts.

Function to create Signature 🛡️.


const crypto = require('crypto');


function createSignature(
  encodedHeader: string,
  encodedPayload: string,
  secret: string
) {
  const data = `${encodedHeader}.${encodedPayload}`;
  return crypto.createHmac("sha256", secret).update(data).digest("base64url");
}

Graphical example of signature creation 🎨 🖌️.

Completed example

Here we have our completed example. As you can see, we can create our own token signing system. This is how libraries that use the JWT standard function. I encourage you to experiment with Node.js's Crypto module and implement your own solution.


const header = {
  alg: "HS256",
  typ: "JWT",
};

const payload = {
  sub: "1234567890",
  name: "John Doe",
  iat: Math.floor(Date.now() / 1000),
};

const encodedHeader = base64urlEncode(JSON.stringify(header));
const encodedPayload = base64urlEncode(JSON.stringify(payload));

const secret = "your-256-bit-secret";

function createSignature(
  encodedHeader: string,
  encodedPayload: string,
  secret: string
) {
  const data = `${encodedHeader}.${encodedPayload}`;
  return crypto.createHmac("sha256", secret).update(data).digest("base64url");
}

const signature = createSignature(encodedHeader, encodedPayload, secret);

const jwt = `${encodedHeader}.${encodedPayload}.${signature}`;

Resume

The token signature is the result of passing the header, payload, and a secret through a hash function, obtaining a fixed value. This value acts as an impenetrable barrier for cybercriminals, ensuring that the data has not been modified and maintaining the integrity and authenticity of the information.

JWT(Signature)	value
Integrity	✅
Authenticity	✅
Privacity	❌

Remember 📌.

Not to include sensitive information in the payload of your JWTs, as they are only encoded, not encrypted. The JWT signature ensures the integrity and authenticity of the token but does not guarantee the privacy of the data.

Upcoming guides:

Best practices for creating your JWTs.
Validate JWTs like a pro.
Know the main attacks and common failures when implementing JWTs.