DEV Community: Omulo Samuel Okoth

Simple Website with SvelteKit

Omulo Samuel Okoth — Fri, 13 Jun 2025 13:04:47 +0000

Are you looking to build a fast, lightweight, and modern personal website with minimal setup? SvelteKit offers a refreshing developer experience and excellent performance out of the box.

Svelte is a JavaScript framework for building user interfaces. Unlike traditional frameworks, it shifts most of the work to compile time, producing highly optimized JavaScript that runs in the browser without using a virtual DOM. You write components using a clean, reactive syntax, and Svelte compiles them into efficient, minimal JavaScript.

SvelteKit, on the other hand, is a full-stack application framework built on top of Svelte. It provides everything needed to build production-grade web apps including routing, server-side rendering (SSR), API endpoints, data loading, and deployment tools. While Svelte handles the UI components, SvelteKit manages the entire app structure and runtime behavior.

This guide walks you through creating a very simple SvelteKit site from setup to deployment preview.

Project Goal

Create a basic personal site with the following:

Home page

About page

Contact form (no backend, just an alert message)

Simple layout and navigation

Step 1: Prerequisites

Before starting, ensure you have the following installed on your system:
Install Node.js (version 18 or newer is recommended)

To check your version:

node -v

If not installed, you can install it using your package manager or via nvm:

Using apt (Ubuntu)

sudo apt install nodejs npm

using nvm (recommended)

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
source ~/.bashrc
nvm install 18

Step 2: Create a SvelteKit Project

Run the following command to create a new SvelteKit project where simpleesvelt is the name of the website:

$ npx sv create simpleesvelt

Then follow the guideline bellow:

┌  Welcome to the Svelte CLI! (v0.8.10)
│
◇  Which template would you like?
│  ❯ SvelteKit minimal       ← (Select this)
│    SvelteKit demo
│    SvelteKit skeleton
│    Vanilla JS
│
◇  Add type checking with TypeScript?
│  ❯ Yes, using JavaScript with JSDoc comments   ← (Select this)
│    Yes, using TypeScript syntax
│    No
│
◆  Project created
│
◇  What would you like to add to your project? (use arrow keys / space bar)
│  ◉ none    ← (Make sure none is selected, press Enter)
│  ◯ ESLint
│  ◯ Prettier
│  ◯ Playwright
│  ◯ Vitest
│
◇  Which package manager do you want to install dependencies with?
│  ❯ npm     ← (Select this or your preferred one)
│    yarn
│    pnpm
│
◇  Installing dependencies with npm...

Step 3: Project Structure Overview

Add src/routes/about/+page.svelte, src/routes/+layout.svelte and src/routes/contact/+page.svelte pages.
Here is how you file structure should look like:

simpleesvelt/
├── src/
│   ├── app.css                  # Global CSS file
│   ├── app.html                 #  HTML shell (defines <head>, links to app.css)
│   ├── routes/
│   │   ├── +layout.svelte       #  Shared layout for nav and page slot
│   │   ├── +page.svelte         #  Home page
│   │   ├── about/
│   │   │   └── +page.svelte     #  About page
│   │   └── contact/
│   │       └── +page.svelte     #  Contact page
├── static/                      #  Public assets like favicon.png
├── svelte.config.js
├── vite.config.js
├── package.json
└── ...

Step 4: Install Dependencies

Navigate into the project directory and install the required dependencies:

cd simpleesvelt
npm install

Step 5: Build Pages
Home Page – src/routes/+page.svelte

<script>
  import { onMount } from 'svelte';
</script>

<h1>Welcome to My Simple Svelte Site</h1>
<p>This is the home page.</p>

<nav>
  <a href="/about">About</a> |
  <a href="/contact">Contact</a>
</nav>

About Page – src/routes/about/+page.svelte

<h3>About Me</h3>
<p>I'm learning Svelte and loving it!</p>

<a href="/">Back to Home</a>

Contact Page – src/routes/contact/+page.svelte

<script>
  let name = '';
  let message = '';

  const submitForm = () => {
    alert(`Thank you, ${name}! We'll respond soon.`);
    name = '';
    message = '';
  };
</script>

<h3>Contact Me</h3>
<script>
  let name = '';
  let message = '';

  function submitForm() {
    alert(`Thank you, ${name}! Your message has been received:\n\n"${message}"`);

    // Reset form (optional)
    name = '';
    message = '';
  }
</script>

<h1>Contact Us</h1>

<form on:submit|preventDefault={submitForm}>
  <label>
    Name:
    <input bind:value={name} required />
  </label>
  <br />

  <label>
    Message:
    <textarea bind:value={message} required></textarea>
  </label>
  <br />

  <button type="submit">Send</button>
</form>

Step 6: Add Basic Styling

Create a new file at src/app.css and add the following:

body {
    font-family: sans-serif;
    background: #f4f4f4;
    color: #333;
    margin: 0;
    padding: 2rem;
    display: flex;
    flex-direction: column;
    align-items: center;  /* horizontally centers content */
  }


  nav a {
    -ms-flex-item-align: center;
    margin-right: 1rem;
    text-decoration: none;
    color: #0070f3;
  }

Import this CSS file in src/routes/+layout.svelte:

<script>
  import '../app.css';
</script>

<nav>
  <a href="/">Home</a>
  <a href="/about">About</a>
  <a href="/contact">Contact</a>
</nav>

<slot />

Step 7: Build and Preview for Production

Once you are ready to prepare your site for deployment, build it and preview the PORT and output:

npm run build
npm run preview

Open your browser and go to:

http://localhost:PORT

It's that simple and your site is now production-ready.

Final Thoughts

SvelteKit gives you a modern, minimal, and scalable foundation for building fast and secure websites with less boilerplate and more control. You've now laid down the groundwork for projects using a framework accessible enough for beginners. Whether you're building a portfolio, a blog, or your first client project, this setup can grow with your skills. Keep your code clean, your structure intentional, and always build with security and accessibility in mind.

How to Hash Passwords Securely Using SHA-256 in Go

Omulo Samuel Okoth — Tue, 12 Nov 2024 15:44:53 +0000

Introduction

Storing passwords securely is crucial to protecting user data. Storing passwords in plain text is a significant security risk, but hashing can mitigate this threat. In this article, we’ll explore how to securely hash passwords using SHA-256 in Go. While bcrypt and Argon2 are generally recommended for password hashing due to their added security features, we can enhance the security of SHA-256 by incorporating a unique salt and multiple iterations.
Why SHA-256 for Password Hashing?
SHA-256 produces a unique, 256-bit fixed-length hash, effectively transforming any password into a consistent, secure format. However, due to its speed, SHA-256 can be vulnerable to brute-force attacks. Therefore, combining SHA-256 with techniques like salting and iteration can significantly improve its security.

Importing necessary packages

First, let's import the necessary packages for cryptographic hashing and encoding:

package main

   import (
    "crypto/sha256"
    "encoding/hex"
    "fmt"
   )

Hash the Password

Here’s a basic SHA-256 function that hashes a password:

func hash password(password string) string {
    hasher := sha256.New()
    hasher.Write([]byte(password))
    return hex.EncodeToString(hasher.Sum(nil))
}

Add Salt for Extra Security

A salt is a unique random string added to each password. It ensures that even if two users have the same password, their hashes will be different, preventing rainbow table attacks.

func hashPasswordWithSalt(password, salt string) string {
    hasher := sha256.New()
    hasher.Write([]byte(salt + password))
    return hex.EncodeToString(hasher.Sum(nil))
}

Note:

It's essential to generate a unique salt for each user's password and store it securely in the database.
Add Iterations for More Security
Adding multiple iterations to the hashing process slows down brute-force attacks by increasing the time required to compute the hash.

Here's how to implement this:

func hashPasswordWithSaltAndIterations(password, salt string, iterations int) string {
    hash := salt + password
    for i := 0; i < iterations; i++ {
        hasher := sha256.New()
        hasher.Write([]byte(hash))
        hash = hex.EncodeToString(hasher.Sum(nil))
    }
    return hash
}

Example Usage
Let’s see how these techniques work in practice. The following example hashes a password with both a salt and iterations:

func main() {
    password := "MySecurePassword"
    salt:= "unique salt" // Generate a unique, random salt for each user
    iterations := 1000    // Choose a safe iteration count
    hashed password := hashPasswordWithSaltAndIterations(password, salt, iterations)
    fmt.Println("Hashed Password:", hashedpassword)
}

Key Points to Remember

Generate Secure Salts: Use Go’s crypto/rand to generate secure, unique salts for each user.
Store Salt and Hash: Save both the salt and the hashed password in your database. The salt should never be kept secret but must be unique to each user.
Consider bcrypt or Argon2: For even better security, consider using bcrypt or Argon2 for password hashing, especially in high-security systems. These algorithms are specifically designed for secure password storage.

Conclusion

While SHA-256 isn't the ideal choice for password hashing in high-security systems, combining it with salting and multiple iterations can significantly strengthen password protection. This approach helps deter brute-force attacks and keeps your users' data safer. For applications that require the highest security, consider using algorithms like bcrypt or Argon2 instead.

Enterprise Password Management

Omulo Samuel Okoth — Mon, 14 Oct 2024 11:20:38 +0000

Introduction

Passwords remain the primary method of protecting access to systems, applications, and online services. Yet weak, reused, and poorly managed passwords continue to be one of the leading causes of unauthorized access, account compromise, and data breaches. A single compromised password can expose sensitive information, disrupt business operations, and cause significant financial and reputational damage.

As organizations adopt cloud computing, remote work, and DevOps practices, the number of accounts and systems requiring secure password management continues to grow. Without clear policies and secure practices, passwords can quickly become one of an organization's weakest security controls.

This article explores password management best practices for organizations, covering password policies, secure storage, password protection, software development, DevOps, incident response, and user awareness to help reduce password-related risks and strengthen organizational cybersecurity.

Why Password Management Matters

Passwords remain the first line of defence for protecting systems, applications, and sensitive information. However, weak, reused, or compromised passwords continue to be one of the most common causes of unauthorized access and data breaches.

Attackers commonly use phishing, brute-force attacks, password spraying, and credential stuffing to obtain valid passwords. Once a password is compromised, it can provide direct access to critical systems and sensitive data.
Poor password management can lead to:

Unauthorized access to systems and data.
Financial and operational losses.
Regulatory and compliance violations.
Reputational damage.

Effective password management is therefore a shared responsibility that requires strong policies, secure technology, and informed users.

Password Management Best Practices for Organizations

An effective password management strategy combines technical controls, organizational policies, and user awareness. Rather than relying on passwords alone, organizations should implement multiple layers of protection that reduce the likelihood and impact of password-related attacks:

Develop a Clear Password Policy: Organizations should establish documented password policies that define minimum password length, password history, password reuse restrictions, account lockout thresholds, password storage requirements, and password reset procedures. The policy should balance security with usability to encourage compliance rather than unsafe workarounds.

Encourage Strong and Unique Passwords:

Users should create passwords that are difficult to guess and unique to every account. Reusing passwords across multiple systems increases organizational risk because a compromise of one account may provide attackers with access to others. Password managers can help users generate and securely store unique passwords without relying on memory.

Implement Multi-Factor Authentication (MFA):

Multi-factor authentication significantly reduces the risk of unauthorized access by requiring users to provide an additional form of verification alongside their password. Even if a password is compromised, MFA provides an additional security layer that helps prevent unauthorized account access.

Protect Password Storage: Passwords should never be stored in plain text within databases, applications, configuration files, spreadsheets, or documentation. Systems should use industry-accepted cryptographic hashing algorithms with unique salts to protect stored passwords, ensuring that compromised databases do not immediately expose user passwords.

Establish Secure Password Reset Procedures:

Password recovery processes should verify a user's identity before allowing password changes. Weak password reset mechanisms can undermine even the strongest password policies by allowing attackers to bypass authentication through insecure recovery methods.

Monitor and Review Password Practices: Organizations should regularly review password-related security controls, monitor authentication logs for suspicious activity, identify inactive accounts, and respond promptly to potential password compromise. Periodic security assessments help verify that password management practices remain effective as technology and threats continue to evolve.

A well-defined password policy promotes consistent security practices across the organization.

Define Clear Requirements: Establish standards for password length, complexity, reuse, storage, and reset procedures.

Train Users Regularly: Keep employees informed about password security best practices and emerging threats.

Support Compliance: Ensure password policies align with applicable legal, regulatory, and organizational requirements.

Password Management in DevOps

DevOps accelerates software delivery through automation and CI/CD, but it also increases the risk of password exposure if secure practices are not followed. Password management should be integrated throughout the software development lifecycle to protect applications, infrastructure, and production environments.

Never Hardcode Passwords:Passwords should never be embedded in source code, configuration files, or scripts. Applications should receive passwords securely during deployment or at runtime, allowing them to be updated without modifying the application.

Protect Passwords in Version Control: Passwords must never be committed to version control repositories. Even after deletion, they may remain accessible in the repository's history. Development teams should review code before merging and immediately replace any password that is accidentally exposed.

Secure Passwords in CI/CD Pipelines: CI/CD pipelines often require passwords to access deployment servers, databases, and testing environments. These passwords should be protected from unauthorized access and must never appear in build logs, error messages, or deployment reports.

Apply the Principle of Least Privilege: Access to passwords should be limited to authorized personnel based on their responsibilities. Restricting access reduces both accidental exposure and insider threats.

Use Different Passwords for Each Environment: Development, testing, staging, and production environments should each have unique passwords. Reusing passwords across environments increases the impact of a security breach.

Audit Password Usage: Administrative password activities, including changes, resets, and privileged access, should be logged to support accountability, compliance, and incident investigations without exposing the passwords themselves.

Promote Security Awareness: Secure password management depends on both technology and people. Regular training helps developers and administrators recognize phishing attacks, avoid password reuse, and follow organizational password policies throughout the software development lifecycle.

Managing Shared and Privileged Accounts

Shared accounts should be used only when necessary and managed carefully to maintain accountability.

Limit Access: Restrict shared passwords to authorized users and review access regularly.

Update Passwords Promptly: Change shared passwords whenever a user changes role or leaves the team or unauthorized access is suspected.

Password Management for Developers

Secure password handling is a fundamental part of secure software development.

Avoid Hardcoding Passwords: Never embed passwords directly in source code or configuration files.

Protect Development Environments: Use different passwords for development, testing, and production environments, and secure version control systems with strong passwords and MFA.

Dealing with Default Passwords

Many hardware and software products are shipped with default administrative passwords.

Change Default Passwords: Replace default passwords during installation before deploying the product into production.

Review Vendor Recommendations: Follow vendor security guidance and disable unnecessary default accounts where possible.

Emerging Trends in Password Management

Password management continues to evolve alongside modern authentication technologies.

Passwordless Authentication: Technologies such as passkeys are reducing reliance on traditional passwords while improving security.

Decentralized Identity: Emerging identity models give users greater control over authentication while reducing dependence on centralized identity providers.

Responding to Password Security Incidents

Organizations should be prepared to respond quickly when passwords are compromised.

Breach Response: Establish procedures for resetting compromised passwords, notifying affected users, and investigating the incident.

Regular Security Audits: Periodically review password policies and controls to identify weaknesses before they are exploited.

Security Awareness and User Training

Technology alone cannot prevent password-related attacks.

Continuous Awareness: Regular security awareness training helps users recognize phishing attempts, create stronger passwords, and follow organizational password policies.

Conclusion

Effective password management remains one of the simplest and most effective ways to strengthen cybersecurity. By implementing strong password practices across organizations, personal devices, social media platforms, shared accounts, and software development environments, organizations can significantly reduce the risk of unauthorized access.

As cyber threats continue to evolve, organizations should regularly review their password policies, educate users, and adopt modern security practices that balance protection with usability.

DEV Community: Omulo Samuel Okoth

Simple Website with SvelteKit

Project Goal

Final Thoughts

Further Reading & Resources

How to Hash Passwords Securely Using SHA-256 in Go

Introduction

Importing necessary packages

Hash the Password

Add Salt for Extra Security

Key Points to Remember

Conclusion

Enterprise Password Management

Introduction

Why Password Management Matters

Password Management Best Practices for Organizations

Password Management in DevOps

Managing Shared and Privileged Accounts

Password Management for Developers

Dealing with Default Passwords

Emerging Trends in Password Management

Responding to Password Security Incidents

Security Awareness and User Training

Conclusion