Security Best Practices for Developers

Overview

Security is not optional in modern software development. This guide covers fundamental security practices every developer should follow: secure authentication with JWT, strong password generation, data integrity verification with hashing and HMAC, and secure credential management.

Estimated time: 30-40 minutes

Prerequisites: Basic understanding of web security concepts and cryptography

Step 1: Implement Secure Authentication with JWT

JSON Web Tokens (JWT) provide a stateless authentication mechanism for modern applications. Proper implementation is critical for security.

{
  "sub": "user_12345",           // Subject: User identifier
  "email": "user@example.com",   // User email
  "role": "user",                // Authorization role
  "iat": 1704067200,             // Issued at (Unix timestamp)
  "exp": 1704153600,             // Expiration (24 hours later)
  "iss": "https://api.example.com", // Issuer
  "aud": "https://app.example.com"  // Audience
}

Use the JWT Generator to create tokens with proper claims. Always include expiration (exp) and issued-at (iat) claims to limit token lifetime.

// Development/Testing: HS256 (Symmetric)
// - Simple secret key
// - Fast signing and verification
// - Secret must be shared with all services

// Production: RS256 (Asymmetric)
// - Private key for signing (kept secret)
// - Public key for verification (can be shared)
// - Better security for distributed systems
// - Prevents token forgery even if public key is known

Use the JWT Decoder to inspect tokens during development and debugging. Remember: decoding is not verification - always validate signatures in production.

Step 2: Generate Strong Passwords

Weak passwords are the #1 cause of account compromises. Generate cryptographically secure passwords for users, API keys, and service accounts.

// Weak: 8 characters, lowercase only
// Entropy: ~37 bits (crackable in seconds)
password

// Medium: 12 characters, mixed case + numbers
// Entropy: ~71 bits (crackable in days/weeks)
MyPass123456

// Strong: 16+ characters, all character types
// Entropy: ~95 bits (crackable in centuries)
K9$mP2#vL8@nQ4!x

// Very Strong: 20+ characters, all types
// Entropy: ~119 bits (practically uncrackable)
T7&kR3$mN9@pL2#vQ5!x

Use the Password Generator to create secure passwords. Configure length (minimum 16 characters) and enable all character types for maximum security.

Step 3: Verify Data Integrity with Hashing

Cryptographic hashes ensure data hasn't been tampered with during transmission or storage. Use them for file integrity verification and data fingerprinting.

// ❌ Avoid: MD5 and SHA-1 (Broken)
// - Collision attacks possible
// - Not suitable for security purposes
// - Only use for non-security checksums

// ✅ Use: SHA-256 (Recommended)
// - 256-bit output
// - No known practical attacks
// - Good balance of security and speed
// - Widely supported

// ✅ Use: SHA-384 or SHA-512 (High Security)
// - Larger output sizes
// - Higher security margin
// - Slightly slower than SHA-256
// - Use for highly sensitive data

Use the Hash Generator for text hashing and the File Checksum Calculator for file integrity verification. Both tools use the Web Crypto API for secure computation.

// 1. Publisher provides file and hash
file: application-v1.0.0.zip
SHA-256: a3c5f8d2e9b1c4a7f6e3d8b2c9a1f4e7d3b6c8a2f5e9d1c4b7a3f6e2d8c5b1a4

// 2. Download the file
// 3. Calculate hash using File Checksum Calculator
// 4. Compare hashes

// ✅ Hashes match: File is authentic and unmodified
// ❌ Hashes differ: File is corrupted or tampered with

Step 4: Implement Message Authentication with HMAC

HMAC (Hash-based Message Authentication Code) provides both data integrity and authenticity verification. Use it for API request signing and webhook validation.

// Sender (API Client)
1. Prepare message: "user_id=123&action=update"
2. Generate HMAC: HMAC-SHA256(message, secret_key)
3. Send message + HMAC signature

// Receiver (API Server)
1. Receive message + signature
2. Calculate HMAC: HMAC-SHA256(message, secret_key)
3. Compare calculated HMAC with received signature
4. ✅ Match: Message is authentic and unmodified
   ❌ Mismatch: Message is invalid or tampered with

Use the HMAC Generator to create and verify HMAC signatures. Supports SHA-256, SHA-384, and SHA-512 algorithms with hex and base64 output formats.

// Webhook payload
{
  "event": "user.created",
  "user_id": 12345,
  "timestamp": 1704067200
}

// Provider sends:
// X-Webhook-Signature: sha256=a3c5f8d2e9b1c4a7f6e3d8b2c9a1f4e7...

// Your verification:
1. Get webhook secret from environment
2. Calculate HMAC-SHA256(payload, secret)
3. Compare with X-Webhook-Signature header
4. Only process if signatures match

Step 5: Secure Credential Management

Proper credential management prevents unauthorized access and data breaches. Never hardcode secrets in source code or commit them to version control.

# .env.example (commit this)
DATABASE_URL=postgresql://localhost:5432/myapp
JWT_SECRET=your-secret-here
API_KEY=your-api-key-here

# .env (DO NOT commit this)
DATABASE_URL=postgresql://prod-db:5432/myapp
JWT_SECRET=K9$mP2#vL8@nQ4!xT7&kR3$m
API_KEY=sk_live_abc123def456ghi789

# .gitignore
.env
.env.local
.env.*.local

Use the Environment File Formatter to validate and format .env files. It detects duplicate keys and validates variable names.

Step 6: Implement Defense in Depth

Security is not a single solution but layers of protection. Implement multiple security controls so that if one fails, others still protect your system.

Security Checklist

Related Tools

• JWT Generator - Create authentication tokens
• JWT Decoder - Inspect token contents
• Password Generator - Generate strong passwords
• Hash Generator - Create cryptographic hashes
• HMAC Generator - Generate message signatures
• File Checksum Calculator - Verify file integrity
• Base64 Encode - Encode binary data
• Base64 Decode - Decode encoded data
• Environment File Formatter - Format .env files

Frequently Asked Questions