Cryptography for Web Developers

Cryptography Basics for Web Developers

Cryptography might sound like something only security experts need to worry about, but if you build websites, you use it every day. Every time someone logs into your site, submits a form, or sends a message, cryptographic operations are happening behind the scenes. Understanding the basics helps you make better security decisions and avoid common mistakes.

Symmetric Encryption: The Same Key for Everything

Symmetric encryption uses the same key to encrypt and decrypt data. It's fast and efficient, making it ideal for encrypting large amounts of data. The modern standard is AES-GCM, which not only encrypts your data but also ensures it hasn't been tampered with. Key sizes of 128 or 256 bits are standard. For mobile applications, ChaCha20-Poly1305 is a good alternative that doesn't require hardware acceleration.

Asymmetric Encryption: Two Keys Are Better Than One

Asymmetric encryption uses a pair of keys: a public key that anyone can see, and a private key that only the owner knows. The public key encrypts data, and only the private key can decrypt it. This is how secure connections work on the web — your browser uses the website's public key to encrypt data that only the website can read.

The old standard was RSA, which required very long keys (2048 bits or more) to be secure. Modern systems use Elliptic Curve Cryptography (ECC), which achieves the same security with much smaller keys. The most common curves are P-256 (NIST) and Curve25519, which is faster and more modern.

Hashing: One-Way Functions

A hash function takes any input and produces a fixed-length output that looks random. The important thing is that it's one-way — you can't reverse the hash back to the original input. This makes hashing perfect for storing passwords and checking file integrity.

SHA-256 is the standard for general-purpose hashing. But for passwords specifically, you should never use a fast hash like SHA-256. Instead, use algorithms designed to be slow, like Argon2id, bcrypt, or scrypt. These make it much harder for attackers to crack passwords even if they steal the hash database.

Digital Signatures: Proving Who Sent What

Digital signatures work like a handwritten signature, but they're much harder to forge. The sender signs a message with their private key, and anyone can verify the signature using the sender's public key. This proves both that the message came from the claimed sender and that it hasn't been altered. EdDSA (Ed25519) is the modern, recommended choice for digital signatures.

Common Mistakes to Avoid

The most important rule of cryptography is: don't invent your own. Use well-established, peer-reviewed algorithms and libraries. Never use ECB mode for encryption, never reuse initialization vectors, never hardcode keys in your source code, and never store secrets in client-side JavaScript. Avoid outdated algorithms like MD5, SHA-1, DES, and RC4. And always use constant-time comparison functions to avoid timing attacks.

For web developers, the most practical cryptographic tools are TLS (for secure connections), the Web Crypto API (for browser-based cryptography), and well-vetted libraries like libsodium for server-side work.