Visualize how passkeys, which rely on asymmetric cryptography to authenticate users, work

Passkeys, a new authentication method, aim to replace traditional passwords

Passkeys use cryptography keys to secure logins without passwords, resisting phishing and risks from data breaches. The FIDO Alliance developed passkeys as a combination of public and private keys for authentication.

In recent years, NIST has suggested that passwords no longer be created using a mix of symbols, numbers, and capital and lowercase letters, as was once recommended.

A mathematical breakdown of how RSA encryption uses prime numbers to encrypt data

This form of asymmetric cryptography uses mathematical functions that rely on the product of two large prime numbers. Because traditional computers struggle to factor such products, obtaining the private keys needed to decrypt messages becomes effectively impossible. This security can be reinforced with larger prime numbers, though this makes encryption more computationally taxing.

How hash functions encrypt stored passwords and can be enhanced with 'salt'

Hash functions convert text into unique, random sets of characters, a process that is computationally expensive and time-consuming to undo. Because hashed outputs for many common passwords are publicly listed, some sites use a salt—additional characters appended to a password—before hashing to produce an output that is not known. When entering a password, it is salted and hashed, then checked against the database for a matching hash before permitting login.

Although there are 10,000 possible combinations of four-digit personal identification numbers, data suggests that about 27% of all PINs are one of 20 combinations, including 1234, 1111, and 0000.

A visual guide to how bitcoin transactions work and rely on cryptography

The "crypto-" in cryptocurrencies like bitcoin refers to the mathematical functions that generate pairs of public and private keys and encrypt data in blocks. When combined, these systems secure transactions on the network, verify digital asset and token transfers, and contribute to end-user anonymity.

Microchips in payment cards improve security by generating unique transaction codes

Magnetic strips store unchanging data that is easily cloned, but microchips act as miniature computers that encrypt sensitive data. They also resist fraud by creating data unique to each transaction, preventing duplication.

Understanding the Diffie-Hellman key exchange, an example of public key cryptography

Published in 1976 by Whitfield Diffie and Martin Hellman, the system involves two parties combining each of their unique private keys with a public key using a mathematical function. The combinations are exchanged and mixed to establish a common key that no third party can determine. The Diffie-Hellman system underlies many encryption protocols for internet traffic.

Digital passports allow identity verification to be digitized

By scanning the security chip on the back of passports and capturing images or video of a person, apps like Google Wallet and Apple Wallet create a digital version of the document. Some states have also developed their own apps for digital driver's licenses.

How end-to-end encryption protects messages, even from service providers

Using symmetric and asymmetric cryptography, data is encrypted on the sender's device before being transmitted across application servers that lack the key needed to decrypt it. The message is not decrypted until it reaches the recipient's device, which uses their private key to recover the plaintext. E2EE's effectiveness has led to its adoption by WhatsApp and Signal.

View a list of the 25 most common passwords according to an analysis of 2.5 terabytes of public data breaches.

How quantum computers can empower Shor's algorithm to break digital encryption

Secure communications largely rely on numeric keys generated by multiplying two enormous prime numbers together, and it is computationally impractical to determine these primes by trying to divide by every possible one. While Shor's algorithm can provide better guesses for this brute-force approach, it relies on a number that is difficult to determine on classical computers but much easier to calculate using the simultaneous computations enabled by quantum superposition.

On credit and debit cards, magnetic stripes have been slowly replaced by microchips that use dynamic, encrypted data to prevent card cloning and counterfeit fraud.

Watch how the Enigma machine encrypts messages and learn about its critical design flaw

Using settings selected from a series of rotors and a plugboard that let operators swap letters with any of their choosing, the machine lit up the output letter for each letter typed. While this system could generate messages requiring any of 150 quintillion potential keys, the machine's reflector never encrypted a letter as itself, providing an entry point for exploiting the system.

Explore a visual guide to how quantum computers can crack RSA encryption

In 1994, Peter Shor introduced an algorithm that showed a quantum computer could efficiently factor the product of two very large prime numbers, undermining the mathematics that makes RSA so secure. While using larger keys can delay the decryption time of quantum computers, this solution increases the time it takes to encrypt data, which may become impractical.

Claude Shannon, for whom Anthropic's AI tools are named, proved the existence of an unbreakable cipher

In the one-time pad approach, the encryption key is randomly generated and of equal length to the plaintext. This randomness ensures that every possible plaintext is equally likely—RBBHN can mean HELLO, SOLVE, CODES, and so on, using a different key—while matching the message and key lengths prevents the appearance of patterns that can be exploited.

Technical vulnerabilities prevent full-proof anonymity when browsing the dark web

Despite encrypting data and relaying it within the Tor network, traffic between the network exit and the final destination is no longer hidden and can be captured. Law enforcement agencies can also attempt to deanonymize users by monitoring and matching data signal patterns entering and leaving the network via a correlation algorithm.

View how AES—the global standard for symmetric encryption—works

Established by the National Institute of Standards and Technology in 2001, the Advanced Encryption Standard transforms plaintext into ciphertext using multiple rounds of processing, including substitution, transposition, and mixing. Larger keys undergo more rounds to produce 16-byte blocks of scrambled data, with 256-bit AES keys taking 3.31 × 10⁵⁶ years to decrypt via brute force.

Watch a video that visualizes what really happens inside a credit card network when you make a purchase.

Create your own cipher by combining mathematical operations and encryption protocols

This tool allows users to build an encryption workflow in which the output of one customizable function becomes the input to another, thereby creating undiscovered methods for obscuring information via a series of ciphers.

The science of cryptography, including methods to encrypt data and how to break encryption

Monoalphabetic ciphers use a set of rules to replace each letter with another consistently, making them susceptible to brute force attacks that try every kind of replacement. While more complex ciphers can transform text in less obvious ways, because certain letters are used more often than others, an analysis of letter frequency may reveal patterns that help uncover the rules that make up a cipher.

Why there are microchips in credit cards

Credit cards have evolved significantly since their invention in 1950, but security lagged in the US for years. Despite handling only a quarter of global transactions, the US once accounted for half of all credit card fraud. The 2013 Target data breach helped push the adoption of chip cards, reducing fraud but shifting risks to online scams.

Trick a large language model into revealing secret passwords over multiple rounds, each with increasing safeguards.

Visualizing the consequence of data breaches

To get a sense of the grim state of data security today, take a look at this infographic from TruthFinder that explains why 2018 was the year of the data breach tsunami.

A look at historical ciphers, from the Spartan 'scytale' to the Navajo Code Talkers

From the Greek word for "hidden writing," cryptography in Ancient Greece took the form of batons around which a long strip of leather or parchment was wrapped, after which messages were written. Recipients needed a scytale of the correct width to encircle received ribbons and reveal the message. Members of the Navajo Nation created a code that remained unbroken throughout its use in World War II.

Explore an interactive timeline of the world's biggest data breaches and hacks, led by the 2024 National Public Data breach, which involved almost three billion stolen records, including full names and Social Security numbers.

Fraud and identity theft are among the most common dark web-related crimes.

Practice encrypting and decrypting text using an online library of ciphers

This tool provides users with customizable protocols, including Caesar, Affine, and Vigenère ciphers, to hide messages in transformed text and convert them back into legible formats. Mechanisms are also available to convert text into other communication languages, such as Morse code and URL encoding.

Your device can become infected with malware by simply browsing the internet

During a drive-by download attack, security flaws in a program or operating system (e.g., Windows) used to access online content are exploited, and malicious code is downloaded—for example, when loading a hacked webpage—onto a user's device without their knowledge. Restricting internet browsing to safe sites and installing security updates helps prevent these attacks.

Privacy concerns in the credit scoring system

Because credit scores use a lot of personal information (such as whether or not someone makes credit card payments on time), some worry their privacy is being compromised in the data collection process.

The mathematics of quantum-based cryptography, and why existing data is already at risk

Seeing the potential of this technology, some governments and malicious actors are thought to have already started storing encrypted data, in the hopes that quantum computers within the next 10 to 20 years will be able to decrypt it. As of 2022, the National Institute of Standards and Technology had selected four algorithms for inclusion in a quantum-resistant encryption standard.

The concept for Palantir's key software came from PayPal's anti-fraud protocol

PayPal, which, like Palantir, was cofounded by Peter Thiel, developed the initial framework for Palantir's data-mining service to prevent financial crime. Following the 9/11 terrorist attacks, Thiel realized the software could also enable government agencies to connect data and prevent similar terrorist attacks from occurring in the future.

Audio deepfakes have fooled voice biometrics at banks

Limitations in facial and body movements as well as mismatches between audio and lip movements can sometimes help flag a video as a deepfake, but removal of the video component significantly improves AI mimicry.

Google data centers possess six layers of security

Property boundaries, such as anti-climb fencing, overlapping cameras, vehicle crash barriers, and circulating patrols, are coupled with lobby iris scans and ID and badge checks. The security operations center monitors individuals throughout their visit, including the less than 1% of Google users who ever receive permission to visit the data center floor.

Like counting how often a word is repeated in a sentence, forensic scientists can identify people by tallying how often short segments of genetic information repeat in specific parts of a person's DNA—a set of numbers that varies from person to person.

Worldcoin: the cryptocurrency collecting biometric data

An ambitious project launched by OpenAI's founder Sam Altman, Worldcoin aims to provide a global financial and identity network based on proof of personhood through biometric scanning of individuals' irises.

Watch a cybersecurity expert answers questions about hacking

From firewalls and VPNs to ransomware and viruses, IBM Distinguished Engineer Jeff Crume has seen many changes in cybersecurity during his 40 years of IT experience. In this video, he explores some of the most significant hacking events in history and provides advice on protecting yourself online.

When you complete a CAPTCHA on a website to prove you are human, you may be unknowingly training algorithms for self-driving cars, whose systems require training data to help identify crosswalks, bicycles, and other outdoor objects.

Onion routing disguises internet traffic in layers resembling a nesting doll

Data is encrypted at least three times before being sent to a node—a server that can only decrypt one layer. Then, the underlying encrypted data is relayed to another node, and the process repeats until all layers are decrypted. Thousands of possible nodes make it extremely difficult to trace activity within the system.

NFTs create a unique digital signature to prove ownership

NFTs create digital certificates for unique online collectibles, mainly on the Ethereum blockchain. Artists can leverage NFTs to verify their online works.

Explaining how open source systems like Linux can be secure, despite their public source code

While no computer system is immune to all cyberattacks and malware, the transparency of open-source technology means many thousands of developers can review and oversee the underlying code powering the software on an ongoing basis. This increases the likelihood of catching and patching vulnerabilities more quickly than smaller groups of cybercriminals looking to exploit them.

Algorithms built to detect credit card fraud can deny charges if they perceive the attempted purchase is unfamiliar or unusual based on historical data, even when a person has enough credit to make the purchase.

The history and operation of SIGABA, the US counterpart of the Nazi Enigma machine

Developed by the US Army and US Navy, over 10,000 of these machines were deployed by the end of World War II to encrypt messages for the armed forces using three series of rotors. The device would continue to be used until the 1950s, while personal computers were shown to possess enough computing power to crack it by 2021.

As of 2026, age verification systems on online platforms have included the collection of personally identifying information, such as government IDs, and biometric age checks that rely on AI-based facial recognition.

Ads follow you around the internet through technology called 'cookies.'

Gas stations top the list of riskiest places to use a debit card

Unlike credit cards, debit cards withdraw funds directly from your checking account, and federal laws provide fewer consumer protections against debit fraud. Gas station "skimmers" and long periods of separation from the card at restaurants are some of the more vulnerable spots for use.

Security technician hacks a voting machine to reveal its vulnerabilities

A technician bought an old, likely-decommissioned voting machine from 2013 and took it apart to see how a would-be hacker might be able to exploit its vulnerabilities. Get a sense of the needs for secure, up-to-date voting machines with this...

Contactless credit cards descend from a batteryless Cold War listening device

The same physics that let Soviet spies eavesdrop on the US ambassador in 1945 underlie contactless payment methods today. The device is a passive chip powered wirelessly by incoming radio waves.

Proof-of-work is the original way cryptocurrencies added new blocks to blockchains

It’s a competitive method requiring “miners” to solve cryptographic puzzles, often using equipment that consumes massive amounts of energy. Ethereum switched to proof-of-stake, a less energy-intensive method in which “validators” stake crypto to be randomly chosen to check transactions.

Social media platforms benefit not just from ensuring they have satisfied users, but also from the personal data they scoop up and can then sell to online advertisers.