In recent years, NIST has suggested that passwords no longer be created using a mix of symbols, numbers, and capital and lowercase letters, as was once recommended.

Passkeys, a new authentication method, aim to replace traditional passwords

Passkeys use cryptography keys to secure logins without passwords, resisting phishing and risks from data breaches. The FIDO Alliance developed passkeys as a combination of public and private keys for authentication.

View a list of the 25 most common passwords according to an analysis of 2.5 terabytes of public data breaches.

Visualize how passkeys, which rely on asymmetric cryptography to authenticate users, work

After using biometrics or a PIN to access the private key stored on a device, it is combined with a random number generated by the site to produce a cryptographic signature. This signature is verified using the site's public key, allowing a user to log in without entering a password. This reduces the risk of fraudulent messages—phishing attacks—and data breaches.

How hash functions encrypt stored passwords and can be enhanced with 'salt'

Hash functions convert text into unique, random sets of characters, a process that is computationally expensive and time-consuming to undo. Because hashed outputs for many common passwords are publicly listed, some sites use a salt—additional characters appended to a password—before hashing to produce an output that is not known. When entering a password, it is salted and hashed, then checked against the database for a matching hash before permitting login.

Although there are 10,000 possible combinations of four-digit personal identification numbers, data suggests that about 27% of all PINs are one of 20 combinations, including 1234, 1111, and 0000.

The science of cryptography, including methods to encrypt data and how to break encryption

Monoalphabetic ciphers use a set of rules to replace each letter with another consistently, making them susceptible to brute force attacks that try every kind of replacement. While more complex ciphers can transform text in less obvious ways, because certain letters are used more often than others, an analysis of letter frequency may reveal patterns that help uncover the rules that make up a cipher.

Trick a large language model into revealing secret passwords over multiple rounds, each with increasing safeguards.

View how AES—the global standard for symmetric encryption—works

Established by the National Institute of Standards and Technology in 2001, the Advanced Encryption Standard transforms plaintext into ciphertext using multiple rounds of processing, including substitution, transposition, and mixing. Larger keys undergo more rounds to produce 16-byte blocks of scrambled data, with 256-bit AES keys taking 3.31 × 10⁵⁶ years to decrypt via brute force.

Claude Shannon, for whom Anthropic's AI tools are named, proved the existence of an unbreakable cipher

In the one-time pad approach, the encryption key is randomly generated and of equal length to the plaintext. This randomness ensures that every possible plaintext is equally likely—RBBHN can mean HELLO, SOLVE, CODES, and so on, using a different key—while matching the message and key lengths prevents the appearance of patterns that can be exploited.

Microchips in payment cards improve security by generating unique transaction codes

Magnetic strips store unchanging data that is easily cloned, but microchips act as miniature computers that encrypt sensitive data. They also resist fraud by creating data unique to each transaction, preventing duplication.

On credit and debit cards, magnetic stripes have been slowly replaced by microchips that use dynamic, encrypted data to prevent card cloning and counterfeit fraud.

Scientific breakthroughs funded by NASA, the NSF, and the NIH include GPS, sign language, bladeless LASIK surgery, and quantum dots—tiny semiconductor crystals used in many modern televisions.

The mathematics of quantum-based cryptography, and why existing data is already at risk

Seeing the potential of this technology, some governments and malicious actors are thought to have already started storing encrypted data, in the hopes that quantum computers within the next 10 to 20 years will be able to decrypt it. As of 2022, the National Institute of Standards and Technology had selected four algorithms for inclusion in a quantum-resistant encryption standard.

Customers wrote just one check a year in 2024, on average

Major retailers like Target have stopped accepting checks in recent years as real-time payment systems are increasingly being implemented across the US. This shift is considered an improvement in safety—as checks are vulnerable to fraud—but can lead to some exclusion for those without access to digital devices.

Explore an interactive timeline of the world's biggest data breaches and hacks, led by the 2024 National Public Data breach, which involved almost three billion stolen records, including full names and Social Security numbers.

Why there are microchips in credit cards

Credit cards have evolved significantly since their invention in 1950, but security lagged in the US for years. Despite handling only a quarter of global transactions, the US once accounted for half of all credit card fraud. The 2013 Target data breach helped push the adoption of chip cards, reducing fraud but shifting risks to online scams.

Paper boarding passes have become rarer in recent years

Many travelers have shared their attachment to the documents as their utility fades. This sharply illustrated timeline reviews the development of the paper boarding pass as technology evolved.

A mathematical breakdown of how RSA encryption uses prime numbers to encrypt data

This form of asymmetric cryptography uses mathematical functions that rely on the product of two large prime numbers. Because traditional computers struggle to factor such products, obtaining the private keys needed to decrypt messages becomes effectively impossible. This security can be reinforced with larger prime numbers, though this makes encryption more computationally taxing.

As of 2026, age verification systems on online platforms have included the collection of personally identifying information, such as government IDs, and biometric age checks that rely on AI-based facial recognition.

Watch a cybersecurity expert answers questions about hacking

From firewalls and VPNs to ransomware and viruses, IBM Distinguished Engineer Jeff Crume has seen many changes in cybersecurity during his 40 years of IT experience. In this video, he explores some of the most significant hacking events in history and provides advice on protecting yourself online.

A look at historical ciphers, from the Spartan 'scytale' to the Navajo Code Talkers

From the Greek word for "hidden writing," cryptography in Ancient Greece took the form of batons around which a long strip of leather or parchment was wrapped, after which messages were written. Recipients needed a scytale of the correct width to encircle received ribbons and reveal the message. Members of the Navajo Nation created a code that remained unbroken throughout its use in World War II.

Watch how the Enigma machine encrypts messages and learn about its critical design flaw

Using settings selected from a series of rotors and a plugboard that let operators swap letters with any of their choosing, the machine lit up the output letter for each letter typed. While this system could generate messages requiring any of 150 quintillion potential keys, the machine's reflector never encrypted a letter as itself, providing an entry point for exploiting the system.

Google data centers possess six layers of security

Property boundaries, such as anti-climb fencing, overlapping cameras, vehicle crash barriers, and circulating patrols, are coupled with lobby iris scans and ID and badge checks. The security operations center monitors individuals throughout their visit, including the less than 1% of Google users who ever receive permission to visit the data center floor.

Digital passports allow identity verification to be digitized

By scanning the security chip on the back of passports and capturing images or video of a person, apps like Google Wallet and Apple Wallet create a digital version of the document. Some states have also developed their own apps for digital driver's licenses.

The 7-Eleven logo intentionally uses a lowercase 'n', something the company president's wife said made it look friendlier.

How quantum computers can empower Shor's algorithm to break digital encryption

Secure communications largely rely on numeric keys generated by multiplying two enormous prime numbers together, and it is computationally impractical to determine these primes by trying to divide by every possible one. While Shor's algorithm can provide better guesses for this brute-force approach, it relies on a number that is difficult to determine on classical computers but much easier to calculate using the simultaneous computations enabled by quantum superposition.

The story of Kryptos, the long unsolved cryptographic sculpture outside the CIA's headquarters

Made by American artist Jim Sanborn, the sculpture features four copper plates engraved with messages written with the 26 letters of the Latin alphabet and question marks. The last of these plates was solved in 2025, but the piece remains of interest to cryptoanalysts.

Practice encrypting and decrypting text using an online library of ciphers

This tool provides users with customizable protocols, including Caesar, Affine, and Vigenère ciphers, to hide messages in transformed text and convert them back into legible formats. Mechanisms are also available to convert text into other communication languages, such as Morse code and URL encoding.

Fintech companies made it easier for merchants to request tips, leading to fatigue

In recent years, companies such as Square and Toast have created touch screen technologies prompting customers at coffee shops and casual restaurants to tip upwards of 25%. Despite the interesting psychological conundrum this presents to consumers, one tech columnist argues that shoppers don't need to succumb to the pressure.

The CISA’s strategy for secure 5G

CISA, through the National Risk Management Center (NRMC), is leading risk mitigation efforts by working with government and industry partners to ensure the security and resiliency of 5G technology and infrastructure.

Like counting how often a word is repeated in a sentence, forensic scientists can identify people by tallying how often short segments of genetic information repeat in specific parts of a person's DNA—a set of numbers that varies from person to person.

Disconnecting from technology can be made easier by turning off notifications, making nonessential apps and devices harder to access, and opting for 'dumb' devices, such as a film camera.

Create your own cipher by combining mathematical operations and encryption protocols

This tool allows users to build an encryption workflow in which the output of one customizable function becomes the input to another, thereby creating undiscovered methods for obscuring information via a series of ciphers.

How the NSA has changed through history

The National Security Agency was born in the Cold War and then transformed by 9/11. This article answers all the basic questions you might have about the NSA, from what it does to how much data it collects to some of its useful intercepts.

Alternatives to polygraphs, which correctly identify innocent people only 57% of the time

Lie detector polygraphs have been standard in law enforcement for a century despite being based in unproven science. Researchers are exploring brain-scanning and eye-tracking alternatives, though some suggest there's no reliable lie-detection process at all.

The history and operation of SIGABA, the US counterpart of the Nazi Enigma machine

Developed by the US Army and US Navy, over 10,000 of these machines were deployed by the end of World War II to encrypt messages for the armed forces using three series of rotors. The device would continue to be used until the 1950s, while personal computers were shown to possess enough computing power to crack it by 2021.

Through prompt injection attacks, bad actors provide deceptive prompts to generative AI systems in order to manipulate their outputs and acquire sensitive data.

The origin of the term STEM—science, technology, engineering, and mathematics—at the NSF

In 2001, Judith Ramaley coined the acronym while director of the National Science Foundation to replace "SMET," which was considered awkward-sounding. Since then, additional elements have been incorporated in various settings to modify the acronym, such as STEAM-based education, which includes art.

Storing data in DNA requires converting binary code into DNA's four-base system

Researchers have suggested that DNA's ability to form compact, dense structures justifies investigating its use for long-term, safe data archiving. This system could fit all of the world's data in a single shoebox, though processing each bit into a nucleotide base takes 2 minutes, as of 2024.

In 2019, Congress passed the Secure Act to reform key aspects of the US tax code

Key Secure Act provisions included raising the age at which mandatory distributions take effect (to increase saving), allowing larger catch-up contributions for older individuals, and allowing employers to directly match contributions in a Roth 401(k).

Privacy concerns in the credit scoring system

Because credit scores use a lot of personal information (such as whether or not someone makes credit card payments on time), some worry their privacy is being compromised in the data collection process.

The worst cyberattacks of the last 10 years

It’s been a rough 10 years in cybersecurity—and it’s only getting worse. From the Stuxnet to the Sony Hack, learn about the worst cyberattacks over the last decade.

The acronym NFT stands for non-fungible token

NFTs have developed as a secure way to use cryptocurrencies and the blockchain to create unique digital art, allowing the owner to prove ownership of a specific digital item.

The $1 bill hasn't been redesigned in over 60 years, making it one of the least secure American banknotes from a counterfeiting and forgery perspective.

Old credit cards can be made into guitar picks, phone stands and more

Experts recommend always cutting through the chip and the card number when disposing of expired credit cards, as the magnetic strip, the chip, and the card number all contain information that thieves might be interested in.

Peter Norton, for whom Norton Antivirus is named, questioned the threat of viruses

The software author was among several computer experts in 1988 who suggested that reports on the threat of computer viruses were exaggerated, referring to testimonials of infections and their spread as "urban legends."

NFTs have been leveraged by brands to represent physical and digital items

The buzz around non-fungible tokens has faded since 2021 to 2022, when brands including Prada and Starbucks launched their own NFTs. While Prada’s NFTs were linked to limited-edition fashion items, Starbucks’ were part of a loyalty program.

How to prepare for cyberattacks

An easy-to-digest checklist on the many ways you want protect yourself from a cyberattack before it happens, if it happens, and after it happens.

Microsoft’s 'Blue Screen of Death' was a symbol of computer crashes for over 30 years

In 2025, the symbol was replaced with a "Black Screen of Death" for improved readability and alignment with Windows 11's modern design. It became a pop culture symbol after appearing in Bill Gates' live tech demo of Windows 98.

Our phones can provide a dopamine hit because of our positive associations with them, which feeds into what some psychologists call social media addiction.