# Security Basics

Security Basics: Hashing and Encryption, JSON Web Tokens.

Updated: November 3, 2026

1. [Hashing and Encryption](https://www.ask-codey.com/lessons/security-basics-hashing-and-encryption) (Journeyman): Hashing is one-way, a fingerprint you can check but never undo, so it's for passwords. Encryption is two-way with a key, so it's for data you need back. A password hash needs a random salt and many rounds, which is what PBKDF2 and ASP.NET Core's PasswordHasher do for you.
2. [JSON Web Tokens](https://www.ask-codey.com/lessons/security-basics-json-web-tokens) (Journeyman): A JSON Web Token is a signed note an API gives you at sign-in: header, payload and signature, joined with dots. Anyone can read the payload, but nobody can change it without the key, so the API can trust the claims in it, such as who you are and your role, until it expires.

Source: https://www.ask-codey.com/courses/csharp-full-stack-bootcamp/topics/security-basics