Learning path

Information security

Learn the safe defaults: hashing, password storage, message authentication, why keys must not be reused, SQL injection, and secure randomness.

About this subject

Information security protects the confidentiality, integrity, and availability of data and systems. Most real failures come from a few repeated mistakes, such as weak password storage, unauthenticated data, predictable secrets, and injection, so learning the safe defaults pays off quickly.

This path covers cryptographic hashing, storing passwords with a salt and a slow function, HMAC authentication, the one-time pad and key reuse, SQL injection, and secure random tokens. The lessons teach defensive practice only. Each lesson uses a small, complete program that runs on its own. Python has the full sequence. The other languages listed below add lessons that use that language's own idioms and standard library, such as Java threads, C++ smart pointers, C# LINQ, or Node.js streams, and appear only for the topics the language supports. The programs are simplified models chosen to make an idea visible, so they are a foundation for further study rather than a replacement for a full course or for production-grade software. Never write your own cryptography for real systems: use maintained, reviewed libraries.

Before you start: Strings and bytes, and basic SQL for the injection lesson.

1
Python
Readable code for automation, data, and first programs.
Cryptographic hashing and integrity
Compute SHA-256 digests and see why a one-character change produces a completely different hash.
Storing passwords safely
Hash passwords with a unique salt and a deliberately slow function, then verify in constant time.
Message authentication with HMAC
Attach a keyed tag to a message so that tampering is detected by anyone who holds the key.
The one-time pad and why keys must never be reused
Use XOR as a cipher and see how reusing a key leaks the relationship between two messages.
SQL injection and parameterized queries
See how string-built queries let input change the query, and how placeholders prevent it.
Secure randomness for tokens and secrets
Generate unpredictable tokens with the secrets module, and see why the random module is not for security.
2
C
Learn memory, pointers, and efficient systems programming.
C: preventing buffer overflows with snprintf
Copy text into a fixed buffer without writing past its end, and detect truncation.
C: validating numeric input with strtol
Accept only text that is entirely a number in the allowed range, and reject everything else.
C: why a one-time pad key must never be reused
XOR two messages with the same key and show that the key cancels out and leaks information.
3
C++
Build fast applications with modern types and classes.
C++: preventing buffer overflows with bounds checks
Reject writes that do not fit in a buffer and use at() so out-of-range reads fail safely.
C++: validating untrusted input with std::from_chars
Parse a port number strictly and reject anything that is not exactly a number in range.
4
Java
Understand object oriented programs and the JVM.
Java: SHA-256 hashing for integrity
Compute a SHA-256 digest with MessageDigest and see that a tiny change produces a completely different value.
Java: storing passwords with a salt and PBKDF2
Derive a password hash with a random salt and many iterations, then verify a login attempt.
5
C#
Build typed applications on .NET.
C#: message authentication with HMAC-SHA256
Compute a keyed tag so a receiver can detect tampering, and compare tags safely.
C#: password storage with a salt and PBKDF2
Derive a slow salted hash from a password and verify a login attempt in constant time.
6
Kotlin
Write concise, typed code for JVM applications.
Kotlin SHA-256 and PBKDF2 on the JVM
Hash text with MessageDigest and derive a salted password hash with PBKDF2.
7
JavaScript
Add behavior to the web and build applications.
JavaScript: SHA-256 hashing and HMAC with node:crypto
Hash a message, authenticate it with a secret key, and compare tags in constant time.
JavaScript: storing passwords with scrypt and a salt
Derive a memory-hard hash from a password and a random salt, then verify a login attempt.
JavaScript: preventing XSS by escaping output
Turn special HTML characters into entities so user text is shown as text, never run as markup.
8
TypeScript
JavaScript with static types for dependable code.
TypeScript: branded types for validated and escaped data
Use the type system so that unvalidated text cannot be passed where a validated value is required.
9
PHP
Learn server-side web programming basics.
PHP password_hash, password_verify, and hash_hmac
Store passwords with bcrypt through the built-in API and sign messages with HMAC.
PHP preventing XSS with htmlspecialchars
Encode user text before printing it into HTML, and escape for the right context.
10
Perl
Explore practical text processing and scripting.
Perl SHA-256 and HMAC with Digest::SHA
Hash messages, authenticate them with a key, and compare tags without leaking timing.
11
HTML
Structure accessible web pages.
HTML Safe Links, Embeds, and Content Security Policy
Limit what linked and embedded content can do with rel, sandbox, and a content security policy.

About this subject

Python

Cryptographic hashing and integrity

Storing passwords safely

Message authentication with HMAC

The one-time pad and why keys must never be reused

SQL injection and parameterized queries

Secure randomness for tokens and secrets

C

C: preventing buffer overflows with snprintf

C: validating numeric input with strtol

C: why a one-time pad key must never be reused

C++

C++: preventing buffer overflows with bounds checks

C++: validating untrusted input with std::from_chars

Java

Java: SHA-256 hashing for integrity

Java: storing passwords with a salt and PBKDF2

C#

C#: message authentication with HMAC-SHA256

C#: password storage with a salt and PBKDF2

Kotlin

Kotlin SHA-256 and PBKDF2 on the JVM

JavaScript

JavaScript: SHA-256 hashing and HMAC with node:crypto

JavaScript: storing passwords with scrypt and a salt

JavaScript: preventing XSS by escaping output

TypeScript

TypeScript: branded types for validated and escaped data

PHP

PHP password_hash, password_verify, and hash_hmac

PHP preventing XSS with htmlspecialchars

Perl

Perl SHA-256 and HMAC with Digest::SHA

HTML

HTML Safe Links, Embeds, and Content Security Policy