Category

For session keys and tokens. Never reach for a password generator or a UUID for this.

A plain === leaks how much of the token matched through its timing. This does not.

Blocks inline script and restricts everything to the origin. Tighten from here rather than loosening from nothing.

Ed25519 rather than RSA: shorter, faster, and no key-size decision to get wrong.

Verifies a download actually matches what the publisher signed, rather than trusting the transfer.

The handful worth setting even when you are not using a framework that sets them for you.