IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Cheat sheet & pop quiz
You went from "what is a server?" to reading a token by eye. Here is the whole track in one table, a quick look-up list, and five questions to test yourself.
Nine ideas, one per lesson
| # | If you remember one thing… |
|---|---|
| 1 | Browsers ask servers, by address. The domain tells you who you are really talking to. A look-alike domain is the oldest trick (the web). |
| 2 | Every web action is a request and a response. The response has a status code (HTTP). |
| 3 | HTTP forgets you between requests. A cookie (or token) says "still me". Attackers want to steal it (state & cookies). |
| 4 | An API is one program talking to another, usually in JSON. It is the same request and response, without the page (APIs & JSON). |
| 5 | Encoding (Base64) is not secret. Encryption needs a key. Hashing is a one-way fingerprint (encoding vs encryption). |
| 6 | A key pair splits locking from unlocking. Share the public key. Guard the private key. Sign with private, check with public (keys & signatures). |
| 7 | A JWT is header.payload.signature. Anyone can read the payload. To trust a token, check the signature (what is a JWT). |
| 8 | Good sites never store your password. They store a salted, slow hash. If a site can email you your old password, leave (password storage). |
| 9 | Phishing is a fake message that tricks you. Read a link from the right. Never share an OTP. Tapped by mistake? Act fast (phishing). |
Quick reference
| Term | In one line |
|---|---|
| 2xx / 3xx / 4xx / 5xx | worked / go elsewhere / problem with the request / problem on the server |
| 401 / 403 / 404 | who are you? / not allowed / not found |
| Encoding | repacks data so it can travel; anyone can undo it (Base64) |
| Encryption | scrambles data with a key; only a key holder can read it |
| Hashing | a one-way fingerprint; it cannot be reversed; used for passwords |
| JWT parts | header . payload . signature |
| Cookie | a small note the browser keeps and sends back by itself |
| Token | a signed pass you carry to show who you are and what you may do |
| Public / private key | share the public one; never share the private one. The private key signs. The public key checks. |
| Phishing | a fake message or page that tricks you into giving a secret or tapping a link |
| OTP | a one-time code that is for you alone; never read it out to anyone |
Pop quiz — five questions
Q1 · An email says: "Your account is locked. Sign in at secure-yourbank.account-verify.com." The page looks perfect and has a padlock. Do you trust it?
No. The real owner of the domain is account-verify.com, a stranger's domain. The scammer put a trusted-sounding word in front of it. The real bank would be yourbank.com. The padlock only means the line is private to whoever owns this domain. A scammer can get one too. Read the domain, not the page (the web; the padlock; phishing).
Q2 · An app calls an API and gets 401. After it logs the user in, a different page returns 403. What does each one mean?
401 Unauthorized means not identified. The server says: "I do not know who you are, so log in." 403 Forbidden means identified but not allowed. The server says: "I know you, but you may not come in." A 404 would mean the thing does not exist. Same wall, two different reasons (HTTP).
Q3 · A developer says: "It is safe to put secrets in the token. The payload is Base64, so it is encrypted." Are they right?
No. Base64 is encoding, not encryption. Anyone can decode it in one step with no key. Encryption needs a key. A hash is a one-way fingerprint. A JWT payload is only encoded. Never put a secret inside it (encoding vs encryption; what is a JWT).
Q4 · You give your boarding-pass JWT to the airline's app. Can the app, or anyone who grabs the token, read your name, flight and seat inside it?
Yes. A JWT's payload is only Base64. Anyone who holds the token can read every claim, with no key. But they cannot change it, because editing any claim breaks the signature. So the contents of a token are effectively public. Only its integrity is protected. That is why you put nothing secret inside (what is a JWT).
Q5 · You click "forgot password" and the site emails you your old password in plain text. What does that show, and what should a good site have done?
It shows the site keeps your password in a form it can read. That is a serious warning. A breach would expose everyone's passwords at once. A safe site keeps only a salted, slow hash and cannot recover the original. It makes you set a new password. Reused passwords make it worse, which is why breach lists matter (password storage; breached passwords).
You have learned how the web works, how it remembers you, and how data is packed, locked and signed. You also saw how passwords are really stored, and how to spot a fake message. You now speak the language the rest of the Academy is written in. Next up is Foundations. You speak web now, so meet identity itself. Start with what "identity" even means.
Put it to work. Browse our free security tools on the tools shelf or explore our services. Talk to our team when you are ready to build the real thing.