Certificate Pinning

The Idea

Apps should verify identity, not just encryption.

With certificate pinning on, packets move between the mobile app and the API server behind a locked, secure connection. Turn it off, and the wire becomes vulnerable; nothing visibly changes yet, but the protection is gone.

Drag the hacker onto that open wire, and you're simulating exactly what an attacker would do: sit between the app and the server, and read what passes through. The status escalates in real time: hijacked, exposed, stolen, while the intercepted count climbs.

Switch pinning back on, and the connection secures itself again. But notice what doesn't reset: the packets already intercepted stay counted. Trust restored isn't the same as damage undone.

Behind the Experience

Security is difficult to communicate because the best security is usually invisible. You don't notice certificate pinning when it's working. So instead of explaining the concept with a diagram or a paragraph, we made the invisible consequence visible.

Keep Exploring

More experiments from the Lab