diff --git a/demos/.gitignore b/demos/.gitignore
index 9b7faddc..a2cb8b4a 100644
--- a/demos/.gitignore
+++ b/demos/.gitignore
@@ -1,11 +1,11 @@
 auth
 box
-generhash
-generhashstream
+generichash
+generichashstream
 hash
 Makefile
 onetimeauth
-sretbox
+secretbox
 shorthash
 sign
 stream
diff --git a/demos/auth.c b/demos/auth.c
index d801f08b..77dd3df4 100644
--- a/demos/auth.c
+++ b/demos/auth.c
@@ -27,11 +27,21 @@ auth(void)
     size_t mlen;                                /* message length */
     int r;
 
-    sodium_memzero(k, sizeof k);                /* must zero the key */
 
     puts("Example: crypto_auth\n");
-
+    
+    /*
+     * Keys are entered as ascii values. The key is zeroed to
+     * maintain consistency. Input is read through a special
+     * function which reads exactly n bytes into a buffer to
+     * prevent buffer overflows.
+     */
+    sodium_memzero(k, sizeof k);
     prompt_input("Input your key > ", (char*) k, sizeof k);
+    puts("Your key that you entered");
+    print_hex(k, sizeof k);
+    putchar('\n');
+
     mlen = prompt_input("Input your message > ", (char*) m, sizeof m);
     putchar('\n');
 
diff --git a/demos/demo_utils.c b/demos/demo_utils.c
index 1387b10d..f0c4b917 100644
--- a/demos/demo_utils.c
+++ b/demos/demo_utils.c
@@ -16,7 +16,8 @@
  * ================================================================== */
 
 /*
- * Print hex.
+ * Print hex is a wrapper around sodium_bin2hex which uses calloc
+ * to allocate temporary memory then immediately printing the result.
  */
 void
 print_hex(const void *buf, const size_t len)
@@ -25,7 +26,7 @@ print_hex(const void *buf, const size_t len)
     char *p;
     
     b = buf;
-    p = malloc((len * 2 + 1) * (sizeof *b));
+    p = calloc(len * 2 + 1, sizeof *b);
     
     /* the library supplies a few utility functions like the one below */
     sodium_bin2hex(p, len * 2 + 1, b, len);
diff --git a/demos/onetimeauth.c b/demos/onetimeauth.c
index c9b47189..fcacdbb8 100644
--- a/demos/onetimeauth.c
+++ b/demos/onetimeauth.c
@@ -33,7 +33,18 @@ onetimeauth(void)
 
     puts("Example: crypto_onetimeauth\n");
 
+    /*
+     * Keys are entered as ascii values. The key is zeroed to
+     * maintain consistency. Input is read through a special
+     * function which reads exactly n bytes into a buffer to
+     * prevent buffer overflows.
+     */
+    sodium_memzero(k, sizeof k);
     prompt_input("Input your key > ", (char*) k, sizeof k);
+    puts("Your key that you entered");
+    print_hex(k, sizeof k);
+    putchar('\n');
+
     mlen = prompt_input("Input your message > ", (char*) m, sizeof m);
     putchar('\n');
 
diff --git a/demos/sign.c b/demos/sign.c
index 08120982..3ca8f06c 100644
--- a/demos/sign.c
+++ b/demos/sign.c
@@ -26,7 +26,7 @@ sign(void)
 {
     unsigned char pk[crypto_sign_PUBLICKEYBYTES];       /* Bob public */
     unsigned char sk[crypto_sign_SECRETKEYBYTES];       /* Bob secret */
-    unsigned char m[BUFFER_SIZE + crypto_sign_BYTES];   /* message */
+    unsigned char m[BUFFER_SIZE];                       /* message */
     unsigned char sm[BUFFER_SIZE + crypto_sign_BYTES];  /* signed message */
     unsigned long long int mlen;                        /* message length */
     unsigned long long int smlen;                       /* signed length */
@@ -48,10 +48,20 @@ sign(void)
     mlen = prompt_input("Input your message > ",
             (char*) m, sizeof m - crypto_sign_BYTES);
     putc('\n', stdout);
+    
+    puts("Notice the message has no prepended padding");
+    print_hex(m, mlen);
+    putchar('\n');
+    putchar('\n');
 
     printf("Signing message with %s...\n", crypto_sign_primitive());
     crypto_sign(sm, &smlen, m, mlen, sk);
     
+    puts("Notice the signed message has prepended signature");
+    print_hex(sm, smlen);
+    putchar('\n');
+    putchar('\n');
+    
     puts("Format: signature::message");
     fputs("Signed: ", stdout);
     print_hex(sm, crypto_sign_BYTES);