DevTools Blog

What each component in a URL does, how percent-encoding works, the difference between relative and absolute URLs, and why userinfo is a security concern.

Why Rust and Python both settled on TOML, what each format actually gives you, and how to validate your Cargo.toml without guessing.

What happens when you save a text file, how UTF-8 encodes characters, and why the same string can be different lengths in binary.

What major/minor/patch actually communicate, how prerelease versions sort, why ^ and ~ matter in package.json, and how to bump correctly.

What a shift cipher is, why ROT13 is self-inverse and useful for light obfuscation, and how frequency analysis breaks even large keys efficiently.

How CSS viewport works vs. device pixels, which breakpoints to test, and why some sites block their own embedding in iframes.

What the fields in a PEM certificate mean, why Subject Alternative Names matter more than the Common Name, and how to decode expiry and key usage.

What JSON Schema guarantees, how draft-07 works, and how instance paths identify fields that are missing, malformed, or the wrong type.

What makes one-object-per-line files different from JSON arrays, when NDJSON shines, and how to work with it in any language.

Reading pixel data with the canvas API, computing luminance correctly, mapping brightness to character density, and the glyph-aspect correction that makes it look right.

What RFC 1952 actually specifies, how gzip differs from zlib and deflate-raw, and how to use CompressionStream in modern browsers without any library.

How capture groups, alternation, and lazy vs. greedy matching turn search-and-replace from tedious editing into precise transformation.

How the Received chain reveals an email's path, what SPF DKIM and DMARC checks actually verify, and how to spot a spoofed sender address.

How to turn a CSV export into typed, quoted, and safe SQL INSERT statements — and why the naive string-concatenation approach breaks on quotes, NULLs, and dates.

How to convert CSV rows to clean GFM tables, handle pipes and newlines inside cells, and avoid the most common escaping mistakes.

Converting config formats sounds trivial until your dates vanish, your comments disappear, and your multiline string gets folded into one line.

What the letter distribution in English looks like, how to use it to break a Caesar cipher, and what word and line stats reveal that individual letters miss.

The entropy-to-words mapping, the checksum, and the security model that makes a 12-word phrase protect an entire cryptocurrency wallet.

How figlet fonts work, which glyphs vary across terminal emulators, and how to pick a font that renders consistently.

How to use thead, tbody, th, and scope correctly, how to escape pipe characters in cells, and when a table is the right choice vs. CSS layout.

Why the API world moved from XML/SOAP to JSON, the attribute-handling quirks that still trip converters up, and how to bridge the two formats safely in a client-side tool.

The canonical clause order — SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT — and the most common mistakes when typing SQL by hand, from unescaped quotes to forgotten GROUP BY columns.

How the API-description format evolved from Swagger 2.0 to OpenAPI 3.x, the practical differences that break importers, and how to sanity-check a spec before shipping it.

Why Markdown became the default for documentation, the GitHub-Flavored extensions that go beyond CommonMark, and how to keep the rendered HTML safe from XSS when you embed it.

The structure of a workflow file, why `on:` becomes a YAML boolean (and how to dodge it), and the common triggers you'll reach for first when bootstrapping CI/CD.

Why a checked-in Compose file beats a one-liner in your shell history, the exact flag-to-key mapping the converter uses, and the gotchas worth knowing when you migrate.

What the version nibble in a UUID means, how v1 and v4 differ, why v7 is taking over for database keys, and how unlikely a collision really is — with generation tips and format options.

Why URLs can't contain spaces or special characters, how percent-encoding works, and how to avoid the classic pitfalls — double-encoding, + vs %20, and encodeURI vs encodeURIComponent.

Why strict JSON breaks so easily, the syntax errors that cause most failures, and the formatting habits that make JSON readable in diffs and reviews — with validation, minifying, and search tips.

What cryptographic hash functions do, which algorithms are still safe, and which to pick for checksums, fingerprints, or passwords — MD5, SHA-1, SHA-256, SHA-512, and BCrypt compared.

Three cryptographic primitives developers constantly confuse — reversible encryption (AES), password hashing (BCrypt), and message signing (HMAC). What each one is for, and how to pick correctly.

An honest comparison of the three ways developers test APIs — the terminal, the heavyweight GUI, and the open-source web app — plus how to turn any curl command into real code.

How to turn spreadsheet-style CSV into structured JSON — header handling, quoting and escaping rules, delimiter variants, type conversion gotchas, and how to go the other way.

The best free, browser-based developer tools compared — CyberChef, Regex101, JWT.io, and the privacy-first alternatives. What to use for JSON, regex, JWTs, hashing, UUIDs, and more.

What Base64 actually does, why it exists, and when you should (and shouldn't) use it — covering the alphabet, padding, Base64URL, Data URIs, and common mistakes.

How phone numbers are structured per country — calling codes, area codes, mobile vs landline vs toll-free — and how to generate test numbers in international, national, raw, or tel: format without using a real subscriber.

Realistic test addresses per country, postcode formats that match local rules, and how to seed a test database without inventing data that points at a real home.

How driver's license numbers are structured across 21 countries and all 50 US states, why some states use Luhn check digits, and how to generate structurally valid test data without impersonating real people.

Compose a SELECT query by stacking clause blocks instead of typing SQL. Learn JOIN, WHERE, GROUP BY and ORDER BY by building them, and see how the builder keeps clauses in canonical order automatically.

A practical guide to RSS and Atom feeds. Learn the channel and item structure, the difference between RSS 2.0 and Atom, how to validate a feed, and how to submit yours to readers and podcast directories.

A practical guide to picking an open-source license. Learn the difference between permissive and copyleft, what each major license actually requires, and which to choose for libraries, applications, and internal tools.

A practical guide to response security headers. What HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy actually do, and the weak values to avoid.

Inspect a Certificate Signing Request before you send it off. Learn what the Subject, SAN, public key and signature mean, and why modern browsers ignore CN in favor of the Subject Alternative Name.

Understand Cross-Origin Resource Sharing from the browser up. Learn why CORS is a browser mechanism, the difference between simple and preflight requests, the wildcard-with-credentials pitfall, and how to read Access-Control-* headers.

Which barcode format to use, how check digits work for EAN and UPC, and how to size a barcode so it actually scans in print.

What an XML sitemap is, what the optional tags actually do, how search engines treat them, and how to generate a valid one from a list of URLs.

What Terms of Service do, the core clauses every agreement needs, and the optional ones that depend on your product.

When a privacy policy is legally required, what it must cover, and how GDPR and CCPA change the picture — plus how to generate a solid starter.

A practical guide to opting your site out of AI training crawlers using robots.txt — which user-agents to block, what it does and doesn't do, and a ready-to-copy example.

The small Markdown style rules that keep documents consistent, diff-friendly, and safe to render — and how to catch violations automatically.

What the RFC 9116 security.txt file is, the required and optional fields, where to host it, and why every production site should have one.

What the web app manifest does, the fields that control the install prompt and splash screen, and the icon requirements browsers actually enforce.

What the three Core Web Vitals measure, their good/poor thresholds, why INP replaced FID, and the rule that decides whether your page passes.

How LLM APIs bill per token, why input and output rates differ, what actually drives your bill, and how to estimate costs before you ship.

What readability formulas measure, how to read a Flesch Reading Ease score, and how to write text that scores well without dumbing it down.

How IPv6 addresses are structured, the rules behind the :: shorthand and leading-zero omission, and how to canonicalize an address per RFC 5952.

Email clients strip modern CSS, so signatures need inline styles and table layout. Here's what survives Outlook, Gmail, and Apple Mail.

robots.txt, sitemap.xml, security.txt, and the web app manifest — the small root-level files that improve crawling, security, and installability.

How CIDR notation, subnet masks, network and broadcast addresses actually work — with the /31 and /32 edge cases most people get wrong.

A tour of the request headers you'll actually use — Authorization, Content-Type, Accept, and friends — with how to build them for curl, fetch, and raw requests.

How to encrypt text in the browser with AES-GCM and PBKDF2 — what the pieces do, why authenticated encryption matters, and the one rule for sharing passphrases.

The classic mix-up between megabits and megabytes, plus SI vs binary units — and how to estimate transfer time correctly.

A working programmer's guide to number bases, bitwise masks, two's-complement negatives and why 0.1 isn't really 0.1.

Three different mechanisms control crawling and indexing, and they're not interchangeable. Here's what each one does and the classic mistake that hides pages from Google.

A practical checklist of the legal, privacy, and security pages users and regulators expect — and how to generate each one.

The Keep a Changelog conventions — the six standard categories, how they map to semantic versioning, and what to leave out.

Why a per-token price tag doesn't tell the whole story, how to compare models on your actual workload, and how to run an apples-to-apples cost estimate.

A single reserved path holds a surprising amount of a site's machine-readable metadata — from security contacts to certificate validation. Here's the tour.

The anatomy of PostgreSQL, MySQL, MongoDB, Redis and SQLite connection strings — and the URL-encoding gotcha that breaks them.

The Compose fields you actually need — services, ports, volumes, environment, depends_on and restart policies — without the YAML foot-guns.

Reverse proxy headers, SPA fallbacks, SSL termination and HTTP-to-HTTPS redirects — the NGINX server block essentials, explained.

Turn messy, one-line SQL into readable queries. A practical guide to dialects, keyword casing, indentation, logical-operator placement, minifying, and every option in the SQL Formatter.

Diff two SQL queries the smart way. Learn why normalizing before comparing beats a plain text diff, and how to use side-by-side vs unified views, ignore-case and ignore-whitespace to see only the changes that matter.

A token-by-token method for decoding any regex — anchors, classes, groups, lookarounds and quantifiers — so patterns stop looking like line noise.

What WCAG color contrast ratios mean, the AA and AAA thresholds, how the ratio is computed from relative luminance, and how to fix text that fails accessibility checks.

What a JWT is, how the header.payload.signature structure works, which claims matter, and how to sign and verify tokens securely — with examples you can run in your browser.

How to use JSONPath expressions to extract values from nested JSON — dot notation, wildcards, recursive descent, and filter expressions, with copy-paste examples.

A field guide to HTTP status codes — what each 1xx–5xx class means, the codes you will meet every day, and the common mistakes people make reading them.

A step-by-step guide to decoding a JSON Web Token by hand — Base64url decoding the header and payload, understanding common claims, and why decoding is not the same as verifying.

A practical comparison of the four most common config and data formats — syntax, strengths, and when each one is the right choice, with side-by-side examples.

The four ways CSS lets you write a color, what each one is good at, and why HSL feels intuitive while LCH solves the gamut problems everyone trips over.

How to read and write cron expressions — the five fields, special characters, and copy-paste schedules for the jobs every developer needs.

Turn any JSON API response into clean, type-safe TypeScript interfaces in seconds. Learn the rules behind type inference, nested objects, and arrays.

How to create cryptographically strong tokens, sign payloads with HMAC, and encrypt data with AES — all client-side, with nothing sent to a server.

A practical comparison of HTTP Basic Authentication and Bearer/JWT tokens — how each works, their trade-offs, and when to reach for which.

What belongs in a .gitignore, the patterns that trip people up, and how to build a complete file for your stack in one click.