Developer Blog
Practical guides and tutorials on the tools and techniques developers use every day. Written and reviewed by developers, each article explains a concept clearly, shows real examples, and links to the free browser-based tools you can use to try it yourself.
We cover working formats like JSON, CSV, YAML and XML; encoding and decoding with Base64, URL and HTML entities; authentication topics such as JWT, bcrypt and hashing; regular expressions; UUIDs and unique identifiers; Unix timestamps and date handling; and the everyday text, color and generator utilities that speed up frontend and backend work. Every guide is free to read, needs no signup, and pairs with a private, in-browser tool so you can go from reading to doing in a single click.
JSON.parse() vs JSON.stringify(): What’s the Difference?
JSON.parse turns JSON text into a JavaScript value; JSON.stringify turns a JavaScript value into JSON text. See examples, errors, and the edge cases that lose data.
Unix Timestamp Seconds vs Milliseconds: How to Tell
A 10-digit Unix timestamp is usually seconds; a 13-digit timestamp is usually milliseconds. Learn how to identify, convert, and avoid the 1970 date bug.
Regex for Email Validation: A Practical Pattern
Use a deliberately simple regex for email form validation, then verify the address by sending mail. Learn what the pattern catches—and what regex cannot prove.
What Is a Pepper in Password Hashing?
A password pepper is a secret value stored outside the user database. Learn how it differs from a salt, what it protects, and how to deploy one safely.
JSON vs YAML for Configuration: Which Should You Use?
JSON is strict and universal; YAML is concise and comment-friendly. Compare their real configuration tradeoffs and choose the safer format for your project.
What Is Key Stretching? PBKDF2 & Iteration Counts
A fast hash cracks in seconds. Key stretching runs it thousands of times so each guess costs real time — here's how PBKDF2 and iteration counts work.
SAML vs OIDC: Which SSO Protocol to Use
SAML and OIDC both do single sign-on, but one is XML-and-enterprise and the other is JSON-and-API. Here's how they differ and which to pick.
What Is scrypt? Memory-Hard Password Hashing Explained
scrypt isn't a better bit-scrambler than bcrypt — it demands a lot of memory per guess, and that one requirement is what breaks an attacker's cheapest hardware.
What Is OpenID Connect? OIDC vs OAuth Explained
"Sign in with Google" isn't plain OAuth — it's OpenID Connect adding a verifiable identity layer on top. Here's what OIDC adds and why the difference bites.
What Is a Rainbow Table? (And Why Salt Beats It)
A rainbow table is a precomputed hash lookup that cracks unsalted passwords in seconds — and one random salt makes it worthless. Here's how it works.
What Is OAuth? Delegated Access Without Passwords
OAuth isn't a login system — it's how you grant an app limited access to your data on another service without sharing your password. Here's how it works.
UUID v5 Explained: Deterministic, Name-Based IDs
UUID v5 turns a namespace and a name into the same ID every time — no randomness, no coordination. Here's when a deterministic UUID beats a random one.
What Is a Hex Color Code? (RRGGBB Explained)
A hex color code like #4F46E5 is just three numbers — red, green, blue — written in base-16. Here's how to read one by eye and mix your own.
Domain Rating vs Domain Authority: The Difference
DR (Ahrefs) and DA (Moz) both score a domain 0–100 — but from different crawls and formulas, so the numbers never match. Here's how to read each.
Markdown vs HTML: When to Use Each (and Convert)
Markdown is shorthand that compiles to HTML — not a rival to it. Here's what each is for, where Markdown falls back to raw HTML, and when to convert.
What Is a UTC Offset? Time Zones and UTC Explained
A UTC offset tells you how far a clock sits from UTC — but it isn't a time zone. Here's the difference, and why it fixes most broken-timestamp bugs.
How to Clean a Messy CSV File (Without Losing Data)
A messy CSV rarely errors — it opens and looks fine. Here's how to spot the real problem (delimiter, quoting, encoding) and clean it in the right order.
TypeScript Interface vs Type: What's the Difference?
TypeScript's interface and type overlap almost completely. Here are the few real differences — and a simple rule for which one to reach for.
Argon2 vs bcrypt: Which Password Hash to Use?
Argon2 and bcrypt are both slow password hashes — but only one is memory-hard. Here's what that means and which to pick for a new system.
JSON vs XML: What's the Difference and Which to Use?
JSON and XML both carry structured data, but they were built for different jobs. Here's when each one is the right tool — and why XML never died.
Base64 URL-Safe vs Standard: What's the Difference?
Standard and URL-safe Base64 encode the same bytes with two different alphabets. Here's when +/ breaks a URL and why JWTs use the URL-safe variant.
What Is an API Key? How It Works and How to Keep It Safe
An API key is a secret string that identifies an app to an API. Here's how it differs from a token — and how to keep yours from leaking.
HS256 vs RS256: Which JWT Signing Algorithm?
HS256 uses one shared secret; RS256 uses a private/public key pair. Here's how they differ and which one your JWTs should use.
What Is JSONPath? Querying JSON Explained
JSONPath is a compact query language for pulling values out of JSON — like XPath for XML. Here's the syntax, from $ to filters.
What Is a URL Slug? A Plain-English Guide
A URL slug is the readable part of a web address that names a page. Here's what makes a good one — and why you shouldn't change it lightly.
How Do QR Codes Work? A Plain-English Guide
A QR code stores data in a grid of black-and-white squares with error correction baked in. Here's how the patterns and scanning really work.
What Is ISO 8601? The Date Format Explained
ISO 8601 is the international standard for writing dates and times with zero ambiguity. Here's the format, the rules, and the bugs it prevents.
What Makes a Strong Password? The Real Math
A long password beats a short one full of symbols — every time. Here's the entropy math behind what actually makes a password hard to guess.
What Is a Salt in Password Hashing?
A salt is a unique, public random value mixed in before hashing so no two password hashes match. Here's what it defends against — and what it can't.
What Is a Checksum? Detecting Data Corruption
A checksum is a short fingerprint that flags when data changed by accident. Here's how it catches a flipped bit — and why it isn't security.
What Is an HMAC? Keyed Hashing Explained
An HMAC is a hash with a shared secret mixed in — proving a message wasn't changed and came from someone who holds the key. Here's how it works.
What Is UTF-8? How Text Becomes Bytes
UTF-8 is why your app shows é and 😀 instead of �. Here's how one encoding fits every character into bytes — and why mojibake happens.
UUID vs Nano ID: Which Unique ID Should You Use?
Compare UUID v4, UUID v7 and Nano ID by size, collision resistance, database behavior, URL safety and ecosystem support.
GUID vs UUID: Are They the Same Thing?
GUID and UUID are the same 128-bit identifier — GUID is just Microsoft's name for it. The small differences that actually bite, explained.
Are UUIDs Unique? Collision Odds Explained
UUIDs aren't guaranteed unique — they're collision-improbable. The real math on v4 collision odds, and when 'astronomically unlikely' still bites.
How to Generate a UUID in JavaScript, Python, Java, C# and SQL
Copy-ready UUID examples for browsers, Node.js, Python, Java, C#, PostgreSQL and MySQL, plus guidance on v4 versus v7.
UUID as a Database Primary Key: Best Practices
Learn when UUID primary keys make sense, why v7 can improve index locality, and how to store UUIDs efficiently in PostgreSQL, MySQL and SQL Server.
UUID Format Explained: Versions, Regex and Validation
Understand the 8-4-4-4-12 UUID format, version and variant bits, validation regexes, nil UUIDs, URNs and common parsing mistakes.
What Is a Refresh Token? The Two-Token Pattern
A refresh token is a long-lived credential that quietly gets you new short-lived access tokens — so you stay logged in without re-entering your password.
Base64 vs Hex vs Binary: When to Use Each
Base64, hex, and binary all turn bytes into text — but differ wildly in size and readability. Which encoding fits which job, with a quick comparison.
UUID vs Auto-Increment IDs: How to Choose
Sequential auto-increment IDs are simple; UUIDs need no coordinator. How to choose database keys — and why many teams quietly use both.
When Does a JWT Expire? The exp Claim Explained
A JWT expires at the Unix timestamp in its exp claim. How to read it, why tokens die early from clock skew, and how to stop surprise 401s.
Is Base64 Encryption? What It Actually Does
Base64 looks scrambled, so people assume it hides data. It doesn't — here's what Base64 really does and what to use when you need real secrecy.
UUID v4 vs v7: Which Version Should You Use?
Random UUID v4 can fragment your database index; time-ordered v7 fixes it. When to use each version — and when v4 is still the right call.
JWT vs Session Cookies: Which Auth to Choose
JWTs aren't 'more secure' than session cookies — they solve a different problem. A plain-English guide to picking the right auth for your app.
How to Open a JSON File (Without Installing Anything)
Double-clicked a .json file and got the "how do you want to open this?" shrug? It's just text. How to open a JSON file on any device — free, in seconds.
How to Open a JSON File in Excel (Two Ways, One Catch)
Excel imports JSON natively — and it's still often the slow way. Both routes to open a JSON file in Excel, and the tree-to-grid catch nobody mentions.
URL Decoding Explained: How to Read %20 and Percent Codes
See a link stuffed with %20 and %2F? URL decoding turns those percent codes back into readable text. Learn to read them by eye — and decode the rest fast.
What is Domain Rating (DR)? A Practical Guide
Domain Rating (DR) scores a site's backlink strength from 0 to 100. Learn what DR means, what counts as good, and how it differs from Domain Authority.
How to Share JSON Online With a Link
Pasting JSON into chat mangles it. Better ways to share JSON online — including a link that carries the data itself and expires after 30 minutes.
How to Fix Invalid JSON (and Salvage the Broken Parts)
A trailing comma cost me a deploy and 40 minutes. The five mistakes behind almost every invalid JSON error — and how to fix or cut them fast.
URL Encoding vs HTML Encoding: When to Use Which
Same text, two encodings — pick the wrong one and you break a link or open an XSS hole. When to URL-encode, when to HTML-encode, and why order matters.
How to Validate JSON Against a Schema
Valid JSON isn't the same as correct JSON. How a JSON Schema catches the wrong shape before it reaches production — with a minimal schema you can copy.
JSON vs YAML: Which to Use for Config Files
Same data, two notations. When YAML's comments and clean syntax win, when JSON's strictness wins, and the gotchas (like the Norway problem) that bite either way.
Markdown Table Syntax: How Tables Work (and Break)
The same Markdown table renders on GitHub and turns to pipe soup in Slack. Learn the two-line syntax, alignment colons, and how to write tables that last.
HEX vs RGB vs HSL: Which Color Format to Use When
HEX, RGB, and HSL are the same color written three ways. Learn what each notation is for — and why HSL is the one you should be editing in.
Master Your Writing: The Ultimate Guide to Word Counters
How to use an online word counter well: the features that matter, word-count targets for essays, blogs and social posts, and the mistakes to avoid.
How to Read Binary: Translate Binary Code to Text
Learn to translate binary to text by hand — decode 0s and 1s into English using ASCII's built-in shortcuts, with a worked example and free tools.
Bcrypt Explained: How Password Hashing Really Works
What bcrypt is, why fast hashes like SHA-256 fail for passwords, and how to pick a salt-round cost that actually slows attackers down.
HTML Entities Explained: The Only 5 You Must Know
What HTML entities are, the five you actually need to memorize, named vs numeric codes, the double-encoding bug, and why encoding is an XSS defense.
What is Hexadecimal? How to Read Hex Numbers
Hexadecimal is base-16 — the compact way programmers write bytes. Learn where A–F come from, why two hex digits equal one byte, and how to read hex anywhere.
MD5 vs SHA-256 vs Bcrypt: Choosing the Right Hash
MD5, SHA-1, SHA-256, and bcrypt solve different problems. A clear-eyed comparison of what's actually broken, what isn't, and which hash to use for each job.
What Is a Bearer Token? How API Auth Works
A bearer token is a string that says “let whoever holds this in.” What's inside one, why the name is a warning, and how to read the token you already have.
What is a Cron Expression? Syntax, Fields & Examples
A cron expression is a compact string that tells a scheduler when to run a job. Learn the five cron fields, the special characters, and common real-world examples.
SHA-256 Hashing Explained for Developers
A developer's guide to SHA-256 cryptographic hashing — how it works, when to use it, and common applications.
Regular Expressions: A Practical Developer Tutorial
Master regex patterns with practical examples for email validation, URL matching, and common developer use cases.
Converting Between CSV and JSON: A Complete Guide
Learn how to convert CSV to JSON and JSON to CSV with practical examples, edge cases, and browser-based tools.
What is JSON? A Beginner's Guide with Examples
JSON is the lightweight, text-based data format that powers web APIs and config files. Learn what JSON is, its syntax, and how to use it, with clear examples.
What is a CSV File? Format, Uses & Examples
A CSV file stores tabular data as plain text with comma-separated values. Learn what CSV is, how the format works, its pros and cons, and how to open one.
What is a Unix Timestamp? Epoch Time Explained
A Unix timestamp counts the seconds since January 1, 1970 UTC. Learn what epoch time is, why computers use it, and how to convert timestamps to dates.
What is JWT? How to Decode and Inspect JWT Tokens
Learn what JSON Web Tokens (JWT) are, how they work, and how to safely decode and inspect them without needing a backend.
JSON Formatting: A Complete Developer Guide
Everything you need to know about JSON formatting, validation, and best practices for clean, readable JSON data.
Understanding Base64 Encoding and Decoding
A practical guide to Base64 encoding — what it is, when to use it, and how to encode and decode in the browser.
What is a UUID? GUIDs, Versions & When to Use Them
A UUID is a 128-bit identifier that is unique across space and time without a central authority. Learn what UUIDs are, their versions, and when to use them.
What is URL Encoding? Percent-Encoding Explained
URL encoding replaces unsafe characters with percent codes so text is safe in a URL. Learn what URL encoding is, why it exists, and how percent-encoding works.