Notes on the things behind these tools
Occasional notes on encodings, protocols, algorithms and privacy. No fixed schedule — I write when there is something worth writing down.
How to Compare Code and Text Files Like a Pro
Eyeballing two files is how mismatches slip into production. Git and the standard diff tool give you word-level, branch-level and whitespace-tolerant comparisons that take seconds to run.
Markdown Syntax Cheat Sheet for Developers
GitHub Flavored Markdown is the lingua franca of READMEs, issues and docs. This cheat sheet shows the source and the rendered result side by side for every construct you actually use.
Base64 is not encryption — so what is it for?
Most people meet Base64 and assume that turning readable text into a string of nonsense must be some form of encryption. It doesn't even hide anything.
Mastering Cron Expressions: A Complete Reference Guide
A cron expression is five fields of line noise until you know the range each one accepts and the exact meaning of every special character. This is the reference you keep open next to your terminal.
Cron expressions, explained five fields at a time
A cron expression looks like line noise until you pull it apart. It is five independent fields, and once you know the range each one accepts, almost any expression becomes readable.
What is a UUID? A Comprehensive Guide for Developers
A UUID is a 128-bit identifier shown as 36 characters. This guide covers the versions (v1, v3/v5, v4, v7), why distributed systems prefer them over auto-increment, the collision math, and the database-primary-key performance cost.
JWT Security Best Practices: A Checklist for Production
A production checklist for JWTs: pin the algorithm, block alg:none and RS256-to-HS256 confusion, validate iss/aud, store refresh tokens in httpOnly cookies, and understand why stateless revocation is hard.
What Is a JWT? A Developer's Guide to JSON Web Tokens
A JWT is three Base64url parts — header, payload, signature. This guide explains what each holds, why the payload is readable by anyone, how the signature prevents tampering, and why JWT is a bad fit for session storage.
JSON or YAML: which one, and when
The two formats describe the same kind of data, but they were designed with different priorities. JSON optimises for machines, YAML for human eyes — and that difference decides where each one belongs.
Base64 in the Wild: 7 Real-World Use Cases for Developers
Seven places Base64 quietly does its job in production: JWTs, data URIs, email MIME, HTTP Basic Auth, binary in JSON/XML, API signatures, and Kubernetes Secrets — each with real code and the trap that bites.
What Is Base64 Encoding? A Developer's Guide
Base64 turns arbitrary bytes into 64 safe text characters. This guide covers the alphabet, the 4/3 size growth, the three variants, and why btoa throws on Chinese text or emoji — plus why it is encoding, never encryption.
Password Hashing Done Right: A Developer's Guide to bcrypt, scrypt, and Argon2
Storing passwords with MD5 or SHA-256 is a breach waiting to happen. Here is why slow, salted, memory-hard hashing is the only correct choice, with working code for bcrypt, scrypt and Argon2id.
Why these tools belong in your browser
Pasting logs, keys and configuration files into whichever online tool comes up first is a habit most people have. The risk is considerably higher than most of them realise.
Hash Functions Explained: From Checksums to Cryptographic Primitives
Beyond 'it makes a fingerprint': how compression functions, Merkle-Damgard, the sponge construction, the birthday paradox and HMAC actually work under the hood.
MD5 vs SHA-256: What's the Real Difference?
People treat MD5 and SHA-256 as interchangeable because both turn data into a hex string. They are not. Here is the side-by-side, the real collision attacks, and when MD5 is still good enough.
How a diff tool actually works out the differences
It looks like nothing more than marking two pieces of text against each other, but underneath sits a classic algorithm with more than forty years of history. Understanding it explains why diff tools occasionally highlight the wrong thing.
What Is Hashing? MD5, SHA-1, SHA-256, and When to Use Each
A hash function turns any input into a fixed-length fingerprint. Here is what that actually means, how it differs from encryption and encoding, and which algorithm to reach for in 2026.
Regular Expressions 101: A Developer's Practical Guide
A practical regex tour: character classes, quantifiers, anchors, groups, backreferences, lookaround, flags, catastrophic backtracking, and why you should not parse HTML or JSON with regex.
URL vs URI: What's the Difference?
URI is the superset, URL the subset, URN the naming cousin. Understand the RFC 3986 syntax and when the URL/URI distinction actually matters for signing, redirects and SSRF.
Common URL Encoding Examples: A Reference for Developers
A practical reference table showing how spaces, &, =, ?, #, /, +, @, :, Chinese, emoji and newlines encode under encodeURIComponent, encodeURI and form submission.
URL Encoding Guide: encodeURIComponent, encodeURI, and When to Use Each
encodeURIComponent and encodeURI are not interchangeable. This guide covers their exact difference, URLSearchParams, decodeURIComponent's URIError, and the traps in Python, Go and Java.
What Is URL Encoding? A Developer's Guide to Percent-Encoding
Percent-encoding turns unsafe characters into %XX triplets at the byte level. Learn where reserved and unsafe characters come from, why a space is %20 not +, and the double-encoding trap.
How to Compare Large JSON Files Locally
Dumping a multi-megabyte JSON into an online diff tool leaks data and usually hangs the tab. Normalise first, then compare structurally with jq or a small Python script that runs offline.
How to Convert JSON to YAML (and Back) Without Losing Your Mind
Practical commands and libraries for converting JSON to YAML and back, plus every trap that silently corrupts data: string wrapping, null vs empty, booleans like 'off', special keys, and lost comments.
YAML for Kubernetes: Writing Manifests That Don't Break at 3am
A field-by-field walk through a minimal Kubernetes Deployment and Service: apiVersion, the labels/selector mismatch that silently breaks applies, resource requests and limits, the three probes, and how to diff before you ship.
YAML vs JSON: When to Use Each (and Why the Answer Is 'Both')
YAML and JSON describe the same data but were built for different readers: programs versus humans. This side-by-side comparison covers readability, comments, anchors, type guessing, parse speed, and the security trap that JSON simply does not have.
When to Use YAML (and When You Shouldn't)
YAML earns its place for config that humans edit by hand, and loses it for machine-generated bulk data. Here is a decision guide covering JSON, TOML, INI, and code-as-config options like CUE, Pkl and Starlark.
Common YAML Errors and How to Fix Them
A field guide to the YAML errors people actually hit: mapping values not allowed, missing colon, tab indentation, reserved characters, duplicate keys, yes/no booleans, chomping mix-ups and broken anchors — each with message, repro, cause and fix.
YAML Syntax Guide: Every Directive and Edge Case You Need to Know
The complete YAML syntax reference: indentation rules, quoting strategy, block and folded scalars with their chomping flags, flow style, anchors, merge keys, multi-document files and explicit type tags — each with a runnable example.
What Is YAML? A Developer's Introduction
YAML turns up in Kubernetes, Docker Compose, CI and Ansible before you ever chose it. Here is what it is, why it is built to be read by humans, and the three mistakes that catch nearly everyone.