Guides
9
CSV to JSON: converting without corrupting data
Why CSV parsing is harder than splitting on commas, what nesting does to a conversion, and the type coercion that quietly destroys zip codes and IDs.
3 min read
Password strength: what entropy actually measures
What actually makes a password hard to guess, why forced rotation and complexity rules backfired, and how many bits of entropy you should be aiming for.
3 min read
Unix timestamps: seconds, timezones and 2038
What a Unix timestamp counts, how to tell seconds from milliseconds, why leap seconds are ignored, and how to store dates without a timezone bug.
3 min read
Base64 explained: what it is, and when to use it
How base64 encoding works, why it makes data 33% larger, the difference between base64 and base64url, and the one case where inlining is worth it.
2 min read
Cron expression cheatsheet with the mistakes that bite
Every cron field explained with worked examples, plus the off-by-one and timezone mistakes that quietly break scheduled jobs.
3 min read
How to decode a JWT (and what every claim actually means)
Decode a JSON Web Token by hand or in the browser, understand every registered claim, and know exactly why decoding is not the same as verifying.
4 min read
Why your JSON won't parse, and how to find the character
The five things that make JSON invalid, how to read a parser error into a line and column, and what JSON does not allow that every other format does.
3 min read
Regex cheatsheet: the patterns you actually need
Every regex construct worth memorising, the JavaScript-specific gotchas, and the ambiguity that makes a pattern hang the whole page.
3 min read
UUID v4 vs v7: which one should be your primary key
Why random UUIDs wreck database index performance, how UUID v7 fixes it with a timestamp prefix, and when a plain integer is still the right answer.
4 min read
About developer reference
This hub is the reference half of the site: short, exact answers to the questions that interrupt you mid-task. What Base64 actually encodes and why it is not encryption. Which part of a JWT is signed and which part anybody can read. What a UUID version number tells you about how the value was generated, and when that matters for a primary key.
Each guide is paired with a browser tool that does the job on the page, with nothing sent to a server. That pairing is deliberate: a decoder you can paste a production token into without wondering where it went is more useful than a longer article, and the article exists to explain what the tool just showed you.
The answers are written to be correct at the edges rather than merely approximately right. Padding rules, URL-safe alphabets, timezone handling in timestamps and the difference between an encoding and a hash are the parts that cause real bugs, so they get the space.
Common questions
- Are the tools safe to paste production values into?
- They run entirely in your browser. Nothing you paste is uploaded, logged or stored, and you can confirm it by opening the network tab while you use one.
- Why pair each reference page with a tool?
- Most of these questions arrive while you are debugging something. Getting the answer and the decoded value in one place is faster than reading a specification and then hunting for a working implementation.