Blog
Tool guides, tips, and developer references.
-
GIF Compressor: Shrink Animated GIFs with Lossy LZW and Fewer Colors
Compress GIF files in the browser: how lossy LZW, palette size, dithering, resizing and frame skipping change the size, with measured results and CLI recipes.
-
Redact Secrets Before You Paste Logs into an AI Chat or an Issue
What leaks when you paste logs or .env files into an AI chat or GitHub issue, how redaction with stable placeholders works, and what to do once a key is out.
-
Why CAs Reject Your CSR — and How to Catch It First
The seven things a certificate authority checks before it will sign a PKCS#10 request, why CN without SAN produces a useless certificate, and how to verify a CSR's self-signature yourself.
-
Barcodes That Actually Scan: A Developer's Guide
Pick the right 1D symbology, compute check digits correctly, and avoid the print mistakes that turn a valid barcode into an unreadable label.
-
CSS clamp(): Precise Fluid Typography
Derive exact CSS clamp() values from two viewport endpoints, then validate the math, accessibility, and production code.
-
DNS Lookup in the Browser: A, MX, TXT, and CAA via DNS-over-HTTPS
Look up DNS records from any browser without dig, nslookup, or whatsmydns. How DoH unlocks A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, PTR, and SRV in a fetch() call — with DNSSEC, TXT-segment, and propagation gotchas.
-
Zero-Width Character Detector: Find Hidden Unicode in AI Output and Code
Detect and strip invisible Unicode characters — zero-width spaces, BOM, bidirectional controls, Unicode tag characters that hide ASCII text — from any text. Trojan-Source aware. Runs in your browser.
-
Read HTTP Headers Like a Pro: A Practical Guide
Paste raw HTTP headers and inspect security, caching, CORS, and cookie metadata in one pass. Learn the categories, the compliance traps, and how to use the headers your code is already sending.
-
Why event.keyCode Lies to You: A Modern Guide to JavaScript Keyboard Events
Stop guessing event.key vs event.code vs keyCode. See exactly what the browser fires, when modifier keys flip, why IME composition breaks single-key handlers, and how to write keyboard shortcuts that survive non-QWERTY layouts.
-
Pick Any Pixel on Your Screen with the EyeDropper API
A developer's guide to the browser-native EyeDropper API — how it works, where it falls short, and how to use it to sample colors from screenshots, videos, and other apps.
-
MIME Types: Syntax, the IANA Registry, Server Defaults and File Sniffing
What a MIME type is and how to write one, which types IANA registers, what Nginx and Apache actually send, how Chrome enforces types, and why file extensions and magic bytes disagree.
-
IBAN Validator: Catching the Wrong Bank Account Before It Costs You
Inside the mod-97 algorithm, the country-by-country BBAN structure, and the OCR-era pitfalls that bounce SEPA payments. With a free browser-side IBAN checker.
-
File Hash Checker: Verifying Downloads with SHA-256 in the Browser
Compute SHA-256, SHA-1, SHA-384, SHA-512, MD5 or CRC32 of local files of any size, streamed in your browser, and check them against a hash or a SHA256SUMS list.
-
PKCE Generator: Wire Up OAuth Authorization Code Flow Without Mistakes
Generate code_verifier and code_challenge pairs, plug them into /authorize and /token, and avoid the five PKCE mistakes that silently break login on mobile and SPAs.
-
SSL Certificate Decoder: A Practical Guide to X.509 PEM Inspection
Decode any X.509 PEM certificate to read Subject, Issuer, SANs, validity, key type, signature algorithm, and fingerprints — without uploading the file or running OpenSSL.
-
Content Security Policy: A Strict, Nonce-Based CSP Tested in Chrome
How Content Security Policy decides what runs, why nonce plus strict-dynamic beats allowlists, what Chrome 152 blocks and logs, and how to roll a policy out with Report-Only first.
-
What Is a Token in AI? How Tokenizers Count Your Text
A token is a piece of text with a number. See how GPT, DeepSeek, Claude and Gemini tokenizers split the same sentence, why counts differ by language, and how to count them.
-
Timezone Converter: IANA, DST, and the UTC Offsets That Burn Engineers
How IANA timezones, DST transitions, and UTC offsets actually work — plus copy-paste conversion code for JavaScript, Python, Go, Java, and SQL.
-
Markdown TOC Generator: One File, Four Anchor Dialects
Generate a clickable Markdown table of contents that actually works on GitHub, GitLab, Jekyll, and Bitbucket. Covers anchor slug algorithms, dedup rules, marker-based in-place updates, and the cross-platform traps that silently break your links.
-
Open Graph Meta Tags: What Facebook, X, Slack and LINE Read From Your Page
The Open Graph protocol's four required tags, how image arrays work, and what Facebook, X, Slack, LINE and Google each read, cache and ignore, with real generator output.
-
Cubic Bezier Generator: Stop Guessing CSS Easing Curves
Drag two control points, see the animation run, and copy CSS / SCSS / Tailwind. Plus: the math behind cubic-bezier, design system presets, and failure modes that ship to production.
-
Favicon Sizes: Which Ones You Need and What Browsers Actually Fetch
Favicon sizes explained from the specs and a browser test: 16, 32 and 48 in favicon.ico, 180 for iOS, 192 and 512 for the manifest, SVG, and what Google Search requires.
-
Color Contrast Checker: Pass WCAG AA Without Killing Your Brand Color
Pick foreground and background, get the WCAG 2.x ratio, AA/AAA pass-fail across body/large/UI, and a hue-preserving fix when contrast is too low.
-
EXIF Metadata Viewer: Strip GPS and Camera Info from Photos in Your Browser
View EXIF metadata and strip EXIF, XMP, and IPTC marker segments from JPEG photos client-side. Covers the JPEG marker layout, GPS coordinate decoding, and what social platforms actually strip.
-
CSS box-shadow Explained: Syntax, Blur, Spread, Inset and drop-shadow()
How CSS box-shadow works per the spec and in Chrome: optional color, blur as a Gaussian, spread and border-radius, inset, layered shadows, filter: drop-shadow() and repaint cost.
-
ULID Generator: What Is a ULID and Why It Beats UUID for Sorting
ULID vs UUID — understand the difference, when to use a ULID, how to generate one, and how ULIDs solve ordering problems in distributed systems.
-
10 Developer Productivity Hacks You Can Do Right in Your Browser
Boost your dev workflow with these 10 browser-based productivity tricks — no installs needed. Format JSON, decode JWTs, generate UUIDs, and more in seconds.
-
The Evolution of Developer Tools: From CLI to Browser
How developer tools shifted from local CLI utilities to cloud-hosted services to client-side browser apps — and why the browser-based model is winning.
-
From Messy JSON to Clean APIs: A Real-World Debugging Story
A walkthrough of a realistic API debugging session — using browser tools to decode tokens, diff responses, format payloads, and finally fix the bug.
-
Web Security Best Practices: The OWASP Top 10:2025 as a Working Checklist
Web security best practices mapped to the OWASP Top 10:2025: access control, injection, XSS, CSRF, password storage, sessions, security headers, tokens, dependencies and logging, with runnable code.
-
Why Every Developer Needs a Toolbox: Building Efficient Workflows
The best developers aren't the smartest — they're the most deliberate about their tools. Here's why a curated developer toolbox is a force multiplier for your workflow.
-
Subnetting Explained: Subnet Masks, CIDR Prefixes and VLSM in Binary
Subnetting worked in binary: mask and prefix conversion, finding the network of any address, RFC 950 and RFC 4632 CIDR, VLSM, /31 and /32, and cloud reserved addresses.
-
CSS Specificity Calculator: Check and Debug Selector Weights Online
Use our CSS specificity calculator online to check selector weights instantly. Understand the 0-0-0 notation, avoid common gotchas, and fix cascade conflicts.
-
AES Encryption: Key Sizes, Modes, IVs and the Mistakes That Break It
How AES encryption works in practice: FIPS 197 key sizes and rounds, why ECB leaks and CBC padding oracles happen, the GCM nonce rule, PBKDF2 for passwords, and a byte-level ciphertext format you can reproduce.
-
CSS Flexbox Explained: Axes, the flex Shorthand, min-width: auto and align-content
How CSS flexbox distributes space, checked in Chrome: main and cross axis, what flex: 1 and flex: auto mean, flex-shrink, why items overflow, auto margins, wrapping, align-content, gap.
-
CSS Grid Explained: Tracks, fr, Named Areas, auto-fill vs auto-fit and Subgrid
How CSS Grid sizes and places things, checked in Chrome: fr and minmax(), why 1fr columns overflow, implicit tracks, named lines and areas, auto-fill vs auto-fit, subgrid.
-
JSONPath: RFC 9535 Syntax and How Libraries Differ (Tested)
JSONPath per RFC 9535: selectors, filters and functions, plus 16 queries run through jsonpath-plus, jsonpath, jsonpath-ng and Jayway to show where results differ.
-
CSS Variables Explained: Custom Properties, var() Fallbacks, @property and Dark Mode
How CSS variables (custom properties) work per the spec and in Chrome: inheritance, var() fallbacks, invalid values, @property, JavaScript access, Sass differences and dark mode.
-
.env File: Syntax, Parser Differences, and Keeping Secrets Out of Git
How a .env file is read: one sample file parsed by dotenv, Node's --env-file, python-dotenv, godotenv and Docker Compose, which value wins, and how to keep secrets safe.
-
Htaccess Generator Online: Apache Rules Without the Manual
Write Apache .htaccess rules for HTTPS and www redirects, caching and security with a generator, plus hand-written examples for CORS, Basic Auth, compression and error pages.
-
JSON Schema: Drafts, Core Keywords, and How Validators Really Differ
JSON Schema from draft-04 to 2020-12 with spec links, the keywords you use daily, and one schema run through Ajv, Python jsonschema and Go jsonschema v6, including format.
-
robots.txt Explained: Groups, Longest Match and How Crawlers Read the File
How robots.txt works under RFC 9309: which group a crawler picks, why the longest rule wins, wildcards, status codes, AI crawler tokens, and tests with Protego and Python.
-
TOTP Explained: How RFC 6238 Codes Are Computed, Checked and Verified
How a TOTP code is built from a secret and the clock, worked through with the RFC 6238 test vectors, plus what authenticator apps read from otpauth:// URIs and how servers should verify codes.
-
WebP: How the Format Works, Browser Support, and Measured File Sizes
WebP explained from the file up: lossy VP8, lossless VP8L and the RIFF container, caniuse support data, and cwebp, sharp and Chrome sizes for a photo, a text chart and a logo.
-
Cron Expression Syntax: Fields, Examples and Scheduler Differences
How a cron expression works: the five fields, *, comma, range and step rules, the day-of-month OR day-of-week trap, and how crontab, Quartz, Spring, EventBridge, GitHub Actions and Kubernetes differ.
-
HMAC Explained: How HMAC-SHA256 Signs Webhooks and API Requests
How HMAC works step by step (RFC 2104), why it beats hash(key + message), how GitHub, Stripe, Slack, Twilio and AWS use it, and how to verify a signature without the usual mistakes.
-
Markdown Table Syntax: Alignment, Escaping Pipes, Line Breaks and Renderers
How GFM Markdown tables work: the delimiter row, alignment colons, when a table ends, escaping | inside code, <br> line breaks, CJK text, and what GitHub, GitLab, Obsidian, Qiita and Zenn do differently.
-
URL Slug Guide: Google's Rules, WordPress and Shopify Slugs, and Why Slugifiers Disagree
What a URL slug is, what Google's URL guidance actually says, how WordPress and Shopify build slugs, how non-ASCII slugs are encoded, and how six slugifiers handle the same titles.
-
Camel Case Explained: camelCase, PascalCase and What Style Guides Say About Acronyms
camelCase and PascalCase compared with snake_case and kebab-case, what PEP 8, Go, .NET, Google and Rust guides require, and how converters split acronyms and numbers.
-
Parts of a URL: Scheme, Host, Port, Path, Query and Fragment
Every part of a URL explained with RFC 3986 and the WHATWG URL Standard: scheme, user info, host, port, path, query, fragment and origin, default ports, IDN, public suffixes and where parsers disagree.
-
ASCII Table: All 128 Codes in Decimal, Hex, Octal and Binary
The complete ASCII table, codes 0 to 127, in decimal, hex, octal and binary, with the meaning of every control character, the bit patterns behind the layout, and what changes above 127.
-
How to Find Aspect Ratio: Formula, Worked Examples and Resolution Table
The aspect ratio formula with worked examples: simplify width:height with the GCD, solve for a missing side, fit 2.39:1 into 16:9, and a table of common resolutions with exact ratios.
-
chmod 755 Explained: Octal Modes, Directories, umask and Special Bits
chmod 755 bit by bit: octal and symbolic modes, what r/w/x do on directories, umask, setuid/setgid/sticky, and where GNU and macOS chmod differ, all tested.
-
HTML Symbols: Entity Names, Decimal and Hex Codes to Copy
Copy-ready HTML symbol codes for spaces, quotes, currency, math, arrows and shapes, with every named, decimal and hex form taken from the WHATWG list, plus the escaping rules and parser quirks that break pages.
-
What Is a JWT? JSON Web Tokens Explained with a Decoded Example
What a JWT is, byte by byte: header, claims and signature per RFC 7519, how HS256 and RS256 signatures are checked, and the alg:none and algorithm confusion attacks from RFC 8725.
-
What Is Lorem Ipsum? Cicero's Text, the 1914 Page Break and When to Use It
Lorem ipsum is scrambled Latin from Cicero's De finibus 1.10.32–33. Where each word comes from, why it starts with 'lorem', how it differs from English, and when to avoid it.
-
Markdown Cheat Sheet: CommonMark and GitHub Syntax with Rendered Output
Markdown cheat sheet checked against CommonMark 0.31.2 and GFM: headings, line breaks, lists, code, links, tables, task lists, raw HTML, GitHub-only syntax, and where GitHub and Notion differ.
-
How to Convert Binary to Decimal: Place Values, Doubling and Back Again
Convert binary to decimal by hand with place values or the doubling method, go back with repeated division, and handle fractions, negative numbers and the usual mistakes.
-
How to Create a Strong Password: Length, Randomness and the NIST Rules
How to create a strong password: let a CSPRNG choose it, count its bits, see how fast GPUs guess, follow NIST SP 800-63B, use Diceware and check breach data.
-
URL Encode / Decode Online: Percent Encoding Explained
Learn how URL encoding (percent encoding) works, when to use encodeURIComponent vs encodeURI, and how to encode and decode URLs instantly online.
-
What Is a UUID? Versions 1–8, Bit Layout and Collision Odds
What a UUID is, per RFC 9562: the 128-bit layout, how to read the version and variant digits, all eight versions with test vectors, the v4 collision math, and how to store UUIDs.
-
Regex Cheat Sheet: Syntax, Flags and Engine Differences (JS, Python, PCRE, Go)
Regex cheat sheet with tested examples: classes, Unicode u and v flags, anchors, lazy and possessive quantifiers, named groups, lookbehind, and where JavaScript, Python, PCRE2 and Go differ.
-
Base64 Encoding Explained: What It Is and How to Use It
Understand what Base64 encoding is, why it exists, how to encode and decode in JavaScript, Python, and the command line — plus a free online Base64 tool.