JWT Expiry, Refresh, and Common Mistakes
By qc_admin
How JWT expiry claims (exp, nbf, iat) work, why access and refresh tokens are split, and the security mistakes that keep breaking auth.
Author: qc_admin
MD5 vs SHA-256: Which to Use and When
By qc_admin
MD5 is 128-bit and broken for security; SHA-256 is 256-bit and sound for integrity. When each is fine, when it is dangerous, and what to use instead.
JSON vs YAML vs TOML: When to Use Which
By qc_admin
An honest comparison of JSON, YAML, and TOML: syntax, readability, gotchas, and which format fits APIs versus config files.
JSON Explained: Syntax, Common Errors, and How to Fix Them
By qc_admin
A clear guide to JSON syntax and data types, plus the parse errors that trip everyone up and exactly how to fix each one.
How Password Hashing Actually Works
By qc_admin
Why you never store plaintext, why fast hashes like MD5 are wrong for passwords, and how salts and slow KDFs (bcrypt, scrypt, Argon2) protect them.
Secrets in Source Control: How to Find and Remove Them
By qc_admin
Why committed API keys and tokens are dangerous, regex patterns to hunt them down, why you must rotate first, and how to purge them from Git history.
Why You Shouldn’t Paste Production Tokens Into Online Tools
By qc_admin
Pasting a live JWT or API key into a random online decoder can leak it to a server. How to tell if a tool is client-side, and why it matters.
Cron Syntax Explained, Field by Field
By qc_admin
A field-by-field guide to cron syntax: the five time fields, stars, ranges, steps, lists, and the day-of-month/day-of-week gotcha.
Converting cURL to Code, Correctly
By qc_admin
How a curl command maps to fetch, axios, requests and Go, plus the quiet pitfalls: implicit POST, content-type, and shell quoting.
Content Security Policy for People Who Keep Breaking It
By qc_admin
A plain explanation of CSP: default-src, script-src, connect-src, self and unsafe-inline, why inline scripts break, and how connect-src blocks data exfiltration.