Blog

What a JWT Actually Contains

A JWT is three base64url parts: header, payload, and signature. Here is what each holds and why the payload is readable, not encrypted.

UUID v4 vs v7: What Changed and Why

How UUIDs are structured, why v4 is fully random, how v7 embeds a millisecond timestamp for index locality, and the privacy tradeoff of a time-ordered ID.

URL Encoding: When It’s Needed and When It Breaks

How percent-encoding works, reserved vs unreserved characters, encodeURIComponent vs encodeURI, %20 vs +, and the double-encoding bugs that break URLs.

Unix Timestamps and Timezone Handling

A Unix timestamp counts seconds since 1970 UTC. Learn seconds vs milliseconds, UTC vs local, ISO 8601, and the accurate Year-2038 problem.

Regex Quantifiers: Greedy vs Lazy Matching

Regex quantifiers *, +, ?, and {n,m} are greedy by default. Learn how adding ? makes them lazy, how backtracking works, with worked examples.

Redirect Rules: htaccess and nginx Compared

Apache RewriteRule and Redirect versus nginx rewrite and return: 301 vs 302, regex backrefs, flags, and testing before you deploy.

Reading a Diff Properly

How to read a unified diff: the @@ hunk header, + and - lines, context lines, line-level vs word-level diffs, and when to ignore whitespace.

MD5 vs SHA-256: Which to Use and When

MD5 is 128-bit and broken for security; SHA-256 is 256-bit and sound for integrity. When each is fine, when it is dangerous, and what to use…

JWT Expiry, Refresh, and Common Mistakes

How JWT expiry claims (exp, nbf, iat) work, why access and refresh tokens are split, and the security mistakes that keep breaking auth.

JSON vs YAML vs TOML: When to Use Which

An honest comparison of JSON, YAML, and TOML: syntax, readability, gotchas, and which format fits APIs versus config files.