Blog

JSON Explained: Syntax, Common Errors, and How to Fix Them

A clear guide to JSON syntax and data types, plus the parse errors that trip everyone up and exactly how to fix each one.

How Password Hashing Actually Works

Why you never store plaintext, why fast hashes like MD5 are wrong for passwords, and how salts and slow KDFs (bcrypt, scrypt, Argon2) protect them.

Secrets in Source Control: How to Find and Remove Them

Why committed API keys and tokens are dangerous, regex patterns to hunt them down, why you must rotate first, and how to purge them from Git…

Why You Shouldn’t Paste Production Tokens Into Online Tools

Pasting a live JWT or API key into a random online decoder can leak it to a server. How to tell if a tool is client-side,…

Cron Syntax Explained, Field by Field

A field-by-field guide to cron syntax: the five time fields, stars, ranges, steps, lists, and the day-of-month/day-of-week gotcha.

Converting cURL to Code, Correctly

How a curl command maps to fetch, axios, requests and Go, plus the quiet pitfalls: implicit POST, content-type, and shell quoting.

Content Security Policy for People Who Keep Breaking It

A plain explanation of CSP: default-src, script-src, connect-src, self and unsafe-inline, why inline scripts break, and how connect-src blocks data exfiltration.

Colour Contrast and WCAG in Practice

How the contrast ratio is computed from relative luminance, the real WCAG AA and AAA thresholds, and practical tips for accessible text.

Client-Side vs Server-Side: What Stays Private

What "runs in the browser" really means, how to verify no data leaves your machine with the DevTools Network tab and CSP, and why client-side tools…

Base64: What It Does and What It Isn’t

Base64 turns binary into safe ASCII text for transport, adds about 33% size, and is not encryption or compression. Here is what it really does.