Blog
Technical walkthroughs, debugging checklists, security workflow notes, and tool-specific guides for Online Dev Tools.
New posts are published from local drafts on a scheduled workflow, then surfaced here, in RSS, and in the sitemap.
-
Regex That Doesn't Backtrack You Into a Corner: Greedy vs Lazy, Anchors, and Groups
Most regex pain comes from a few misunderstood ideas — greedy quantifiers, missing anchors, and capture vs non-capture groups. Here is how to write patterns that do what you meant.
Read article -
YAML Gotchas: The Norway Problem, Tabs, and Multiline Strings
YAML looks friendly and bites hard. The Norway problem, why tabs break everything, quoting rules, and how to handle multiline strings without surprises.
Read article -
TOTP and 2FA Explained: How the 6-Digit Code Actually Works
The rotating 6-digit code in your authenticator app is not magic — it is an HMAC over the current time and a shared secret. Here is how TOTP works, why codes fail, and what the QR code really contains.
Read article -
Unix Timestamps, Time Zones, and the Off-by-One-Hour Bug
A Unix timestamp is just seconds since 1970 UTC — no time zone attached. Here is where that trips people up, the seconds-vs-milliseconds gotcha, and how to sanity-check a timestamp fast.
Read article -
UUIDs, ULIDs, and Random Tokens: Choosing Identifiers That Don't Leak
Not all IDs are equal. When to use a UUID v4, when sequential IDs leak business data, why v7/ULID exist, and how to generate tokens that are actually unguessable.
Read article -
"Base64 Is Not Encryption: What It's For and How to Read It"
Base64 encodes bytes into safe text — it hides nothing. Here is what it actually does, where it shows up (JWTs, data URLs, email), and why treating it as security is a mistake.
Read article -
"CIDR Subnetting Without the Headache: Masks, Ranges, and Host Counts"
A plain-English guide to reading CIDR notation — what the /24 means, how to find the network, broadcast, first and last usable host, and how many addresses a block actually holds.
Read article -
"Stop Eyeballing JSON Diffs: Sort Keys, Normalize, Compare"
Two JSON blobs that are semantically identical can diff as wildly different because of key order and formatting. Normalize first, then compare — here is the quick workflow.
Read article -
A Pragmatic Content-Security-Policy for Static Sites and SPAs
A no-nonsense path to a useful CSP — start in report-only, kill unsafe-inline with hashes or nonces, and tighten connect-src — without breaking your site on day one.
Read article -
"JWT Security in 2026: alg:none, Key Confusion, and Reading Tokens Safely"
JWTs are easy to decode and easy to get wrong. A practical look at the alg:none trap, RS256-to-HS256 key confusion, what a decoder can and cannot tell you, and how to verify tokens correctly.
Read article -
Converting IP Addresses Between Decimal, Hex, and Binary: When and Why
An IPv4 address is just a 32-bit number wearing four dotted octets. Here is when you actually need it as an integer, hex, or binary — and how to convert without second-guessing yourself.
Read article -
The 2026 npm Supply-Chain Attacks: A Developer's Defense Checklist
2026 brought a wave of npm supply-chain attacks — the Red Hat namespace compromise, the Axios hijack, and typosquats that steal CI/CD secrets. Here is what happened and a practical checklist to protect your builds.
Read article -
Print-Ready PDFs from HTML: Paged.js, Headless Chromium, and the Truncated-Render Pitfall
A practical workflow for turning HTML and CSS into paginated, print-ready PDFs with Paged.js and headless Chromium — including the async-render pitfall that silently truncates your document to one page.
Read article -
Password Strength Is Mostly Length: Entropy, Crack Times, and What Actually Helps
What password 'entropy' really measures, how offline crack-time estimates work, why length beats symbol-swapping, and the handful of habits that actually keep accounts safe.
Read article -
Triaging a Suspicious Domain From the Browser: A Five-Minute Workflow
A fast, repeatable workflow for triaging a suspicious domain using only browser-based tools — resolve it, attribute the IP, check the range, and pull registration data.
Read article -
Log Triage Checklist for Faster Incident Response in the Browser
A practical checklist for sorting noisy logs, isolating the first meaningful error, and moving from raw output to a clear incident lead.
Read article -
Hashing vs HMAC for Engineers: Choosing Algorithms and Avoiding Common Mistakes
Learn when to use plain hashing vs HMAC, how to choose algorithms like SHA-256, and avoid critical security mistakes. Practical guide for engineers.
Read article -
WHOIS and Domain Intelligence: Investigating Ownership, Registrar Signals, and Response Workflows
Learn how WHOIS lookups reveal domain ownership, registrar data, and abuse signals. Build effective investigation and response workflows with domain intelligenc
Read article -
JSON Formatting for API Debugging: Predictable Diffs, Key Sorting, and Schema Checks
Learn how JSON formatting with key sorting and schema validation streamlines API debugging, produces predictable diffs, and speeds up code review.
Read article -
CSP Hardening Workflow: From Report-Only to Full Enforcement with Practical Testing
Learn how to harden Content Security Policy step by step—starting in report-only mode, analyzing violations, and enforcing safely with practical testing.
Read article -
Building a Lightweight Incident-Response Toolbelt in the Browser: Repeatable Workflows
Learn how to build a browser-based incident response toolbelt with repeatable workflows using lightweight online dev tools for faster triage and resolution.
Read article