Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Your Regex Works Until Someone Named Müller Signs Up
Your Token Generator Is Biased Even With a Secure Source
A token generator using a secure random source can still be biased — modulo on a 62-character set isn't uniform. Plus why 32-bit IDs collide after 77,000 values.
The 200 Response Is the Least Useful Thing You Can Test
The successful request is the least informative test. Response headers, error paths and duplicate-request behaviour are where API integrations actually break.
Why Composition Rules Make Passwords Weaker, Not Stronger
Composition rules reduce entropy, symbols break config files, and bcrypt silently ignores anything past 72 bytes. What actually makes a generated password work.
Why Hex Won: One Digit, Exactly Four Bits
Hex won because 16 is a power of 2, so each digit is exactly four bits. That single property makes byte boundaries, bitmasks and memory alignment visible at a glance.
JWT Claims: The Seven Registered Ones and Why aud Matters
Seven registered JWT claims have defined meanings; everything else is yours and is ignored unless you check it. What each claim does and which ones libraries skip.
Unexpected Token at Position 847: Debugging JSON Errors
"Unexpected token at position 847" has a short list of likely causes. Here's every JSON parse error, what triggers it, and the two that fail without throwing at all.
eyJ, iVBOR, JVBER: Identifying Base64 Before You Decode It
iVBOR is a PNG, JVBER is a PDF, eyJ is JSON. Base64 prefixes identify content before decoding — plus what "invalid character" and "incorrect padding" actually mean.
Your Password Hash Is a Denial-of-Service Amplifier
A deliberately slow hash makes your login endpoint a denial-of-service amplifier. Rate limiting before hashing, dummy hashes for unknown users, and async execution fix it.
Your JSON Diff Shows 40 Changes and 28 Are Noise
A correct diff can still be useless when 28 of 40 changes are timestamps and reordered arrays. Normalisation is what turns structural comparison into a usable signal.
How Many Times Should You Unescape? Count the Backslashes
Three backslashes before a quote means two layers of encoding. How to count escape layers precisely, unescape safely, and fix the producer that caused it.
Why Comparing Hashes With == Leaks Your Secret
Comparing a signature with === leaks it one byte at a time, and hash(secret + message) can be forged without the secret. Two one-line fixes for both.
The Invisible HTML Entities: nbsp, shy and Zero-Width Spaces
Non-breaking spaces, soft hyphens and zero-width spaces control how text wraps — and they're invisible in your source. Why entity form matters and where each belongs.
