Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
JSON Inside JSON: Why Some Fields Are Strings Containing Their Own JSON, and How to Parse Them
A field containing `"{\"name\":\"Alice\"}"` isn't broken — it's JSON stored as a string, inside a JSON document, a deliberate pattern in logging systems, GraphQL, and webhook relays. Here's how to recognize this pattern by its escaped quotes, why it requires two separate parsing steps, and how to tell when it's a legitimate design choice versus an unnecessary double-stringification bug.
#FF5733, 00:1A:2B:3C:4D:5E, and IPv6: Three Everyday Hex Formats, Three Different Reasons for Hex
Color codes, MAC addresses, and IPv6 addresses all use hexadecimal — but for different reasons rooted in what each format actually represents. Here's how hex's "two digits per byte" property makes color codes' three-channel structure visible at a glance, why MAC addresses' hex grouping aligns with manufacturer-ID lookups, why IPv6's 128-bit addresses would be unwieldy in decimal, and how the "::" shorthand compresses runs of zero-groups.
JWT vs Opaque Session Tokens: Why This Tool Can Decode Some Tokens and Not Others
Some APIs return a token that decodes into readable claims; others return an opaque string that reveals nothing. The difference isn't a quality signal — it's the fundamental architectural choice between stateless JWTs (the token contains the session data) and stateful opaque tokens (the token is a lookup key into a server-side session store). Here's why instant revocation pushes some systems toward the "extra database lookup" approach, and what it means when a token you paste into this tool decodes to nothing.
JSON Patch, Merge Patch, JSON Pointer, and JSON Path: The Standards Most Developers Don't Know
JSON Patch (RFC 6902) sends a list of operations (add, remove, replace, test) to modify a resource atomically. JSON Merge Patch (RFC 7396) uses a simpler merge rule. Here's both standards with examples, JSON Pointer path syntax, JSON Path for querying, and why the `test` operation enables optimistic concurrency.
Named Capture Groups, Lookahead, and Lookbehind: Modern Regex Features That Make Patterns Readable
Named capture groups turn regex matches from numbered tuples into readable dictionaries. Lookahead and lookbehind assertions match positions without consuming characters. Here's the modern regex feature set — named groups, non-capturing groups, all four assertion types — with practical patterns for log parsing and URL extraction.
Why 9007199254740993 Becomes 9007199254740992: JSON Numbers and JavaScript's Precision Limit
A JSON number like 9007199254740993 can become 9007199254740992 just by being parsed in JavaScript — not a bug in the parser, but a mismatch between JSON's unlimited-precision number specification and JavaScript's double-precision floating point, which can't represent integers above 2^53 exactly. Here's why this specifically affects large database IDs, the common "represent as string" workaround, and why this creates cross-language inconsistencies when backends and JavaScript frontends disagree about what "the same number" means.
Unicode Fundamentals: ASCII History, UTF-8 Encoding, Byte Order Marks, and Why Mojibake Happens
ASCII was designed in 1963 for 7-bit telegraph machines. Every country's attempt to extend it to 8 bits was incompatible, producing mojibake when files crossed systems. Here's how Unicode solved the problem, why UTF-8 became dominant (backward compatibility with ASCII), what byte order marks are, and what character encoding corruption actually looks like.
Cron and Daylight Saving Time: Why Your 2:30 AM Job Didn't Run — or Ran Twice
A cron job scheduled for 2:30 AM doesn't run on "spring forward" night, because 2:30 AM doesn't exist that night — and the same job might run twice on "fall back" night, because 2:30 AM happens twice. Here's why this is exactly the time window many maintenance jobs use, why UTC eliminates the problem entirely for most automated jobs, and why "9 AM local time" scheduling that survives DST requires timezone-aware libraries, not static cron expressions.
How the Cron Daemon Works: OS Scheduling, Process Priority, and When to Use systemd Timers Instead
Cron wakes up once per minute, runs with a minimal PATH, and executes via /bin/sh — which is why working shell commands often fail in crontabs. Here's how crond works as a daemon, why environment variables must be set explicitly, process priority with nice values, and why systemd timers handle missed jobs better.
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.
Color Blindness and Design: Why Redundant Signals Matter More Than "Colorblind-Safe" Palettes Alone
Roughly 1 in 12 men have some form of red-green color vision deficiency — meaning "red means error, green means success" relies on a color distinction that's specifically the hardest for the most common type of color blindness. Here's how different CVD types affect color perception differently, why redundant non-color signals (icons, labels, patterns) are the core fix, and how CVD simulation reveals confusable color pairs during design review.
UUID v4 vs UUID v7 vs ULID vs NanoID: Which Identifier Format Should You Use?
UUID v4's random bits fragment database B-tree indexes, causing write amplification. UUID v7 adds a millisecond timestamp prefix to fix this. ULID is sortable and URL-safe without hyphens. NanoID is compact and customisable. Here's how each works and when to choose each format.
