Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
Bcrypt's 72-Byte Limit: Why Two Different Passwords Can Hash to the Same Value
Bcrypt silently truncates input at 72 bytes — meaning two passwords sharing the same first 72 bytes but differing afterward produce the identical hash. Here's why 72 specifically, how multi-byte Unicode characters (emoji especially) reach this limit far sooner than "72 characters" suggests, why pre-hashing with SHA-256 is a common mitigation, and why this isn't actually a meaningful security concern for typical passwords.
Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Standard Base64's `+`, `/`, and `=` characters all have special meaning in URLs — which is why a Base64-encoded JWT pasted directly into a URL can silently corrupt, and why Base64url exists as a separate, URL-safe alphabet. Here's exactly which characters differ, why JWTs require Base64url specifically, how padding works and why Base64url commonly omits it, and how to tell the two variants apart.
JSON Patch and JSON Pointer: How "What Changed" Becomes a Standardized, Executable Sequence of Operations
"What's different between these two JSON documents" and "what's the smallest sequence of operations that transforms one into the other" are related but distinct questions — the second is what JSON Patch (RFC 6902) standardizes. Here's the six JSON Patch operations, the JSON Pointer path syntax they rely on, how the test operation enables optimistic concurrency control, and when the simpler JSON Merge Patch is sufficient instead.
JWT Token Refresh Strategies: Access Tokens, Refresh Rotation, and When Sessions Beat JWTs
Short-lived access tokens require a refresh mechanism — and how you implement that mechanism determines your app's security and user experience. Here's refresh token rotation, silent refresh in SPAs, theft detection via refresh token families, and the cases where server-side sessions are simpler and safer.
URL Design as API Design: REST Conventions, Versioning Strategies, and the Long-Term Cost of Changing URLs
REST URL conventions, API versioning strategies (URL path vs header vs date-based like Stripe), trailing slash canonicalization, URL length limits, and the link rot problem — URL design decisions made at launch determine API maintainability for years.
Practical JSON Diff Workflows: Debugging APIs, Finding Config Drift, and Verifying Migrations
The most common reason to reach for a JSON diff tool is "something changed and I need to know exactly what, fast." Here's four practical workflows: diagnosing API response changes, finding configuration drift between environments, verifying data migrations changed only what was intended, and triaging failing test assertions where the actual difference is buried in a large JSON structure.
JSON Diff: Why Structural Comparison Matters and How It Handles Key Order, Formatting, and Arrays
Two JSON documents can be semantically identical while looking completely different to a text diff tool — different key order, formatting, or minification all produce false "differences." Here's how structural JSON diffing actually works, why array comparison is the hardest part, and practical uses for API testing, config comparison, and data migration verification.
Credential Breaches and Stuffing Attacks: What Leaked Password Databases Reveal and How HIBP Works
Have I Been Pwned has indexed 12+ billion breached accounts. Here's what a leaked credential database actually looks like, how attackers use credential stuffing at scale, the k-anonymity trick that lets HIBP check passwords without seeing them, and why bcrypt salting defeats rainbow tables.
Design Tokens, CSS Variables, and Dark Mode: How to Build a Colour System That Scales
Design tokens are a three-tier hierarchy: primitive colours → semantic meanings → component-specific use. CSS custom properties implement this at runtime, making dark mode a one-place change. Here's the full token model, how Tailwind's colour system works, and why OKLCH is replacing HSL for design systems.
How Email Attachments Work: MIME Encoding, Base64, and Why Binary Files Need Encoding
Email attachments work because MIME uses Base64 to encode binary files as ASCII text — a system designed in 1992 when email could only carry 7-bit ASCII. Here's how MIME multipart email works, why binary needs encoding, the 33% Base64 overhead on attachment sizes, and how the same system handles HTML form file uploads.
Production Scheduled Jobs: Idempotency, Monitoring, and Modern Alternatives to Cron
Cron jobs fail silently and traditional cron has no alerting, no history, and no overlap prevention. Here's idempotency design for scheduled jobs, modern alternatives (Celery Beat, AWS EventBridge, Kubernetes CronJobs), and the dead man's switch monitoring pattern.
JSON Schema Validation and API Contracts: OpenAPI, Contract Testing, and Validation Libraries
JSON Schema validates structure and constraints — and OpenAPI uses it as the contract format for API documentation, client SDK generation, and contract testing. Here's how JSON Schema works, key validation keywords, how OpenAPI extends it, and how Pact implements consumer-driven contract testing.
