Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
GraphQL's Introspection Query Is an Attacker's Best Friend — Batching, Nested Query DoS, and Persisted Queries
URL Structure: Query String Parsing Ambiguities, Punycode, and Open Redirect Vulnerabilities
A URL has five components — and bugs come from confusing which part you're encoding. Here's query string parsing ambiguities between frameworks, IDN Punycode for international domains, URL normalisation for comparison, open redirect vulnerabilities, and relative URL resolution edge cases.
Data URLs and Base64: When to Embed Resources Inline vs Link to Them
Data URLs embed files directly in HTML and CSS as Base64 strings — no separate HTTP request. Here's when that's faster, when it makes things worse, how JWT tokens use Base64URL, and how inline images in emails work around image blocking.
Beyond UUID: How Twitter's Snowflake IDs, ULID, CUID2, and Nano ID Work
Twitter, Discord, and Instagram all built custom ID systems because UUID couldn't handle time-sortability, distributed generation, and 64-bit constraints simultaneously. Here's how Snowflake IDs work, what ULID and CUID2 offer, and when each alternative makes sense.
Colour Contrast and Accessibility: WCAG Ratios, Common Failures, and Accessible Design Systems
WCAG contrast requirements are now enforceable law in the EU and UK. Here's how contrast ratios are calculated from RGB values, which common colour combinations fail (including Bootstrap blue), and how to build accessible colour systems from the start.
JSON vs YAML vs MessagePack vs Protocol Buffers: Which Format for Which Use Case
JSON has no comments, no date type, and a number precision problem that caused Twitter to change their API. Here's how JSON compares to XML, YAML, MessagePack, and Protocol Buffers, when each format makes sense, and what JSON Schema adds.
URL Encoding Edge Cases That Break Real Applications
The difference between encoding a full URL and a URL component, why + and %20 aren't always interchangeable, how double-encoding silently corrupts data, and the characters that break most URL handling code.
UUID v1, v4, v5, v7 Compared — Which Version Should You Actually Use?
UUID v1, v3, v4, v5, and v7 all work differently and suit different use cases. Here's when to use each — including why v7 is now the recommended choice for database primary keys.
Unix Timestamps and Timezone Bugs: What Every Developer Should Know
Timezone bugs cause more production incidents than most developers realise. Here's how Unix timestamps actually work, why "store UTC, convert at display" solves the problem, and the specific bugs that catch teams off guard.
Regex Patterns Every Developer Should Have: A Practical Reference
A practical reference of the regex patterns developers actually need — email, URL, UUID, IP address, dates, semver, hex colours, slugs, and more — with edge cases and caveats for each.
How Long Does a Random String Need to Be? The Birthday Problem Explained
How long does a random string need to be? The birthday problem shows that 6-character codes collide far sooner than most developers expect. Here's how to calculate the right length for tokens, IDs, and API keys.
Base64 Encoder/Decoder — What It Is, When to Use It & Why It's Not Encryption
Learn how Base64 encoding works, why it's used in JWTs, Basic Auth, data URIs, and email attachments, why it's not encryption, and how to use a free Base64 encoder/decoder for any data.
Bcrypt Generator — Hash & Verify Passwords the Right Way
Learn how bcrypt works, why slowness is the feature, what the cost factor means, how to use bcrypt for user authentication, and why MD5 and SHA-256 should never be used for passwords — with a free bcrypt generator.
