Developer Tools

Learn what HTML entities are, which characters always need encoding, how to use <, &,  , and special symbols correctly — with a free HTML entities encoder/decoder tool.

A URL that works in a browser can fail in curl, JSON, or as a query parameter — because each context has different rules about which characters need encoding. Here's why "just URL-encode it" is underspecified without knowing the context, the encoding-within-encoding problem (a URL as a value inside another URL), why & needs HTML entity encoding in href attributes but not JSON, and the + vs %20 space ambiguity.

A cron job scheduled for 2:30 AM doesn't run on "spring forward" night, because 2:30 AM doesn't exist that night — and the same job might run twice on "fall back" night, because 2:30 AM happens twice. Here's why this is exactly the time window many maintenance jobs use, why UTC eliminates the problem entirely for most automated jobs, and why "9 AM local time" scheduling that survives DST requires timezone-aware libraries, not static cron expressions.

Learn what makes a password truly strong, why human-invented passwords fail, and how to use a free password generator to create cryptographically random credentials for every account.

Python's None vs JSON null, JavaScript's integer precision limit at 2^53, Go's strict struct tags, and Ruby's symbolize_names security concern are real production pitfalls. Here's the JSON parsing edge cases in each major language and how they cause bugs at API boundaries.

Short-lived access tokens require a refresh mechanism — and how you implement that mechanism determines your app's security and user experience. Here's refresh token rotation, silent refresh in SPAs, theft detection via refresh token families, and the cases where server-side sessions are simpler and safer.

SMS OTP and TOTP are both vulnerable to real-time phishing (AiTM attacks relay codes before they expire) — hardware keys and passkeys are phishing-resistant because their response is cryptographically bound to the exact URL. Here's the MFA security spectrum from SMS to passkeys, the MFA fatigue (push bombing) attack that compromised Uber in 2022, why number matching prevents rubber-stamping push notifications, and why security questions aren't a genuine second factor.

JSON5 and JSONC add comments and trailing commas to JSON — and if you've ever tried to add a // comment to a tsconfig.json and wondered why VS Code allows it but JSON.parse() doesn't, you've encountered the JSON variant ecosystem. Here's why JSON has no comments by design, the three overlapping "JSON with comments" specifications, why standard parsers reject JSONC content, and the preprocessing approaches for handling these variants in automation.

bcrypt's work factor doubles hashing time for every increment — work factor 10 is ~100ms, work factor 12 is ~400ms, work factor 14 is ~1.6 seconds. This exponential relationship is the design feature, not a side effect: when hardware gets faster, incrementing the work factor by 1 restores the original time cost. Here's how to choose the right factor, the opportunistic re-hash strategy for upgrading existing hashes without forcing logout, and how to read the work factor from a stored bcrypt hash string.

HTML encoding converts < to &lt; — but it can't protect against XSS in JavaScript contexts, where the browser parses script blocks before HTML encoding applies. Content Security Policy blocks injected scripts at the browser level, using nonces (random per-request values) or hashes to allow only legitimate inline scripts. Here's why both layers are required, how CSP nonces work, and what violation reports reveal about attacker probing.