Developer Tools

Learn what HTML entities are, why they exist, the most common named entities, how numeric entities work for any Unicode character, and when modern UTF-8 pages don't need them — with a free HTML entities tool.

Math.random() in JavaScript is predictable from 128 observations. Python's random module explicitly warns it's not for security. Here's why PRNGs fail for tokens, the secure alternatives in every major language, and the specific bit lengths needed for different security contexts.

Named capture groups turn regex matches from numbered tuples into readable dictionaries. Lookahead and lookbehind assertions match positions without consuming characters. Here's the modern regex feature set — named groups, non-capturing groups, all four assertion types — with practical patterns for log parsing and URL extraction.

Binary-Coded Decimal (BCD) encodes each decimal digit as a 4-bit group — which is why real-time clock chips return 0x59 to mean 59 seconds (not 89), and why hardware with BCD limits constrains values to 0-99 rather than 0-255. Here's BCD in RTC hardware and financial calculations, Gray code's one-bit-change property that prevents rotary encoder errors, and why TCP checksums use one's complement arithmetic.

Python's None vs JSON null, JavaScript's integer precision limit at 2^53, Go's strict struct tags, and Ruby's symbolize_names security concern are real production pitfalls. Here's the JSON parsing edge cases in each major language and how they cause bugs at API boundaries.

A UUID looks random but encodes information depending on its version: v1 embeds the creation timestamp and the generating machine's MAC address (recoverable by anyone who sees the UUID); v4 is genuinely random (122 random bits); v5 is deterministically computed from a namespace and name; v7 is timestamp-ordered with random low bits. Here's what each segment of a UUID actually contains, why v1 is a privacy risk in public-facing contexts, and when UUIDs shouldn't be used as security tokens.

A cron job scheduled for 2:30 AM doesn't run on "spring forward" night, because 2:30 AM doesn't exist that night — and the same job might run twice on "fall back" night, because 2:30 AM happens twice. Here's why this is exactly the time window many maintenance jobs use, why UTC eliminates the problem entirely for most automated jobs, and why "9 AM local time" scheduling that survives DST requires timezone-aware libraries, not static cron expressions.

A deliberately slow hash makes your login endpoint a denial-of-service amplifier. Rate limiting before hashing, dummy hashes for unknown users, and async execution fix it.

UUID v4's random bits fragment database B-tree indexes, causing write amplification. UUID v7 adds a millisecond timestamp prefix to fix this. ULID is sortable and URL-safe without hyphens. NanoID is compact and customisable. Here's how each works and when to choose each format.

LinkedIn stored 117 million passwords as unsalted SHA-1 — cracked within days. Adobe used 3DES encryption (reversible) instead of hashing. These are the specific, named password storage mistakes that keep producing data breaches. Here's every common error, why it fails, and the correct modern approach with bcrypt and Argon2.