Developer Tools

Standard JSON.parse() requires the complete document before returning anything — which fails for large files that exceed memory and real-time streaming APIs that never "finish." Here's how streaming JSON parsers work (event-driven, token-by-token), JSON Lines as a simpler alternative that works with standard parsers, the specific use cases where streaming is necessary vs over-engineering, and when high-volume data transfer argues for protobuf instead of JSON entirely.

A bcrypt hash is four fields packed into one string. Learn to read the version prefix, cost, embedded salt and digest — and why the salt is stored in plain sight.

Learn how a JSON formatter works, what common JSON syntax errors look like, the difference between JSON and JavaScript objects, and how to format and validate JSON instantly with a free tool.

Learn how binary, octal, decimal, and hexadecimal number systems work, when each is used in programming, and how to convert between them instantly with a free number base converter.

Bcrypt silently truncates input at 72 bytes — meaning two passwords sharing the same first 72 bytes but differing afterward produce the identical hash. Here's why 72 specifically, how multi-byte Unicode characters (emoji especially) reach this limit far sooner than "72 characters" suggests, why pre-hashing with SHA-256 is a common mitigation, and why this isn't actually a meaningful security concern for typical passwords.

HSL's "50% lightness" produces visually different brightness across hues — yellow at HSL(60,100%,50%) looks far brighter than blue at HSL(240,100%,50%). oklch solves this with perceptual uniformity: equal L values produce equal apparent lightness regardless of hue. Here's how oklch works in CSS (now supported in all modern browsers), why it's the best tool for dark mode palettes, and how wide-gamut P3 colors fit in.

Learn how bcrypt works, why slowness is the feature, what the cost factor means, how to use bcrypt for user authentication, and why MD5 and SHA-256 should never be used for passwords — with a free bcrypt generator.

Some APIs return a token that decodes into readable claims; others return an opaque string that reveals nothing. The difference isn't a quality signal — it's the fundamental architectural choice between stateless JWTs (the token contains the session data) and stateful opaque tokens (the token is a lookup key into a server-side session store). Here's why instant revocation pushes some systems toward the "extra database lookup" approach, and what it means when a token you paste into this tool decodes to nothing.

Regular expressions cannot formally match arbitrarily nested structures like balanced parentheses or nested JSON — this is a mathematical limitation, not an engine deficiency. Here's the five specific signals that indicate you've outgrown regex, how parser combinators recursively compose small parsing functions, and why "regex JSON extractors" only work for simple flat cases.

Named capture groups turn regex matches from numbered tuples into readable dictionaries. Lookahead and lookbehind assertions match positions without consuming characters. Here's the modern regex feature set — named groups, non-capturing groups, all four assertion types — with practical patterns for log parsing and URL extraction.