Blog
Practical SEO and web-dev guides — no fluff, with the free tools to act on them.
-
CORS Errors Explained: Why curl Works and fetch Doesn't
The server got your request. The browser just won't let your JavaScript read the reply. What preflight is, the three wrong fixes, and the missing header.
Read → -
DMARC From p=none to p=reject: The Rollout That Doesn't Break Your Own Mail
Publish p=none, read the aggregate reports, fix the usual failures and alignment, then step up to quarantine and reject without losing your own invoices.
Read → -
Free Image Compressors That Never Upload Your Files (and How to Tell)
TinyPNG, iLoveIMG and Compressor.io upload your images. Squoosh, ImageOptim and our tools don't. Free limits checked October 2026, plus a 2-minute test.
Read → -
How to Total a Timesheet with Breaks and Overnight Shifts (and Convert 7:45 to 7.75 Hours)
Step-by-step timesheet math: subtract unpaid breaks, handle shifts that cross midnight, apply daily or 40-hour overtime, and convert minutes to decimal hours.
Read → -
Every HTML Meta Tag That Matters for SEO (and the Ones Google Ignores)
The head tags that change indexing or how your result looks, the robots directives Google honors, the tags it ignores, and the canonical edge cases that bite.
Read → -
HTTP Status Codes: The Reference You Actually Use, With the SEO Ones Flagged
The HTTP status codes developers actually meet, by class, plus the confusing pairs: 301 vs 308, 404 vs 410, 401 vs 403, 429, 503 and soft 404s.
Read → -
Keyword Density in 2026: What the Number Tells You (and What It Never Did)
There is no ideal keyword density, and Google never published one. What the ratio measures, how stop words skew it, and the four jobs it is still good for.
Read → -
Free Alternative to Neil Patel's SEO Analyzer (No Login, Technical Checks Included)
Neil Patel's free SEO audit needs a form and opts you into marketing email. This no-login alternative adds security header, JSON-LD and redirect checks.
Read → -
Record Voice Memos on Your Laptop Without Installing Anything (and Why Safari Can Give You an M4A)
Record audio straight from a browser tab, no app and no upload. What each browser saves (WebM, M4A, WAV), how big the files get, and how to fix a silent recording.
Read → -
Free Seobility Alternative: Single-Page SEO Checks Without an Account
Seobility is strong for site crawls and rank tracking. For quick one-page SEO checks with no account and no daily cap, here is an honest free alternative.
Read → -
Why Your PDF Copies as Gibberish (and How to Tell a Text PDF from a Scanned One)
Copying text from a PDF gives boxes, wrong letters or nothing at all? Here is what is actually inside the file, how to check, and how to get clean text out of a scan.
Read → -
XPath vs CSS Selectors: When Each One Wins, with 12 Copy-Paste Expressions
CSS can't match by text and needs :has() to look up the tree. XPath does both. 12 side-by-side expressions for scraping and tests, plus the //tag[1] trap.
Read → -
How to Write a Check Amount in Words (With Cents, Zeros, and Cents Under $1)
Dollars in words, 'and', then cents over 100: $123.45 is 'One hundred twenty-three and 45/100'. Six examples, plus what wins when words and numbers disagree.
Read → -
ISO 8601 vs RFC 3339: Which Timestamp Format Should Your API Return?
RFC 3339 is a strict profile of ISO 8601. Eight timestamps checked against both, plus the no-offset string that is valid in one and ambiguous in the other.
Read → -
npm Caret vs Tilde: What ^1.2.3 and ~1.2.3 Really Allow (and the 0.x Exception)
^ allows minor and patch updates, ~ allows only patch, and below 1.0.0 the rules change. Every range resolved, plus why the lockfile usually wins.
Read → -
Secret Santa Without a Hat: Derangements, Exclusions, Private Links
Drawing names from a hat fails about 63% of the time with 5+ people. The math of derangements, when couple exclusions make a draw impossible, and how reveal links work.
Read → -
CodeBeautify and JSONFormatter Leaked 80,000 Pastes. How to Format JSON Without Uploading It
Researchers pulled cloud, database, and bank-client credentials from saved pastes on two JSON formatters. The leak was the Save feature, not the formatting.
Read → -
Why Your Text Shows "é" and "’": Mojibake, Decoded
Garbled characters are a fingerprint: UTF-8 bytes read as Windows-1252. Lookup table of every common pattern, the exact cause, and the one-line fix.
Read → -
Mouse Double-Clicking by Itself? Switch Chatter vs. Software
A mouse that double-clicks on its own is usually a bouncing switch, not a setting. How chatter works, how to prove it in a minute, and what a browser can measure.
Read → -
Stacked Discounts: Why 20% Off + 10% Off Is 28%, and How to Back Out Sales Tax
Discounts multiply, they don't add: 20% then 10% is 28% off. To find the price before tax, divide by 1.08, don't take 8% of the total. Worked examples.
Read → -
How to Calculate Board Feet (and Why a 2x4 Isn't 3.5 of Them)
Board feet = thickness x width x length / 144. Softwood is tallied on nominal size, so a 2x4x8 counts as 5.33 BF but holds 3.5. Worked table inside.
Read → -
Margin vs Markup: Why a 50% Markup Is Only a 33% Margin
Margin divides profit by price, markup divides it by cost. The conversion table, how to price from a target margin, and why discounts eat margin faster than you think.
Read → -
"Permissions 0644 Are Too Open": Fix the SSH Private Key Warning
OpenSSH refuses any private key readable by group or others. Fix: chmod 600. If chmod 'does nothing', you're on a Windows drive under WSL.
Read → -
Roof Pitch to Degrees: Chart, Formula, and the Multiplier for Ordering Shingles
4/12 is 18.43 degrees, 6/12 is 26.57, 12/12 is 45. Full chart with roof-area multipliers so you can turn a footprint into squares of shingles.
Read → -
Bit Masks and Flags: The Bitwise Tricks Every Developer Should Know
Set, clear, toggle and test bits, x & (x - 1), x & -x, packing RGB565 and Unix mode bits, and the JavaScript 32-bit traps that break masks above bit 30.
Read → -
iOS 27 App Store Header and Search Image Sizes, Explained
The new product page header is 3840×1646 (21:9), search results are 3:2 up to 3840×2560, and one 5244×2950 PNG can fill both. Here's how the crops work, what Apple bans, and the alpha-channel trap.
Read → -
APR vs APY, and Why Compounding Frequency Matters Less Than You Think
APY includes compounding, APR does not, and loan APR adds fees. At 5%, daily beats monthly compounding by about one basis point. Rate and time matter more.
Read → -
What an LLM API Call Actually Costs in October 2026 (GPT-6 vs Claude 5.5 vs Gemini 3.8)
Per-call and per-1,000-call costs for GPT-6, Claude 5.5 and Gemini 3.8, worked out with real arithmetic, plus the billing traps that make naive estimates wrong.
Read → -
Why a Longer Car Loan Costs More (48 vs 60 vs 72 vs 84 Months)
Stretching $35,000 from 48 to 84 months cuts the payment by $284.50 but adds $5,982 of interest and years of negative equity. The math, worked out.
Read → -
How to Make a macOS .icns and a Windows .ico From One PNG
Inside the .icns and .ico containers: the element types, the iconutil workflow, and the two gotchas that leave desktop icons blurry or garbled.
Read → -
Webcam Goes Black or Freezes Mid-Call? Here's What's Actually Happening
Your camera worked, then went black, froze, or turned choppy. How browsers signal device loss, why a black picture is often by design, and a fix order.
Read → -
What BMI Can and Can't Tell You
The BMI formula and its 1830s origin, the adult cut-points, why children use percentiles, and what waist-to-height ratio adds. Worked in metric and US units.
Read → -
Baker's Percentages: Hydration, Starters, Yeast and Cake Pans
Baker's percentages measure everything against flour, not dough. How that settles hydration, starter math, pizza styles, yeast swaps and cake pan scaling.
Read → -
Coffee to Water Ratio by Brew Method (and Why It's by Weight)
The SCA's 55 g per kg of water is about 1:18. Here are the ratio ranges for pour-over, French press, AeroPress, cold brew and espresso, and why grams beat scoops.
Read → -
Turkey Thaw Time and Safe Temperatures: The USDA Math, Worked Out
USDA says 24 hours of fridge time per 4–5 lb, so a 20 lb turkey for Thanksgiving goes in the fridge by Saturday. The thaw, roast and 165 °F rules, worked out.
Read → -
What Do I Need on My Final? The Formula, Plus Weighted GPA Math
The final exam formula is (target − current × (1 − w)) ÷ w. Worked examples, why weights must add to 100, how dropped scores shift it, and how GPA points work.
Read → -
Stick Drift, Dead Zones and Ghost Touches: Testing Input in a Browser
Why worn analog sticks drift, how radial dead zones hide it, what the Gamepad API reports, and how to catch touchscreen dead zones and ghost touches.
Read → -
A CSS px Is Not a Device Pixel: PPI, devicePixelRatio, and rem
The CSS px is a viewing-angle unit, not a dot on your panel. How PPI, devicePixelRatio and min-resolution connect them, and why rem sits on top of all three.
Read → -
How Long Does a Propane Tank Last? The BTU Math, Worked Out
A 20 lb tank holds about 4.7 gallons, or roughly 431,600 BTU. Divide by the burner's BTU/h to get hours. Worked examples for grills, heaters, generators and furnaces.
Read → -
Why 12 V LED Strips Dim at the Far End: Voltage Drop Explained
Current in a 12 V LED run travels out and back, so the far end gets less voltage. The round-trip formula, worked numbers, and when thicker wire or 24 V fixes it.
Read → -
Why Your First Mortgage Payment Is Mostly Interest
On a $375,000 loan at 7%, payment one is $2,187.50 interest and $307.38 principal. The two-line formula behind it, the crossover month, extra payments, and PMI.
Read → -
Why Your CSV Opens in One Column in Excel (and How to Fix It)
Excel splits CSV files on your locale's list separator, not on commas. Why decimal-comma locales get semicolons, what sep= and BOMs do, and how delimiter detection works.
Read → -
Dimensional Weight: What the 139 Divisor Actually Means
Billable weight is the larger of actual weight and L×W×H ÷ 139. What 139 means as a density, who uses 166 or 5,000, USPS's July 2026 switch, and pallets.
Read → -
Domain Age: What RDAP Actually Tells You (and What It Can't)
Domain age is one RDAP event: the current registration's creation date. Why some registries omit it, why re-registration resets it, and why Google doesn't rank on it.
Read → -
How to Check a Camera's Shutter Count (and Why Canon Won't Tell You)
The shutter count isn't a standard EXIF tag. It sits in each maker's private notes, and only Nikon, Sony and Pentax write one you can decode. Edits and exports erase it.
Read → -
Opening a PSD Without Photoshop: Why Maximize Compatibility Matters
A PSD opens cleanly outside Photoshop only if it was saved with Maximize Compatibility. What's inside the file, why viewers show blank or wrong images, and PSD vs PSB.
Read → -
Cubic Yards, Tons, and Density: Ordering Gravel, Soil, and Mulch
Area × depth in inches ÷ 12 ÷ 27 gives cubic yards; density turns yards into tons. The real numbers for gravel, soil, mulch, asphalt, concrete bags, and sod.
Read → -
hreflang Mistakes That Silently Break: en-UK, Self-Links, x-default
Why en-UK does nothing, why every page must list itself, what x-default is for, and which hreflang errors a validator can catch versus the ones only a crawl finds.
Read → -
JSON 'Unexpected Token' Errors: What Each Message Really Means
Decode Chrome, Node, Firefox and Safari JSON.parse errors: trailing commas, single quotes, comments, BOMs, smart quotes, HTML pages, and what JSON.parse lets through.
Read → -
nginx Redirects: return vs rewrite, $request_uri vs $uri
When to use return and when rewrite in nginx, why $request_uri keeps the query string and $uri does not, how location modifiers pick a winner, and the redirect loops to avoid.
Read → -
The YAML Norway Problem and Other Values That Change Type
Why NO becomes false, 0755 becomes 493 and 1:30 becomes 90 in YAML 1.1 parsers but not in YAML 1.2, with real output from PyYAML, Ruby Psych, and the yaml npm package.
Read → -
Paint, Wallpaper, Tile: How Much to Buy and Where the Waste Goes
Why one gallon per 400 sq ft under-orders, how pattern repeats eat wallpaper, and the tile, grout, thinset and drywall figures, each worked for a real room.
Read → -
TOML to JSON: Tables, Dates, and Big Integers That Don't Survive
Why pyproject.toml and Cargo.toml fail with "defining a table twice" and duplicate-key errors, what [[array of tables]] actually means, what TOML 1.1 changed about inline tables, and which TOML types (datetimes, 64-bit integers, inf/nan) JSON cannot represent.
Read → -
Why the NATO Alphabet Spells It Alfa and Juliett (and Says Niner)
Why Alfa has an f, why Juliett has two t's, and how to say TREE, FIFE and NIN-er: the ICAO spelling alphabet checked against Annex 10 and ITU Appendix 14.
Read → -
Sass @import Is Deprecated: Migrating to @use and @forward
What the "Sass @import rules are deprecated" warning means, when Dart Sass 3.0 removes @import, how @use namespaces, as *, with() and @forward replace it, why darken() and map-get() warn too, and how sass-migrator does the rewrite for you.
Read → -
CSS Page Breaks: Why break-inside: avoid Is Not Working in Your PDF
Why HTML-to-PDF output splits tables, images and headings mid-page, and how to control it: page-break-* vs break-*, why avoid silently fails, orphans, widows, @page and thead, with browser support checked against MDN data.
Read → -
Why Your SVG Converts to a Blank or Wrong-Size PNG
Seven reasons an SVG rasterizes to nothing, to 300×150, or to solid black — missing xmlns, no intrinsic size, currentColor, blocked external images and fonts, and the foreignObject that taints the canvas. All measured in Chrome.
Read → -
Why the Last Word of a BIP39 Seed Phrase Isn't Random
A 12-word BIP39 mnemonic has only 128 valid final words out of 2048, and a 24-word one has 8. Here is the checksum math, the error-detection rate, and what the checksum cannot catch.
Read → -
Email Normalization: Gmail Dots, Plus Tags, and the Rules That Only Apply to One Provider
Why [email protected] and [email protected] are one inbox but [email protected] and [email protected] are two, what RFC 5321 says about case, and why stripping +tags for every domain quietly merges different people.
Read → -
umask Explained: Why New Files Are 644 and New Directories 755
Why a new file is 644 and a new directory 755, why umask 023 produces 644 and not 643, why the symbolic form looks backwards, and the commands that ignore your umask completely.
Read → -
.htpasswd Hash Formats: bcrypt vs apr1 (MD5) vs {SHA} vs crypt, and What nginx Actually Accepts
htpasswd hash formats explained: bcrypt $2y$, apr1 MD5, {SHA} and crypt(3) — how to tell them apart, and which ones Apache, nginx, Caddy and Traefik accept.
Read → -
The WIFI: QR Code Format, Explained (WPA3, Hidden Networks, and the Semicolon Problem)
WiFi QR code format explained field by field: WIFI:T:WPA;S:..., backslash escaping, WPA3 and hidden networks, and why the code won't scan on an iPhone.
Read → -
How Website Technology Detection Works (and Why It's Often Wrong)
How website technology detection works: the meta tags, HTML fingerprints, headers and cookies every detector reads, why they misfire, and how to hide yours.
Read → -
Why Emoji Look Different (or Broken) on Other Devices
Why emoji look different on iPhone and Android, why some show as empty boxes, and why family emoji fall apart into separate people — ZWJ and VS16 explained.
Read → -
JSON to C#, Java, GraphQL: What Each Converter Guesses
One JSON sample, four targets: how a JSON to C# class, Java class, GraphQL schema and JSDoc typedef converter each guess what JSON can't tell them.
Read → -
JSON to Go Struct: What the Converter Can't Know
A JSON to Go struct converter sees one sample. Why it emits int64 for every whole number, interface{} for null, and never time.Time — and exactly what to fix.
Read → -
YYYY vs yyyy: The Week-Year Bug That Ships in December
YYYY vs yyyy: in date-fns, Java and ICU, YYYY is the week-based year, not the calendar year — it prints 2027-12-31 for Dec 31, 2026. Plus a token cheat sheet.
Read → -
XOR, ROT13 and Caesar: Why Toy Ciphers Still Matter
XOR cipher explained — why ROT13 and Caesar are toys, why XOR sits inside AES, HMAC and ChaCha20, and how a repeating-key XOR is broken in a few seconds.
Read → -
Is Math.random() Random Enough? (Usually No)
Math.random vs crypto.getRandomValues: why V8 output is predictable from a few samples, how modulo bias loads a dice roll, and the JavaScript shuffle bug.
Read → -
Two's Complement: How Negative Numbers Are Stored
Two's complement explained: why 255 reads as -1, why (int8_t)200 is -56, how invert-and-add-1 works, and what sign extension does when you widen a value.
Read → -
"Address Already in Use": Ephemeral Port Ranges, TIME_WAIT, and Picking a Dev Port
EADDRINUSE has three different causes and most developers only know one: another process, a TIME_WAIT ghost from the server you just killed, or macOS AirPlay squatting on port 5000. Plus the ephemeral ranges Linux, Windows, and macOS actually use (none agree with IANA), demonstrated with real lsof, sysctl, and socket output.
Read → -
CSS clamp() Fluid Typography: The Math, and the Zoom Trap
A fluid font-size is a straight line through two points — slope, intercept, done. The derivation with real numbers, why the intercept must be rem and not px, what the spec says when min is bigger than max, and the WCAG 1.4.4 failure that a vw-only value walks straight into.
Read → -
HTML Entities vs URL Encoding vs String Escaping: Which One Stops XSS
There is no universal "sanitize" function. Each encoder neutralizes one parser and is inert or actively harmful in the next one over: HTML entities inside a script block corrupt data and a lone backslash still breaks out, an HTML-encoded onclick value is decoded before JavaScript ever sees it, and JSON.stringify leaves </script> intact. The OWASP context rule, demonstrated in Node.
Read → -
Generating JSON Schema From a Sample: What Inference Can't Know
A schema inferred from one JSON sample encodes only what that sample happened to contain: every key becomes required, null becomes a type, a status string is not an enum, and an empty array accepts anything. What our draft-07 generator emits in each case, validated against mutated payloads with Ajv 8 — including the overlapping oneOf trap that makes a sample fail its own schema.
Read → -
JSON Diff Is Not Text Diff: Key Order, 1 vs 1.0, and What 'Changed' Means
A line diff of two JSON documents reports changes that are not changes (key order, whitespace, 1 vs 1.0) and hides changes that are (1 vs "1", null vs missing). What RFC 8259 actually says, how a structural diff decides, where ours uses index matching instead of LCS, and JSON Patch as the machine-readable answer.
Read → -
How GitHub Turns Headings Into Anchor Links (and Why Your TOC Links 404)
There is no standard Markdown heading-anchor algorithm. GitHub strips punctuation and keeps the double hyphen in c--rust, markdown-it-anchor percent-encodes it, and the DOM id you see on GitHub has a user-content- prefix the href never mentions. Twelve headings run through five slugifiers, with real output, plus which of them our TOC generator matches, and where it deliberately does not.
Read → -
XML to JSON Has No Canonical Mapping: Attributes, Repeats, and Lost Order
XML and JSON have different data models, so every converter invents a convention: BadgerFish, Parker, GData and fast-xml-parser disagree on attributes, text nodes and repeats. Executed examples of the singleton-vs-array trap, mixed content, type coercion, and why element order cannot survive the trip.
Read → -
Percentage Points vs Percent Change (Same Number, Twice)
Percentage points vs percent change: a rate going 10% to 12% is up 2 points and up 20 percent at once. The formulas, the asymmetry trap, reverse percentages.
Read → -
Fancy Fonts Aren't Fonts: Unicode and Screen Readers
Fancy fonts aren't fonts — they're substitute Unicode characters from the math blocks. What screen readers announce, why search misses them, when to use them.
Read → -
Why Browser Text-to-Speech Sounds Different on Every Machine
speechSynthesis is a thin wrapper over voices you did not install and cannot ship. The first getVoices() call legitimately returns an empty list, Chrome has required a user gesture since M71, long text dies around 15 seconds, and half the voices send your text to a server. What the spec guarantees, and what it does not.
Read → -
Base64 vs Base32 vs Base58: Choosing an Alphabet Humans Can Retype
Three encodings of the same bytes, three different design goals. Why base32 is case-insensitive and 60% larger, which four characters Bitcoin deleted from base64 and why, why your TOTP secret is always 32 uppercase characters, and where each decoder is deliberately more permissive than RFC 4648 allows.
Read → -
Drawing Your Name on a PDF Is Not a Digital Signature
Our Sign PDF tool embeds a PNG and draws it on the page. That is what almost every free "PDF signature" tool does, and under US and EU law it is usually still a valid electronic signature — but it proves nothing about whether the document changed afterward. Here is the mechanism a real PDF signature uses, and the exact legal line between the two.
Read → -
One IPv6 Address, Eight Ways to Write It
The same 128 bits can be spelled at least eight legal ways, which is why string-comparing IPv6 addresses in logs, allowlists, and databases quietly fails. RFC 5952 picks exactly one canonical form — here are its four rules, worked through real output, plus the two places our expander deliberately departs from it.
Read → -
Why Your .gitignore Isn't Working
The file is almost never the problem. Git ignores untracked files only, `!` negation is dead text inside an excluded directory, and check-ignore lies to you by default. Six rules, each demonstrated with real git 2.50.1 output, plus the untrack recipe that does not delete anything.
Read → -
CSS aspect-ratio vs the padding-bottom Hack
CSS aspect-ratio vs the padding-bottom hack: why the property is ignored when both dimensions are set, why content overrides it, and the ratio percentages.
Read → -
Why Your URL Starts With xn--: Punycode Explained
The xn-- prefix is not a broken link — it is the ASCII form DNS actually carries. How Punycode works, and why browsers show xn-- to block homograph attacks.
Read → -
EditorConfig vs Prettier vs ESLint: Who Does What
EditorConfig vs Prettier vs ESLint: three layers, not three competitors. What only .editorconfig can do, how Prettier reads it, and why yours isn't working.
Read → -
How to Verify a SHA-256 Checksum (and What It Proves)
How to verify a SHA-256 checksum on Windows, macOS and Linux, why a matching hash proves less than you think, and what to check when it does not match.
Read → -
JSONPath vs jq: One Selects, One Transforms
JSONPath vs jq: one selects nodes, one is a transformation language. A syntax cheat sheet, RFC 9535's rules, and where implementations still disagree.
Read → -
What "AES Encrypt" Actually Does in Your Browser
A password is not a key. Walking the three layers between a typed passphrase and a base64 blob — PBKDF2 key derivation, an AES-GCM nonce that must never repeat, and a payload format with no version byte — including why NIST calls IV reuse almost as bad as leaking the key.
Read → -
Your Regex Can Hang Your Server: Catastrophic Backtracking Explained
A 31-character string that takes Node 31 seconds to reject, the exact pattern that took Cloudflare offline for 27 minutes, and why the Stack Overflow outage needed no exponential blowup at all. How backtracking engines melt down, the three pattern shapes that cause it, and the fixes that work per language.
Read → -
There Is No .env Spec: Why Your Secret Works in Dev and Breaks in Docker
A password containing # silently truncates in dotenv, executes in bash, and survives in Docker Compose. Four parsers compared on the same fourteen lines, with real output — quoting, inline comments, multiline values, interpolation, and the duplicate-key rule each one picked.
Read → -
npm audit Says 47 Vulnerabilities. How Many Are Real?
Why a fresh project reports a wall of critical findings, why two scanners disagree about the same package, and how to triage a dependency report in the right order — reachability before severity, lockfile before package.json, and what a CVSS base score is actually claiming.
Read → -
Why MAC Address Vendor Lookup Fails on Modern Phones
Every phone on your network since 2019 has been lying about its hardware address on purpose. How to read the U/L bit that gives a randomized MAC away, why some real addresses resolve to "IEEE Registration Authority", and what an OUI can and cannot tell you about a device.
Read → -
Generating a CSR Shouldn't Mean Pasting Your Private Key Into a Website
A certificate signing request contains no secrets — it is your public key and subject details, self-signed to prove possession. So any CSR site that generates your key server-side or asks you to paste one has the trust model backwards. What RFC 2986 actually puts in a CSR, and how WebCrypto keeps the key on your machine.
Read → -
Your .dockerignore Is Not Broken — It Just Is Not .gitignore
The classic bug — "why is node_modules still in my build context?" — is not a bug at all. Docker matches patterns with Go's filepath.Match against the context root, not with gitignore rules: bare names don't recurse, negation is last-line-wins, and the Dockerfile is sent to the builder even when you exclude it.
Read → -
A Valid Email Address Is Not a Deliverable One
[email protected] passes every email regex ever written. So does a perfect address at a domain that refuses all mail, and one at a domain that does not exist. Syntax and deliverability are different layers — here is what each can and cannot catch, and where the honest limit is.
Read → -
Generate an ER Diagram From an Existing SQL Schema (No DBML Required)
Most ER-diagram guides assume you are modeling a database from scratch. Usually you already have one — a pg_dump, a migration, a CREATE TABLE block — and just want to see it. How DDL-to-diagram works, where DBML fits in the middle, and why real dumps trip parsers.
Read → -
Flattening JSON for CSV Export: The Round-Trip Gotchas
Turning nested JSON into dot-path keys looks trivial and is quietly lossy: flat keys cannot distinguish arrays from numeric-keyed objects, two different structures can collapse onto one key, and empty containers have nowhere to live. The mechanics, with worked examples.
Read → -
Your HAR File Has Your Login Session in It — And So Does Every Support Ticket
A HAR export is a verbatim transcript of every request your browser made — cookies, Authorization headers, passwords in POST bodies and all. Attackers hijacked real Okta customer sessions from exactly these files. What is in a HAR, how to read one, and how to sanitize it before it lands in a ticket.
Read → -
INI to JSON: Why "Everything Is a String" Breaks Round-Trips
INI has no spec — only dialects — so every INI↔JSON converter must decide whether 01 is a number, whether yes is a boolean, and where a comment starts. Those judgment calls determine whether ini → json → ini gives you back the same file.
Read → -
NDJSON Is Not a JSON Array With Extra Newlines
Newline-delimited JSON has three rules and three classic ways to break them: a UTF-8 BOM glued to the first token, CRLF line endings from Windows exports, and the blank-line question the two specs answer differently. The mechanics of each failure, and why per-line error isolation is the format's real selling point.
Read → -
Disallow Doesn't Mean Deindex: What robots.txt Actually Controls
robots.txt controls crawling, not indexing — a Disallowed URL can still rank from external links, and Google dropped robots.txt noindex in 2019. How RFC 9309 matching really works, when to use noindex instead, and a percent-encoding edge case almost nobody documents.
Read → -
Why Your WebSocket Keeps Disconnecting: Reading Close Codes 1000–1015
Code 1006 with an empty reason is the most common WebSocket failure and the least explained. How the close handshake actually works, the full RFC 6455 close-code table, which codes are never allowed on the wire, and why an idle proxy is probably killing your connection at the 60-second mark.
Read → -
The UPC/EAN Check Digit Algorithm: Mod 10, Worked by Hand
How the GS1 mod-10 check digit actually works — the 3/1 weights anchored at the right end, a full digit-by-digit worked example, why UPC-A and EAN-13 share one algorithm, and the exact transposition errors mod 10 fails to catch.
Read → -
Why Your CSV Breaks When You Convert It to a Markdown Table
Pipes that split cells, newlines that shear rows apart, quotes a naive converter mangles, and semicolon "CSV" from Excel — the exact bytes that break CSV-to-Markdown conversion, per RFC 4180 and the GFM spec.
Read → -
DNS Propagation Is Not Real: What You Are Actually Waiting For
Nothing "propagates" when you change a DNS record — millions of independent resolver caches just expire on their own schedules. Where the 24–48 hour folklore comes from, the TTL procedure that removes the wait, and why lookups made too early keep failing.
Read → -
JSON to Pydantic Models: How One Sample Lies to the Generator
Why auto-generated Pydantic models are a first draft, not a schema: int vs float, invisible optionality, empty arrays, stringly-typed dates, camelCase aliases, and the v1/v2 traps — with hardened before/after code.
Read → -
Should You Store Timestamps in UTC? Yes — Except Future Local-Time Events
Why "store UTC, display local" is the right default for recording instants, and the exception that corrupts calendars: future events defined in local time need a wall time plus an IANA zone name, because governments really do rewrite timezone rules with weeks of notice.
Read → -
SVG Optimizer vs SVG to PNG vs SVG to React: Which Conversion Does Your SVG Actually Need?
A decision guide for the three things you can do with an SVG — minify it with SVGO, rasterize it to PNG, or convert it to a React component — plus when to go the other way with PNG-to-SVG tracing. With email-client support data and the honest trade-offs of each route.
Read → -
Why Every User-Agent String Looks the Same Now: UA Reduction and Client Hints
Why your analytics show Windows NT 10.0 and Mac OS X 10_15_7 for everyone, which UA tokens Chrome and Safari deliberately froze, and how User-Agent Client Hints replace the detail — in the browsers that ship them.
Read → -
CSS Easing Functions Explained: ease, cubic-bezier(), steps(), and linear()
What an easing function actually is, the cubic-bezier values behind the keywords, why ease-out belongs on entrances, how steps() powers typing effects, and what linear() can do that cubic-bezier cannot.
Read → -
How HMAC Works (and Why hash(key + message) Is Broken)
A developer-friendly explainer of HMAC — why a plain hash can't authenticate a message, how the length-extension attack breaks hash(key||message), what the 0x36/0x5c inner and outer pads actually do, and how to verify signatures without leaking your secret through timing.
Read → -
Invisible Unicode Characters: Why Two Identical Strings Don't Match
Zero-width spaces, non-breaking spaces, BOMs, and bidi overrides — the characters that render as nothing but break string comparisons, greps, and config files. What they are, where they sneak in, and how to find and remove them safely.
Read → -
Password Entropy Explained: Why Strength Meters Disagree
The entropy formula every strength meter starts from, why it overrates human-chosen passwords, how zxcvbn-style estimators differ, and the real math behind diceware and BIP39 passphrases.
Read → -
Skeleton Screens vs. Spinners: What Loading States Actually Do to Perceived Speed
Skeletons are supposed to feel faster than spinners. The research is more mixed than the listicles admit. What each pattern is for, when to show nothing at all, and how to build a skeleton that does not backfire.
Read → -
URL Encoding Explained: %20 vs +, and Which JavaScript Function to Use
Percent-encoding per RFC 3986, why + means space only in form data, exactly which characters encodeURI and encodeURIComponent leave alone, and the double-encoding bug that produces %2520.
Read → -
Browser Fingerprinting Explained: Why Hardening Your Browser Can Make You Easier to Track
What a fingerprint actually is, why entropy is the only number that matters, why bit totals are usually overstated, and the counterintuitive reason that rare privacy settings make you more identifiable.
Read → -
Content-Type: Why Your File Downloads Instead of Opening
The browser does not care about your file extension. What Content-Type actually controls, how MIME sniffing turns a wrong header into an XSS bug, and the extensions where the canonical type is genuinely contested.
Read → -
Dead Pixels vs. Stuck Pixels: How to Tell, and What Your Warranty Actually Covers
A dead pixel and a stuck pixel look similar and are completely different failures. How to distinguish them in 30 seconds, what the ISO pixel-fault classes allow, and whether "pixel fixer" videos do anything.
Read → -
How LLM Tokenization Actually Works (And Why Your Token Count Is Always Wrong)
Byte-pair encoding from the merge table up: why a leading space changes the token, why the same text costs different amounts on different models, and why non-English prompts can cost four times as much.
Read → -
IndexNow vs. Sitemaps: What It Does, Which Engines Use It, and Why Google Is Not One
IndexNow pushes URLs to search engines instead of waiting to be crawled. Which engines actually consume it, how key verification works, every response code, and an honest read on whether it is worth your time.
Read → -
Keyboard Ghosting and N-Key Rollover, Explained
Why cheap keyboards drop keys when you hold three at once, what NKRO actually requires over USB, and why a browser-based keyboard test can never see quite everything.
Read → -
What Readability Scores Actually Measure (It Is Not Comprehension)
Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau and ARI all count roughly two things. Here is the actual math, what each formula was built for, and why a good score does not mean anyone understands you.
Read → -
Why Your Browser Can't Access Your Microphone (And Why the Usual Advice Doesn't Help)
Every getUserMedia error name, what actually causes it, and the failure mode nobody writes about: a response header that kills the permission prompt before it ever appears.
Read → -
Why Regex PII Redaction Always Leaks (And When to Use It Anyway)
Pattern matching finds emails and card numbers reliably. It cannot find names, addresses, or free-form identifiers at all — and the checksums that reduce false positives introduce their own. An honest account of the limits.
Read → -
Black Boxes Don't Redact PDFs — the Text Is Still Right There
Drawing a black rectangle over PDF text hides it visually but leaves the original characters completely intact. Why that happens, real cases where it leaked, and how to actually remove text from a PDF.
Read → -
CSS clip-path: A Working Guide to Shapes, Coordinates & Animation
How clip-path actually works — every basic shape with correct syntax, the coordinate system that breaks on aspect-ratio changes, the real rules for animating shapes, and when to use mask-image or SVG instead.
Read → -
How to Read a curl Command: Every Flag You Will Actually See
A field guide to the curl flags that show up in the wild — -d vs --data-raw vs --data-binary, when -d silently makes it a POST, what -L does to your method on a redirect, and why -k is never the fix.
Read → -
Why Excel Dates and IDs Break When You Export Them (45292 Explained)
The real mechanism behind Excel turning dates into numbers like 45292, stripping leading zeros from IDs, and mangling long numbers into scientific notation — with the fixes.
Read → -
UTM Parameters, Explained Properly (Not Just What They Stand For)
What each UTM parameter is actually for, how GA4 reports it, and the gotchas — case sensitivity, internal linking, dropped redirects, taxonomy drift — that quietly corrupt campaign attribution.
Read → -
What ATS Software Actually Reads From Your Resume
The 75% rejection stat has no source. Here is what applicant tracking systems really do with your file, verified against Greenhouse, Lever, Taleo, and parsing-vendor docs — and what genuinely breaks parsing.
Read → -
WHOIS Is Effectively Dead. Here Is What RDAP Actually Returns
Plain-text WHOIS on port 43 has been replaced by RDAP: JSON over HTTPS, standardized fields, and GDPR redaction. What changed, what you still get, and what every EPP status code actually means for your domain.
Read → -
Why Your OCR Results Are Garbage: 1nvo1ce vs Invoice
Why OCR turns "Invoice" into "1nvo1ce" — how modern OCR actually recognizes text, the image quality factors that dominate accuracy (resolution, skew, contrast, compression), and a pre-flight checklist to fix it before you scan.
Read → -
Does Your Photo Leak Your Home Address? How EXIF and GPS Metadata Work
What EXIF actually stores, exactly what your phone records when you take a photo, which apps strip it and which don't, and how to check and remove it without uploading the photo anywhere.
Read → -
Frames, Disposal Methods, and LZW: How Animated GIFs Actually Work
A developer-friendly deep dive into the GIF89a format — the graphic control extension, LZW compression, the four disposal methods, and why extracting a single raw frame often looks broken.
Read → -
PDF Passwords Explained: Why You Can Open a File You Can't Edit
The difference between a PDF user password and owner password — why one blocks opening and the other is an honor-system restriction any viewer can ignore, and what that means for unlocking a file you own.
Read → -
Why Blurring or Pixelating a Screenshot Doesn't Actually Redact It
Pixelation and blur look like they destroy text, but both are reversible under the right conditions. What Depix and Unredacter proved, why Gaussian blur is just as unsafe, and what actually hides a secret.
Read → -
How to Scan a QR Code From a Screenshot on Your Computer (No App, No Upload)
The fastest way to decode a QR code from a screenshot without a phone app — plus why "just use Google Lens" is bad advice when the code holds a WiFi password, and the technical reasons some codes refuse to scan.
Read → -
Social Media Image Sizes in 2026 (and How to Not Crop Out the Important Part)
The full 2026 size chart for Instagram, X, Facebook, LinkedIn, YouTube, TikTok, and Pinterest — plus why platform auto-cropping ruins photos and the focal-point fix that stops it.
Read → -
chmod 755 vs 644: Linux File Permissions Without the Guesswork
What the three digits actually mean, why directories need the execute bit, when to use 600, and the recursive chmod mistake that breaks every folder on your server.
Read → -
301 vs 302 Redirects: Which to Use, and How to Check What You Actually Send
Permanent vs temporary redirects, where 307 and 308 fit, why redirect chains cost you rankings, and the config snippets for Apache, nginx, Cloudflare, Netlify, and Next.js.
Read → -
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT and the Rest
What every DNS record type actually does, why you cannot put a CNAME at your root domain, how TTL really works, and how to read SPF, DKIM, DMARC, and CAA records.
Read → -
Open Graph Image Sizes in 2026: One File That Works Everywhere
The 1200×630 standard, the safe zone that survives every crop, the meta tags you actually need, and why X strips your headline — plus how to debug a preview that refuses to update.
Read → -
How to Test Discord and Slack Webhooks (Without Writing Code)
The exact JSON payloads both platforms expect, what each status code means, why 204 looks like a failure, and how to debug rate limits, invalid_payload, and no_service errors.
Read → -
App Icon Sizes in 2026: iOS, Android, and Every File Your App Actually Needs
What app icons require in 2026 — iOS light/dark/tinted modes, Liquid Glass, Android adaptive and themed icons, Expo and Flutter configs — and the surprisingly short list of files that covers it all.
Read → -
Content-Security-Policy Explained: A Practical Guide to CSP Headers
What a CSP header actually does, every major directive in plain English, nonces vs hashes vs unsafe-inline, and the gotchas (WASM, dev servers, report-only) that bite in production.
Read → -
Designing for Color Blindness: What 300 Million Users Actually See
How the 8 types of color vision deficiency change what users see, why red/green UI fails, and practical rules — plus a free simulator to test your own designs and palettes.
Read → -
Favicon Sizes in 2026: The Five Files You Actually Need
Skip the 20-file favicon packages. The modern minimal set — ICO, SVG, Apple touch icon, and two PWA sizes — what each one is for, and the exact HTML to ship.
Read → -
WCAG Contrast Ratio Explained: What 4.5:1 Actually Means
How contrast ratio is calculated, the real rules behind WCAG AA and AAA, when 3:1 is enough, and the mistakes that make accessible-looking designs fail — with a free checker.
Read → -
Ed25519 vs RSA: Which SSH Key Should You Actually Generate?
A clear, opinionated comparison of Ed25519 and RSA SSH keys — speed, security, key size, and compatibility — plus a simple decision rule and the exact command to generate each.
Read → -
docker run to docker-compose: Convert Any Command, Flag by Flag
A practical guide to converting a docker run command into a docker-compose.yaml file — what each flag maps to (-p, -e, -v, --restart, --name, --network), with copy-paste examples for Postgres, Redis, and Nginx.
Read → -
How to Read an X.509 Certificate, Field by Field
An X.509 / SSL certificate looks like a wall of Base64, but decoded it is a short list of meaningful fields. Here is what subject, issuer, validity, SAN, and key usage actually mean — and why a SAN mismatch breaks Chrome.
Read → -
A Free iLovePDF Alternative — No Upload, No Watermark, No Account
Looking for a free iLovePDF or Smallpdf alternative that does not upload your files, add watermarks, or gate everything behind an account? Here is an honest comparison and a browser-based set of PDF tools for developers.
Read → -
Unix Timestamps and Epoch Time Explained (Plus the Year 2038 Problem)
What a Unix timestamp actually is, why "the epoch" is 1970, how seconds vs milliseconds trips people up, timezones, and the Year 2038 problem — with tools to convert epoch values instantly.
Read → -
HEIC vs JPG: What's Actually Different?
Compression, quality, file size, compatibility — a practical comparison of HEIC and JPG, and when to convert between them.
Read → -
Why Does My iPhone Save Photos as HEIC (and How to Change It)
What HEIC is, why Apple made it the default, how to make your iPhone shoot JPG again — and the fastest way to convert the HEIC photos you already have.
Read → -
The Graph Paper Field Guide: Square, Dot, Isometric, Hex, and Beyond
Not all grids are the same. A practical field guide to the seven kinds of graph paper — square, dot, isometric, hexagonal, engineering, semi-log, and polar — what each one is actually for, the right grid size to pick, and how to print your own for free.
Read → -
Print Your Own Bullet Journal: Free Dot Grid, Planners, and Habit Trackers
Bullet journaling does not require a $30 notebook. Here is how to print your own dot grid, weekly and daily planners, and habit-tracker pages for free — the right dot spacing to use, how to bind loose sheets, and a printable setup that costs pennies.
Read → -
Why Your Printable Paper Prints the Wrong Size (and How to Fix It)
You printed 5mm graph paper and the squares came out at 4.6mm. The culprit is almost always print scaling. Here is why "Fit to Page" quietly shrinks your grid, how to print true-to-scale at 100%, and how margins and file format affect a print-perfect result.
Read → -
Structured Data & JSON-LD: A Practical Guide to Rich Results
A developer-focused guide to structured data and JSON-LD — what schema.org markup actually does for search, why JSON-LD beats microdata, which schema types earn rich results, where to put the script, and how to validate it before it ships.
Read → -
How TOTP 2FA Codes Actually Work: Shared Secrets, Time Steps & QR Codes
A developer-friendly breakdown of TOTP — the six-digit codes from authenticator apps. How the shared secret gets into your phone via a QR code, why the code changes every 30 seconds without any network connection, what HMAC and the time step do, and how the server verifies it.
Read → -
CIDR & Subnetting Explained: Reading /24, Masks, and Host Counts
A no-memorization guide to CIDR notation and subnetting — what the slash number really means, how to count hosts in a /24 or /20, why the network and broadcast addresses are reserved, how subnet masks work in binary, and the quick mental math for everyday networking.
Read → -
How bcrypt Actually Works: Salts, Cost Factors & Why You Never MD5 a Password
A developer-friendly explanation of bcrypt — why password hashing is different from regular hashing, what the salt and cost factor in a $2b$ string mean, how deliberate slowness defeats brute-force attacks, and why MD5 and SHA-256 are the wrong tools for passwords.
Read → -
UUID vs ULID: v4, v7, and Which ID You Should Actually Use
A practical comparison of UUID and ULID for generating unique IDs — how UUIDv4, UUIDv7, and ULID differ, why random IDs wreck database index performance, what "sortable" really buys you, and a clear decision guide for picking the right identifier in 2026.
Read → -
How to Test File Upload Limits: Boundaries, 413s, and Exact-Size Files
A practical developer guide to testing file upload limits correctly — nginx client_max_body_size, cloud function payload caps, S3 multipart thresholds, the MB vs MiB unit trap, and how to generate exact-size test files in any format.
Read → -
Sample File Sizes for Testing: 1 MB, 10 MB, 100 MB and Why They Matter
A practical guide to which file sizes you should actually test, the real-world thresholds they map to (form uploads, API gateways, CDN edge limits), the decimal MB vs binary MiB gotcha that causes off-by-5% limit bugs, and why round numbers are the worst test inputs you can pick.
Read → -
What Makes a File Valid? Magic Bytes & File Signatures Explained
How programs really know what a file is — not from its extension, but from the raw bytes at the start. A developer-friendly look at magic numbers, MIME sniffing, structural validity, and why renaming a .txt file to .pdf does not make a PDF.
Read → -
How ZIP Files Actually Work: Local Headers, Central Directory & the End Record
A developer-friendly deep-dive into the ZIP binary format — the three structural sections every archive contains, why a ZIP reader seeks from the end rather than the beginning, how STORE and DEFLATE differ, and what really happens when a tool reports your archive is corrupt.
Read → -
PNG vs JPG vs WebP vs AVIF: Which Format to Use and When
A practical breakdown of the four main web image formats — PNG, JPG, WebP, and AVIF — covering lossless vs lossy, alpha transparency, compression efficiency, browser support in 2026, animation, encode/decode cost, and a clear decision guide for developers.
Read → -
Cron Syntax Cheat Sheet: Fields, Examples & Special Strings
A clear cron cheat sheet: what each of the five fields means, the special characters, @daily-style shortcuts, ready-to-use schedule examples, and the day-of-week gotcha that catches everyone.
Read → -
Git Cheat Sheet: The Commands You Actually Use (with the Gotchas)
A practical Git cheat sheet grouped by what you are trying to do — commit, branch, undo, stash, sync, and recover — with the gotchas that bite people. Copy-paste ready.
Read → -
How Font Files Actually Work: TTF, OTF, WOFF & WOFF2 Explained
A developer-friendly look at what is really inside a font file — sfnt tables, TrueType vs CFF outlines, and why WOFF/WOFF2 are just compressed containers. Plus when converting between formats is lossless and when it is not.
Read → -
How JWTs Actually Work: Header, Payload, Signature & Common Mistakes
A developer-friendly explainer of JSON Web Tokens — what the three parts really are, what signing does and does NOT do, how validation works, and the security mistakes that cause real breaches.
Read → -
Regex Cheat Sheet: Syntax, Patterns & Copy-Paste Examples
A practical regular expression cheat sheet — anchors, character classes, quantifiers, groups, and lookarounds — plus ready-to-use patterns for email, URLs, dates and more, and the gotchas to avoid.
Read → -
The Best Free SEO Audit Tools for Developers (No Signup)
An honest roundup of free SEO audit tools for developers — including competitors — judged on depth, signup friction, and the technical checks that actually matter.
Read → -
Core Web Vitals Explained: LCP, INP, and CLS for Developers
What LCP, INP, and CLS actually measure, the thresholds that matter, and the real causes behind each failure — written for developers, with concrete fixes.
Read → -
The Complete On-Page SEO Checklist (45 Checks, Free Tools Included)
A practical, developer-focused on-page SEO checklist for 2026 — meta tags, headings, content, links, images, structured data, Core Web Vitals, security headers, and crawlability, each with a free tool to check it.
Read → -
A Free SEOptimer Alternative — No Email, No Paywall
Looking for a free SEOptimer alternative that does not gate the report behind an email signup? Here is an honest comparison and a no-signup, browser-based option for developers.
Read →