Blog
Practical SEO and web-dev guides — no fluff, with the free tools to act on them.
-
Your Regex Can Hang Your Server: Catastrophic Backtracking Explained
A 31-character string that takes Node 31 seconds to reject, the exact pattern that took Cloudflare offline for 27 minutes, and why the Stack Overflow outage needed no exponential blowup at all. How backtracking engines melt down, the three pattern shapes that cause it, and the fixes that work per language.
Read → -
What "AES Encrypt" Actually Does in Your Browser
A password is not a key. Walking the three layers between a typed passphrase and a base64 blob — PBKDF2 key derivation, an AES-GCM nonce that must never repeat, and a payload format with no version byte — including why NIST calls IV reuse almost as bad as leaking the key.
Read → -
There Is No .env Spec: Why Your Secret Works in Dev and Breaks in Docker
A password containing # silently truncates in dotenv, executes in bash, and survives in Docker Compose. Four parsers compared on the same fourteen lines, with real output — quoting, inline comments, multiline values, interpolation, and the duplicate-key rule each one picked.
Read → -
npm audit Says 47 Vulnerabilities. How Many Are Real?
Why a fresh project reports a wall of critical findings, why two scanners disagree about the same package, and how to triage a dependency report in the right order — reachability before severity, lockfile before package.json, and what a CVSS base score is actually claiming.
Read → -
Why MAC Address Vendor Lookup Fails on Modern Phones
Every phone on your network since 2019 has been lying about its hardware address on purpose. How to read the U/L bit that gives a randomized MAC away, why some real addresses resolve to "IEEE Registration Authority", and what an OUI can and cannot tell you about a device.
Read → -
Generating a CSR Shouldn't Mean Pasting Your Private Key Into a Website
A certificate signing request contains no secrets — it is your public key and subject details, self-signed to prove possession. So any CSR site that generates your key server-side or asks you to paste one has the trust model backwards. What RFC 2986 actually puts in a CSR, and how WebCrypto keeps the key on your machine.
Read → -
Your .dockerignore Is Not Broken — It Just Is Not .gitignore
The classic bug — "why is node_modules still in my build context?" — is not a bug at all. Docker matches patterns with Go's filepath.Match against the context root, not with gitignore rules: bare names don't recurse, negation is last-line-wins, and the Dockerfile is sent to the builder even when you exclude it.
Read → -
A Valid Email Address Is Not a Deliverable One
[email protected] passes every email regex ever written. So does a perfect address at a domain that refuses all mail, and one at a domain that does not exist. Syntax and deliverability are different layers — here is what each can and cannot catch, and where the honest limit is.
Read → -
Generate an ER Diagram From an Existing SQL Schema (No DBML Required)
Most ER-diagram guides assume you are modeling a database from scratch. Usually you already have one — a pg_dump, a migration, a CREATE TABLE block — and just want to see it. How DDL-to-diagram works, where DBML fits in the middle, and why real dumps trip parsers.
Read → -
Flattening JSON for CSV Export: The Round-Trip Gotchas
Turning nested JSON into dot-path keys looks trivial and is quietly lossy: flat keys cannot distinguish arrays from numeric-keyed objects, two different structures can collapse onto one key, and empty containers have nowhere to live. The mechanics, with worked examples.
Read → -
Your HAR File Has Your Login Session in It — And So Does Every Support Ticket
A HAR export is a verbatim transcript of every request your browser made — cookies, Authorization headers, passwords in POST bodies and all. Attackers hijacked real Okta customer sessions from exactly these files. What is in a HAR, how to read one, and how to sanitize it before it lands in a ticket.
Read → -
NDJSON Is Not a JSON Array With Extra Newlines
Newline-delimited JSON has three rules and three classic ways to break them: a UTF-8 BOM glued to the first token, CRLF line endings from Windows exports, and the blank-line question the two specs answer differently. The mechanics of each failure, and why per-line error isolation is the format's real selling point.
Read → -
INI to JSON: Why "Everything Is a String" Breaks Round-Trips
INI has no spec — only dialects — so every INI↔JSON converter must decide whether 01 is a number, whether yes is a boolean, and where a comment starts. Those judgment calls determine whether ini → json → ini gives you back the same file.
Read → -
Disallow Doesn't Mean Deindex: What robots.txt Actually Controls
robots.txt controls crawling, not indexing — a Disallowed URL can still rank from external links, and Google dropped robots.txt noindex in 2019. How RFC 9309 matching really works, when to use noindex instead, and a percent-encoding edge case almost nobody documents.
Read → -
Why Your WebSocket Keeps Disconnecting: Reading Close Codes 1000–1015
Code 1006 with an empty reason is the most common WebSocket failure and the least explained. How the close handshake actually works, the full RFC 6455 close-code table, which codes are never allowed on the wire, and why an idle proxy is probably killing your connection at the 60-second mark.
Read → -
The UPC/EAN Check Digit Algorithm: Mod 10, Worked by Hand
How the GS1 mod-10 check digit actually works — the 3/1 weights anchored at the right end, a full digit-by-digit worked example, why UPC-A and EAN-13 share one algorithm, and the exact transposition errors mod 10 fails to catch.
Read → -
Why Your CSV Breaks When You Convert It to a Markdown Table
Pipes that split cells, newlines that shear rows apart, quotes a naive converter mangles, and semicolon "CSV" from Excel — the exact bytes that break CSV-to-Markdown conversion, per RFC 4180 and the GFM spec.
Read → -
DNS Propagation Is Not Real: What You Are Actually Waiting For
Nothing "propagates" when you change a DNS record — millions of independent resolver caches just expire on their own schedules. Where the 24–48 hour folklore comes from, the TTL procedure that removes the wait, and why lookups made too early keep failing.
Read → -
JSON to Pydantic Models: How One Sample Lies to the Generator
Why auto-generated Pydantic models are a first draft, not a schema: int vs float, invisible optionality, empty arrays, stringly-typed dates, camelCase aliases, and the v1/v2 traps — with hardened before/after code.
Read → -
Should You Store Timestamps in UTC? Yes — Except Future Local-Time Events
Why "store UTC, display local" is the right default for recording instants, and the exception that corrupts calendars: future events defined in local time need a wall time plus an IANA zone name, because governments really do rewrite timezone rules with weeks of notice.
Read → -
SVG Optimizer vs SVG to PNG vs SVG to React: Which Conversion Does Your SVG Actually Need?
A decision guide for the three things you can do with an SVG — minify it with SVGO, rasterize it to PNG, or convert it to a React component — plus when to go the other way with PNG-to-SVG tracing. With email-client support data and the honest trade-offs of each route.
Read → -
Why Every User-Agent String Looks the Same Now: UA Reduction and Client Hints
Why your analytics show Windows NT 10.0 and Mac OS X 10_15_7 for everyone, which UA tokens Chrome and Safari deliberately froze, and how User-Agent Client Hints replace the detail — in the browsers that ship them.
Read → -
CSS Easing Functions Explained: ease, cubic-bezier(), steps(), and linear()
What an easing function actually is, the cubic-bezier values behind the keywords, why ease-out belongs on entrances, how steps() powers typing effects, and what linear() can do that cubic-bezier cannot.
Read → -
How HMAC Works (and Why hash(key + message) Is Broken)
A developer-friendly explainer of HMAC — why a plain hash can't authenticate a message, how the length-extension attack breaks hash(key||message), what the 0x36/0x5c inner and outer pads actually do, and how to verify signatures without leaking your secret through timing.
Read → -
Invisible Unicode Characters: Why Two Identical Strings Don't Match
Zero-width spaces, non-breaking spaces, BOMs, and bidi overrides — the characters that render as nothing but break string comparisons, greps, and config files. What they are, where they sneak in, and how to find and remove them safely.
Read → -
Password Entropy Explained: Why Strength Meters Disagree
The entropy formula every strength meter starts from, why it overrates human-chosen passwords, how zxcvbn-style estimators differ, and the real math behind diceware and BIP39 passphrases.
Read → -
Skeleton Screens vs. Spinners: What Loading States Actually Do to Perceived Speed
Skeletons are supposed to feel faster than spinners. The research is more mixed than the listicles admit. What each pattern is for, when to show nothing at all, and how to build a skeleton that does not backfire.
Read → -
URL Encoding Explained: %20 vs +, and Which JavaScript Function to Use
Percent-encoding per RFC 3986, why + means space only in form data, exactly which characters encodeURI and encodeURIComponent leave alone, and the double-encoding bug that produces %2520.
Read → -
Browser Fingerprinting Explained: Why Hardening Your Browser Can Make You Easier to Track
What a fingerprint actually is, why entropy is the only number that matters, why bit totals are usually overstated, and the counterintuitive reason that rare privacy settings make you more identifiable.
Read → -
Dead Pixels vs. Stuck Pixels: How to Tell, and What Your Warranty Actually Covers
A dead pixel and a stuck pixel look similar and are completely different failures. How to distinguish them in 30 seconds, what the ISO pixel-fault classes allow, and whether "pixel fixer" videos do anything.
Read → -
Content-Type: Why Your File Downloads Instead of Opening
The browser does not care about your file extension. What Content-Type actually controls, how MIME sniffing turns a wrong header into an XSS bug, and the extensions where the canonical type is genuinely contested.
Read → -
How LLM Tokenization Actually Works (And Why Your Token Count Is Always Wrong)
Byte-pair encoding from the merge table up: why a leading space changes the token, why the same text costs different amounts on different models, and why non-English prompts can cost four times as much.
Read → -
IndexNow vs. Sitemaps: What It Does, Which Engines Use It, and Why Google Is Not One
IndexNow pushes URLs to search engines instead of waiting to be crawled. Which engines actually consume it, how key verification works, every response code, and an honest read on whether it is worth your time.
Read → -
Keyboard Ghosting and N-Key Rollover, Explained
Why cheap keyboards drop keys when you hold three at once, what NKRO actually requires over USB, and why a browser-based keyboard test can never see quite everything.
Read → -
What Readability Scores Actually Measure (It Is Not Comprehension)
Flesch-Kincaid, Gunning Fog, SMOG, Coleman-Liau and ARI all count roughly two things. Here is the actual math, what each formula was built for, and why a good score does not mean anyone understands you.
Read → -
Why Your Browser Can't Access Your Microphone (And Why the Usual Advice Doesn't Help)
Every getUserMedia error name, what actually causes it, and the failure mode nobody writes about: a response header that kills the permission prompt before it ever appears.
Read → -
Why Regex PII Redaction Always Leaks (And When to Use It Anyway)
Pattern matching finds emails and card numbers reliably. It cannot find names, addresses, or free-form identifiers at all — and the checksums that reduce false positives introduce their own. An honest account of the limits.
Read → -
Black Boxes Don't Redact PDFs — the Text Is Still Right There
Drawing a black rectangle over PDF text hides it visually but leaves the original characters completely intact. Why that happens, real cases where it leaked, and how to actually remove text from a PDF.
Read → -
CSS clip-path: A Working Guide to Shapes, Coordinates & Animation
How clip-path actually works — every basic shape with correct syntax, the coordinate system that breaks on aspect-ratio changes, the real rules for animating shapes, and when to use mask-image or SVG instead.
Read → -
How to Read a curl Command: Every Flag You Will Actually See
A field guide to the curl flags that show up in the wild — -d vs --data-raw vs --data-binary, when -d silently makes it a POST, what -L does to your method on a redirect, and why -k is never the fix.
Read → -
Why Excel Dates and IDs Break When You Export Them (45292 Explained)
The real mechanism behind Excel turning dates into numbers like 45292, stripping leading zeros from IDs, and mangling long numbers into scientific notation — with the fixes.
Read → -
UTM Parameters, Explained Properly (Not Just What They Stand For)
What each UTM parameter is actually for, how GA4 reports it, and the gotchas — case sensitivity, internal linking, dropped redirects, taxonomy drift — that quietly corrupt campaign attribution.
Read → -
What ATS Software Actually Reads From Your Resume
The 75% rejection stat has no source. Here is what applicant tracking systems really do with your file, verified against Greenhouse, Lever, Taleo, and parsing-vendor docs — and what genuinely breaks parsing.
Read → -
WHOIS Is Effectively Dead. Here Is What RDAP Actually Returns
Plain-text WHOIS on port 43 has been replaced by RDAP: JSON over HTTPS, standardized fields, and GDPR redaction. What changed, what you still get, and what every EPP status code actually means for your domain.
Read → -
Why Your OCR Results Are Garbage: 1nvo1ce vs Invoice
Why OCR turns "Invoice" into "1nvo1ce" — how modern OCR actually recognizes text, the image quality factors that dominate accuracy (resolution, skew, contrast, compression), and a pre-flight checklist to fix it before you scan.
Read → -
Does Your Photo Leak Your Home Address? How EXIF and GPS Metadata Work
What EXIF actually stores, exactly what your phone records when you take a photo, which apps strip it and which don't, and how to check and remove it without uploading the photo anywhere.
Read → -
Frames, Disposal Methods, and LZW: How Animated GIFs Actually Work
A developer-friendly deep dive into the GIF89a format — the graphic control extension, LZW compression, the four disposal methods, and why extracting a single raw frame often looks broken.
Read → -
PDF Passwords Explained: Why You Can Open a File You Can't Edit
The difference between a PDF user password and owner password — why one blocks opening and the other is an honor-system restriction any viewer can ignore, and what that means for unlocking a file you own.
Read → -
Why Blurring or Pixelating a Screenshot Doesn't Actually Redact It
Pixelation and blur look like they destroy text, but both are reversible under the right conditions. What Depix and Unredacter proved, why Gaussian blur is just as unsafe, and what actually hides a secret.
Read → -
How to Scan a QR Code From a Screenshot on Your Computer (No App, No Upload)
The fastest way to decode a QR code from a screenshot without a phone app — plus why "just use Google Lens" is bad advice when the code holds a WiFi password, and the technical reasons some codes refuse to scan.
Read → -
Social Media Image Sizes in 2026 (and How to Not Crop Out the Important Part)
The full 2026 size chart for Instagram, X, Facebook, LinkedIn, YouTube, TikTok, and Pinterest — plus why platform auto-cropping ruins photos and the focal-point fix that stops it.
Read → -
chmod 755 vs 644: Linux File Permissions Without the Guesswork
What the three digits actually mean, why directories need the execute bit, when to use 600, and the recursive chmod mistake that breaks every folder on your server.
Read → -
DNS Record Types Explained: A, AAAA, CNAME, MX, TXT and the Rest
What every DNS record type actually does, why you cannot put a CNAME at your root domain, how TTL really works, and how to read SPF, DKIM, DMARC, and CAA records.
Read → -
301 vs 302 Redirects: Which to Use, and How to Check What You Actually Send
Permanent vs temporary redirects, where 307 and 308 fit, why redirect chains cost you rankings, and the config snippets for Apache, nginx, Cloudflare, Netlify, and Next.js.
Read → -
Open Graph Image Sizes in 2026: One File That Works Everywhere
The 1200×630 standard, the safe zone that survives every crop, the meta tags you actually need, and why X strips your headline — plus how to debug a preview that refuses to update.
Read → -
How to Test Discord and Slack Webhooks (Without Writing Code)
The exact JSON payloads both platforms expect, what each status code means, why 204 looks like a failure, and how to debug rate limits, invalid_payload, and no_service errors.
Read → -
App Icon Sizes in 2026: iOS, Android, and Every File Your App Actually Needs
What app icons require in 2026 — iOS light/dark/tinted modes, Liquid Glass, Android adaptive and themed icons, Expo and Flutter configs — and the surprisingly short list of files that covers it all.
Read → -
Content-Security-Policy Explained: A Practical Guide to CSP Headers
What a CSP header actually does, every major directive in plain English, nonces vs hashes vs unsafe-inline, and the gotchas (WASM, dev servers, report-only) that bite in production.
Read → -
Designing for Color Blindness: What 300 Million Users Actually See
How the 8 types of color vision deficiency change what users see, why red/green UI fails, and practical rules — plus a free simulator to test your own designs and palettes.
Read → -
Favicon Sizes in 2026: The Five Files You Actually Need
Skip the 20-file favicon packages. The modern minimal set — ICO, SVG, Apple touch icon, and two PWA sizes — what each one is for, and the exact HTML to ship.
Read → -
WCAG Contrast Ratio Explained: What 4.5:1 Actually Means
How contrast ratio is calculated, the real rules behind WCAG AA and AAA, when 3:1 is enough, and the mistakes that make accessible-looking designs fail — with a free checker.
Read → -
Ed25519 vs RSA: Which SSH Key Should You Actually Generate?
A clear, opinionated comparison of Ed25519 and RSA SSH keys — speed, security, key size, and compatibility — plus a simple decision rule and the exact command to generate each.
Read → -
docker run to docker-compose: Convert Any Command, Flag by Flag
A practical guide to converting a docker run command into a docker-compose.yaml file — what each flag maps to (-p, -e, -v, --restart, --name, --network), with copy-paste examples for Postgres, Redis, and Nginx.
Read → -
How to Read an X.509 Certificate, Field by Field
An X.509 / SSL certificate looks like a wall of Base64, but decoded it is a short list of meaningful fields. Here is what subject, issuer, validity, SAN, and key usage actually mean — and why a SAN mismatch breaks Chrome.
Read → -
A Free iLovePDF Alternative — No Upload, No Watermark, No Account
Looking for a free iLovePDF or Smallpdf alternative that does not upload your files, add watermarks, or gate everything behind an account? Here is an honest comparison and a browser-based set of PDF tools for developers.
Read → -
Unix Timestamps and Epoch Time Explained (Plus the Year 2038 Problem)
What a Unix timestamp actually is, why "the epoch" is 1970, how seconds vs milliseconds trips people up, timezones, and the Year 2038 problem — with tools to convert epoch values instantly.
Read → -
HEIC vs JPG: What's Actually Different?
Compression, quality, file size, compatibility — a practical comparison of HEIC and JPG, and when to convert between them.
Read → -
Why Does My iPhone Save Photos as HEIC (and How to Change It)
What HEIC is, why Apple made it the default, how to make your iPhone shoot JPG again — and the fastest way to convert the HEIC photos you already have.
Read → -
The Graph Paper Field Guide: Square, Dot, Isometric, Hex, and Beyond
Not all grids are the same. A practical field guide to the seven kinds of graph paper — square, dot, isometric, hexagonal, engineering, semi-log, and polar — what each one is actually for, the right grid size to pick, and how to print your own for free.
Read → -
Print Your Own Bullet Journal: Free Dot Grid, Planners, and Habit Trackers
Bullet journaling does not require a $30 notebook. Here is how to print your own dot grid, weekly and daily planners, and habit-tracker pages for free — the right dot spacing to use, how to bind loose sheets, and a printable setup that costs pennies.
Read → -
Why Your Printable Paper Prints the Wrong Size (and How to Fix It)
You printed 5mm graph paper and the squares came out at 4.6mm. The culprit is almost always print scaling. Here is why "Fit to Page" quietly shrinks your grid, how to print true-to-scale at 100%, and how margins and file format affect a print-perfect result.
Read → -
Structured Data & JSON-LD: A Practical Guide to Rich Results
A developer-focused guide to structured data and JSON-LD — what schema.org markup actually does for search, why JSON-LD beats microdata, which schema types earn rich results, where to put the script, and how to validate it before it ships.
Read → -
How TOTP 2FA Codes Actually Work: Shared Secrets, Time Steps & QR Codes
A developer-friendly breakdown of TOTP — the six-digit codes from authenticator apps. How the shared secret gets into your phone via a QR code, why the code changes every 30 seconds without any network connection, what HMAC and the time step do, and how the server verifies it.
Read → -
CIDR & Subnetting Explained: Reading /24, Masks, and Host Counts
A no-memorization guide to CIDR notation and subnetting — what the slash number really means, how to count hosts in a /24 or /20, why the network and broadcast addresses are reserved, how subnet masks work in binary, and the quick mental math for everyday networking.
Read → -
How bcrypt Actually Works: Salts, Cost Factors & Why You Never MD5 a Password
A developer-friendly explanation of bcrypt — why password hashing is different from regular hashing, what the salt and cost factor in a $2b$ string mean, how deliberate slowness defeats brute-force attacks, and why MD5 and SHA-256 are the wrong tools for passwords.
Read → -
UUID vs ULID: v4, v7, and Which ID You Should Actually Use
A practical comparison of UUID and ULID for generating unique IDs — how UUIDv4, UUIDv7, and ULID differ, why random IDs wreck database index performance, what "sortable" really buys you, and a clear decision guide for picking the right identifier in 2026.
Read → -
How to Test File Upload Limits: Boundaries, 413s, and Exact-Size Files
A practical developer guide to testing file upload limits correctly — nginx client_max_body_size, cloud function payload caps, S3 multipart thresholds, the MB vs MiB unit trap, and how to generate exact-size test files in any format.
Read → -
Sample File Sizes for Testing: 1 MB, 10 MB, 100 MB and Why They Matter
A practical guide to which file sizes you should actually test, the real-world thresholds they map to (form uploads, API gateways, CDN edge limits), the decimal MB vs binary MiB gotcha that causes off-by-5% limit bugs, and why round numbers are the worst test inputs you can pick.
Read → -
What Makes a File Valid? Magic Bytes & File Signatures Explained
How programs really know what a file is — not from its extension, but from the raw bytes at the start. A developer-friendly look at magic numbers, MIME sniffing, structural validity, and why renaming a .txt file to .pdf does not make a PDF.
Read → -
How ZIP Files Actually Work: Local Headers, Central Directory & the End Record
A developer-friendly deep-dive into the ZIP binary format — the three structural sections every archive contains, why a ZIP reader seeks from the end rather than the beginning, how STORE and DEFLATE differ, and what really happens when a tool reports your archive is corrupt.
Read → -
PNG vs JPG vs WebP vs AVIF: Which Format to Use and When
A practical breakdown of the four main web image formats — PNG, JPG, WebP, and AVIF — covering lossless vs lossy, alpha transparency, compression efficiency, browser support in 2026, animation, encode/decode cost, and a clear decision guide for developers.
Read → -
Cron Syntax Cheat Sheet: Fields, Examples & Special Strings
A clear cron cheat sheet: what each of the five fields means, the special characters, @daily-style shortcuts, ready-to-use schedule examples, and the day-of-week gotcha that catches everyone.
Read → -
Git Cheat Sheet: The Commands You Actually Use (with the Gotchas)
A practical Git cheat sheet grouped by what you are trying to do — commit, branch, undo, stash, sync, and recover — with the gotchas that bite people. Copy-paste ready.
Read → -
How Font Files Actually Work: TTF, OTF, WOFF & WOFF2 Explained
A developer-friendly look at what is really inside a font file — sfnt tables, TrueType vs CFF outlines, and why WOFF/WOFF2 are just compressed containers. Plus when converting between formats is lossless and when it is not.
Read → -
How JWTs Actually Work: Header, Payload, Signature & Common Mistakes
A developer-friendly explainer of JSON Web Tokens — what the three parts really are, what signing does and does NOT do, how validation works, and the security mistakes that cause real breaches.
Read → -
Regex Cheat Sheet: Syntax, Patterns & Copy-Paste Examples
A practical regular expression cheat sheet — anchors, character classes, quantifiers, groups, and lookarounds — plus ready-to-use patterns for email, URLs, dates and more, and the gotchas to avoid.
Read → -
The Best Free SEO Audit Tools for Developers (No Signup)
An honest roundup of free SEO audit tools for developers — including competitors — judged on depth, signup friction, and the technical checks that actually matter.
Read → -
Core Web Vitals Explained: LCP, INP, and CLS for Developers
What LCP, INP, and CLS actually measure, the thresholds that matter, and the real causes behind each failure — written for developers, with concrete fixes.
Read → -
The Complete On-Page SEO Checklist (45 Checks, Free Tools Included)
A practical, developer-focused on-page SEO checklist for 2026 — meta tags, headings, content, links, images, structured data, Core Web Vitals, security headers, and crawlability, each with a free tool to check it.
Read → -
A Free SEOptimer Alternative — No Email, No Paywall
Looking for a free SEOptimer alternative that does not gate the report behind an email signup? Here is an honest comparison and a no-signup, browser-based option for developers.
Read →