Tutorials, deep-dives, and privacy-first thinking about developer tools.
Showing 25–36 of 38 posts
Regex lookahead vs lookbehind, explained with five production patterns: password rules, thousands separators, price parsing, and camelCase splits.
A pattern that works in PCRE can silently break in JavaScript or Python re. Here are the regex flavor differences that explain why, with fixes for each.
Unix timestamp 1700000000 was Tuesday, November 14, 2023, 22:13:20 UTC. Learn how to date any timestamp from its leading digits, no converter needed.
JWT exp, nbf, and iat are Unix timestamps in seconds. Learn to read them in 3 seconds, convert them to a date, and check token expiry by hand.
Learn what the JWT exp, nbf, and iat claims mean, how to read token expiry without doing epoch math by hand, and the clock-skew gotchas that bite in 2026.
Your JavaScript timestamp is in milliseconds while most backends use seconds, so it looks 1000× too big. Here is why, and how to convert it safely.
RFC 3986 names just 66 characters as unreserved — and most encoders mishandle the rest of printable ASCII. Here's what each one actually is, and why it matters.
A double-encoded URL is when a value runs through encodeURIComponent twice. Here's how to spot %2520 in seconds and fix the API bug it caused.
Every JWT carries the same standard claims — iss, sub, aud, exp, iat, nbf, jti. Here's what each one means, RFC 7519 references, and the bugs they cause.
encodeURIComponent vs encodeURI trips up every JavaScript dev once — here's the actual rule, the characters each protects, and when to pick which in 2026.
A Unix timestamp is the 10-digit number in every log line — here's what it means, why timezones don't apply, and how to convert it without bugs in 2026.
Why URLs use + for spaces, when to use %20 instead, and how to encode a literal + as %2B. Covers the 30-year-old form-encoding quirk that still breaks emails with `+` in 2026.