Tutorials, deep-dives, and privacy-first thinking about developer tools.
Showing 25–35 of 35 posts
RFC 3986 names just 66 characters as unreserved — and most encoders mishandle the rest of printable ASCII. Here's what each one actually is, and why it matters.
A double-encoded URL is when a value runs through encodeURIComponent twice. Here's how to spot %2520 in seconds and fix the API bug it caused.
HS256 vs RS256 is the first decision when issuing a JWT — symmetric speed vs asymmetric key separation. Here's how to pick the right algorithm in 2026.
Every JWT carries the same standard claims — iss, sub, aud, exp, iat, nbf, jti. Here's what each one means, RFC 7519 references, and the bugs they cause.
encodeURIComponent vs encodeURI trips up every JavaScript dev once — here's the actual rule, the characters each protects, and when to pick which in 2026.
A Unix timestamp is the 10-digit number in every log line — here's what it means, why timezones don't apply, and how to convert it without bugs in 2026.
Why URLs use + for spaces, when to use %20 instead, and how to encode a literal + as %2B. Covers the 30-year-old form-encoding quirk that still breaks emails with `+` in 2026.
URL encoding looks simple until your API drops a plus sign. Here's the real difference between component, URI, and form encoding — with code, fixes, and 2026 rules.
What does JSON decode actually mean? It's not the same as parse or validate — and confusing them ships bugs. Three operations, finally distinguished.
How iKit ships 14 independent tools as 14 separate Laravel apps with shared conventions, 25-language i18n, and zero file uploads — the operational handbook for a browser-first toolkit.
A technical look at how every iKit tool processes your files locally — WebAssembly, OffscreenCanvas, Web Crypto, and the patterns that replace server round-trips.