Tutorials, deep-dives, and privacy-first thinking about developer tools.
Showing 61–72 of 106 posts
Learn what the JWT exp, nbf, and iat claims mean, how to read token expiry without doing epoch math by hand, and the clock-skew gotchas that bite in 2026.
Your JavaScript timestamp is in milliseconds while most backends use seconds, so it looks 1000× too big. Here is why, and how to convert it safely.
Unix timestamps come in seconds, milliseconds, microseconds, and nanoseconds. This 2026 cheat sheet shows how to tell them apart and convert safely.
Sign a JWT in the browser with HS256 and the Web Crypto API — five lines of JavaScript, no library, no server. The 2026 walkthrough.
When an API returns 401 Unauthorized in 2026, the JWT is usually the smoking gun. Decode the token, read exp, aud, iss — and fix the bug in 90 seconds.
Converting a Unix timestamp to a date is one division operation, but the timezone you format it in is the whole bug. Here's how to get it right.
RFC 3986 names just 66 characters as unreserved — and most encoders mishandle the rest of printable ASCII. Here's what each one actually is, and why it matters.
jwt.io is the JWT inspector most developers reach for, but should production tokens leave your machine? Here's how the iKit JWT Decoder compares in 2026.
The JWT alg: none vulnerability lets attackers forge tokens without a secret. Here's how the exploit works and why libraries still trip on it in 2026.
A double-encoded URL is when a value runs through encodeURIComponent twice. Here's how to spot %2520 in seconds and fix the API bug it caused.
A 400 Bad Request usually traces to a URL decoding bug. Here's how to decode the query string, spot the broken character, and ship a fix in five minutes.
HS256 vs RS256 is the first decision when issuing a JWT — symmetric speed vs asymmetric key separation. Here's how to pick the right algorithm in 2026.