Tutorials, deep-dives, and privacy-first thinking about developer tools.
Showing 25–36 of 61 posts
A double-encoded URL is when a value runs through encodeURIComponent twice. Here's how to spot %2520 in seconds and fix the API bug it caused.
A 400 Bad Request usually traces to a URL decoding bug. Here's how to decode the query string, spot the broken character, and ship a fix in five minutes.
HS256 vs RS256 is the first decision when issuing a JWT — symmetric speed vs asymmetric key separation. Here's how to pick the right algorithm in 2026.
Every JWT carries the same standard claims — iss, sub, aud, exp, iat, nbf, jti. Here's what each one means, RFC 7519 references, and the bugs they cause.
URL encode online without leaking auth tokens, S3 links, or password-reset codes. Here's where pasted URLs actually end up — and how to encode privately.
encodeURIComponent vs encodeURI trips up every JavaScript dev once — here's the actual rule, the characters each protects, and when to pick which in 2026.
A Unix timestamp is the 10-digit number in every log line — here's what it means, why timezones don't apply, and how to convert it without bugs in 2026.
Decode a JWT in 2026 with real Auth0 and Firebase tokens — header, payload, signature explained, common debugging traps, and why pasting tokens online is risky.
Why URLs use + for spaces, when to use %20 instead, and how to encode a literal + as %2B. Covers the 30-year-old form-encoding quirk that still breaks emails with `+` in 2026.
URL encoding looks simple until your API drops a plus sign. Here's the real difference between component, URI, and form encoding — with code, fixes, and 2026 rules.
Looking for an Appicon.co alternative? iKit's browser-only app icon generator outputs the same iOS, Android adaptive, and PWA icons — without uploading your source PNG to any server.
What does JSON decode actually mean? It's not the same as parse or validate — and confusing them ships bugs. Three operations, finally distinguished.