Tutorials, deep-dives, and privacy-first thinking about developer tools.
Showing 73–84 of 105 posts
Your JavaScript timestamp is in milliseconds while most backends use seconds, so it looks 1000× too big. Here is why, and how to convert it safely.
Sign a JWT in the browser with HS256 and the Web Crypto API — five lines of JavaScript, no library, no server. The 2026 walkthrough.
When an API returns 401 Unauthorized in 2026, the JWT is usually the smoking gun. Decode the token, read exp, aud, iss — and fix the bug in 90 seconds.
Converting a Unix timestamp to a date is one division operation, but the timezone you format it in is the whole bug. Here's how to get it right.
RFC 3986 names just 66 characters as unreserved — and most encoders mishandle the rest of printable ASCII. Here's what each one actually is, and why it matters.
The JWT alg: none vulnerability lets attackers forge tokens without a secret. Here's how the exploit works and why libraries still trip on it in 2026.
A double-encoded URL is when a value runs through encodeURIComponent twice. Here's how to spot %2520 in seconds and fix the API bug it caused.
Every JWT carries the same standard claims — iss, sub, aud, exp, iat, nbf, jti. Here's what each one means, RFC 7519 references, and the bugs they cause.
URL encode online without leaking auth tokens, S3 links, or password-reset codes. Here's where pasted URLs actually end up — and how to encode privately.
encodeURIComponent vs encodeURI trips up every JavaScript dev once — here's the actual rule, the characters each protects, and when to pick which in 2026.
A Unix timestamp is the 10-digit number in every log line — here's what it means, why timezones don't apply, and how to convert it without bugs in 2026.
Decode a JWT in 2026 with real Auth0 and Firebase tokens — header, payload, signature explained, common debugging traps, and why pasting tokens online is risky.