Blog
Guides, explainers, and updates from the DevTools Hub team.
Encoding vs Encryption vs Hashing
All three turn one piece of data into another, which is exactly why they get confused — and why mixing them up in real code is a security mistake, not just a vocabulary slip. Encoding is reversible with no key (Base64), encryption is reversible only with the right key (AES, RSA, TLS), and hashing is never reversible at all (bcrypt, Argon2). What each is actually for, and the real mistakes that come from picking the wrong one: "encoding" a secret as if it were hidden, storing passwords encrypted instead of hashed, and assuming HTTPS protects data once it's already stored.
AES vs RSA
Asking whether AES or RSA is "better" is like asking whether a hammer beats a screwdriver — one is symmetric (one key, both directions), the other asymmetric (a public/private pair), and that difference decides which one can even do the job. Why RSA can't encrypt more than a couple hundred bytes at a time, why AES has no way to give someone an encrypt-only capability, the hybrid-encryption pattern every real system (TLS included) actually uses, and why RSA-4096 isn't "stronger than AES-256" no matter how the numbers look.
What Happens If Password Hashes Leak?
A leaked hash table isn't a leaked password table, but it isn't nothing either. What actually happens depends first on how the passwords were stored (plaintext, a fast hash, or a real password-hashing algorithm), then on what an attacker does with a stolen table (crack the easy ones first, then feed the confirmed pairs into credential stuffing against completely unrelated sites), and finally on what the breached organization does in response — including why a strong hash doesn't mean skipping the forced reset.
How Long Does It Take To Crack A Password?
There's no single answer — a top-breached password like "password123" is cracked in seconds by dictionary lookup, while a truly random 16-character password can outlast the universe, under the exact same word "crack." What actually decides the answer: whether it's already on a breach list, where the attack happens (online, offline against a fast hash, or offline against a slow hash), and how much real randomness it has. Real crack-time numbers across common password styles, and why two 12-character passwords can land centuries apart.
Credential Rotation
Rotating a machine credential — an API key, a database password, a cloud IAM access key, a certificate — isn't a one-step swap. It's a create-new, deploy-alongside-old, verify, then revoke-old sequence, and skipping a step is exactly what turns routine rotation into an outage. The overlap-window pattern, scheduled vs. event-driven rotation, where automation actually handles it, and the mistakes that leave a "rotated" credential still valid.
Password Spraying Explained
Password spraying is the mirror image of credential stuffing: one guessed, never-leaked password tried against every account on a system, one attempt each, paced to slip under the per-account lockout threshold that would stop a classic brute-force attempt. Why per-account lockout alone is structurally blind to it, how the attack is actually paced and targeted (SSO front doors especially), and which defenses — MFA, common-password blocklists, risk-based throttling — actually close it.
Credential Stuffing Explained
Credential stuffing doesn't guess passwords — it replays already-correct ones, leaked from unrelated breaches, against every other login form at automated scale. Why password reuse makes this the most consequential password attack in practice, how the automation actually works, and which defenses (breach-checking, MFA, passkeys) target it directly versus which ones (rate limiting, CAPTCHAs) only slow it down.
Passwords vs Passkeys
A passkey isn't a stronger password — it's a structurally different credential. A public-key pair generated per site, where the half that could ever be phished or stolen never leaves your device. What that actually closes (breach exposure, credential stuffing, phishing relays), what it doesn't fix yet (recovery, cross-platform syncing), and how it relates to MFA and hardware security keys.
Minimum Password Length Recommendations
Every password-policy post on this site states the same fact in one line: an 8-character floor, 15+ recommended, 64+ supported. This one is the why — what each number actually buys you, broken down by the exact three attack scenarios (online rate-limited, offline fast hash, offline slow hash) this site's own crack-time tools already compute, plus practical length targets by account type.
NIST Password Guidelines Explained
"No forced rotation, no composition rules" is two headlines out of a much more specific document — Authenticator Assurance Levels, a mandatory ban on security questions, a rate-limiting requirement, and a truncation rule bcrypt has a real, narrow tension with. A provision-by-provision walkthrough of NIST SP 800-63B in its own SHALL/SHOULD language.
Password Rotation: Good or Bad?
Every mention of password rotation on this site states the same NIST-aligned verdict without ever arguing the other side. Here's the actual debate: the honest case for scheduled rotation, why it falls apart for a human-memorized password specifically, and the real exception nothing else covers — machine-generated credentials, where rotation still makes perfect sense.
Multi-Factor Authentication Explained
MFA gets a one-paragraph mention throughout this site's other posts as the control that catches a stolen or correctly guessed password, but never its own explanation. The three factor categories, why SMS, TOTP, push, and hardware keys aren't interchangeable, and the specific attacks (SIM swapping, MFA fatigue, real-time phishing relays) each one is and isn't resistant to.
How to Validate a CloudFormation Template
"Validate the template" means three different checks — syntax, structure, and resource-property semantics — and a template can pass the first two and still fail on deploy. The real tools for each layer (aws cloudformation validate-template vs. cfn-lint), what Capabilities actually tells you, and why only a change set catches account-specific failures.
Password Security: A Comprehensive Guide
Password security is four separate layers — creating one, the policy an organization sets, how it's actually stored, and defense beyond the password itself — each with its own failure mode. A roadmap connecting all four, linking out to a full deep-dive and the right tool wherever one already exists.
Password Hash Migration Strategies
You can't recompute a stronger hash for a password you don't have — every migration strategy is a different answer to what to do with the one moment you get the real plaintext back. Rehash-on-login, wrap-then-migrate, dual verification during the transition, forced reset, and migrating to a whole new identity provider, mapped to which situation actually needs which one.
What Makes a Strong Password Policy?
In 2017, the NIST manager who wrote the 2003 rules behind mandatory composition and 90-day rotation told the Wall Street Journal he regretted most of it. Why the guidance reversed once real breach data existed to check it against, what NIST SP 800-63B actually requires now, and a framework for judging any policy beyond a single checklist.
Docker Compose Environment Variables Explained
The project's root .env file doesn't automatically end up inside your container — it's read by the Compose CLI purely to substitute ${VAR} placeholders in docker-compose.yml before parsing. The three distinct mechanisms (.env interpolation, environment:, env_file:), the ${VAR:-default} vs ${VAR-default} syntax most people never learn, precedence, and why build args are a separate lifecycle entirely.
How Docker Compose Overrides Work
"Override" doesn't mean the same thing for every field — a mapping like environment: merges key-by-key, but a list like ports: gets concatenated, not replaced, which is exactly how a port collision or duplicate volume mount shows up after merging files. The three merge behaviors by YAML shape, the !override and !reset tags that force a real replace, file load order, and COMPOSE_FILE's second job for the project .env file.
Docker Compose Volumes Explained
"Does my data survive a restart" depends on which of three different things you used — bind mount, named volume, or anonymous volume — and which exact command you ran. The more surprising part: a bind mount can silently hide what the image actually built, which is exactly why the classic node_modules-disappears-after-bind-mounting problem happens, and the anonymous-volume trick that fixes it.
Message Queues Explained
"Exactly-once delivery" is impossible in the general case — every real guarantee is built around that fact. The visibility-timeout mechanic behind at-least-once delivery, why queue and topic are genuinely different delivery models (not branding), ordering guarantees that hold far less often than assumed, dead-letter queues, and how RabbitMQ, Kafka, SQS, and Redis Streams actually differ.
Kafka vs RabbitMQ
Not a speed contest — they're built on opposite premises. RabbitMQ is a smart broker that tracks per-message ack state and deletes on consumption; Kafka is a dumb, append-only log where the consumer tracks its own offset and replay is trivial. What that split actually causes (routing, priority, TTL, RPC, replay) and when each one genuinely wins.
Idempotency Explained
"Idempotent" doesn't mean "has no side effects" — DELETE has a very real side effect and is still idempotent. The precise definition (repeating it doesn't change the end state further), why POST can't be idempotent by definition, the Idempotency-Key pattern Stripe and PayPal use to make it safe anyway, and the same problem — and the same two fixes — on the consumer side of a message queue.
Eventual Consistency Explained
"Eventually" sounds reassuring, but the formal guarantee (Vogels, 2008) is much weaker than that — no bound on how long, and it only applies once writes stop entirely. The actual session guarantees (read-your-writes, monotonic reads, causal consistency), how replicas really converge (anti-entropy, read repair, hinted handoff), and why naive last-write-wins can silently lose data in a way vector clocks and CRDTs are specifically built not to.
Distributed Locks Explained
A distributed lock can't guarantee mutual exclusion the way a single-process mutex can — not primarily because of the network, but because a process can pause for an unbounded time and not know it. Kleppmann's Redlock critique, the fencing-token fix that actually closes the hole, the real Redlock/antirez debate, and how ZooKeeper, etcd, and Chubby build fencing in natively.
Load Balancers Explained
The mechanism Horizontal vs Vertical Scaling treated as a black box: L4 vs L7 (what a routing decision can and can't see), the actual algorithms (round robin, least connections, and the real power-of-two-choices algorithm nginx and HAProxy ship), active vs passive health checks, sticky sessions, and DNS round robin's TTL-staleness problem.
CAP Theorem Explained
"Pick two of three" is subtly wrong — partition tolerance was never optional for a real networked system, so the actual choice is CP vs AP during a partition. The precise Gilbert & Lynch definitions (CAP's Consistency isn't ACID's), real CP/AP systems with their tunable-consistency nuances, and PACELC, the extension covering the far more common non-partitioned case CAP says nothing about.
What Causes N+1 Queries
Invisible to EXPLAIN ANALYZE, because there's no single slow query — an ORM's lazy loading hiding a network round trip behind what looks like a property access, why eager-loading multiple relations at once can quietly multiply rows, and why GraphQL resolvers make N+1 the structural default instead of an accident.
Database Indexes Explained
"Index" isn't one thing — it's a family of structures. Hash indexes trade away ordering for O(1) equality, covering indexes skip the table entirely, partial indexes only cover the rows that matter, and the two mechanical reasons — low selectivity and a function wrapping the column — an index you did create can still get ignored.
Caching Explained
The mechanism underneath the hit rate number: eviction policies (LRU traced step by step, LFU, FIFO) and why they're implemented the way they are, write-through vs write-back vs write-around, why cache invalidation is genuinely hard, and the cache stampede failure mode that only shows up under real concurrent load.
Horizontal vs Vertical Scaling
The question that actually decides which one you need isn't cost or complexity — it's whether the thing you're scaling holds state. Why a stateless web tier scales out almost for free, why a database can't without hitting the CAP theorem, and why real systems do both in a specific, constrained order.
Understanding B-Trees
The tree behind every database index, and almost nothing like a binary search tree: why hundreds of keys per node beats one, how the split-on-insert mechanism keeps every leaf at the same depth without ever needing a rotation, and why almost no real database actually uses a plain B-tree — they use a B+ tree.
Tree vs Graph
A tree is a graph with three promises kept — connected, acyclic, exactly n-1 edges — and every difference between them falls out of which promise gets broken: why graph traversal always needs a visited set and tree traversal never does, why shortest path is trivial in a tree and hard in a graph, and the DAG-that-looks-like-a-tree trap (a git merge commit has two parents).
Kubernetes Rate Limiting Explained
"Kubernetes rate limiting" means three different things: client-go throttling itself (5 QPS / 10 burst by default), the API server's Priority and Fairness protecting the control plane (429s), and Ingress-level limits protecting your application (503s) — which Kubernetes gives you zero of until you add it yourself.
How Hash Maps Work
The companion to Hash Table Explained that goes under the hood of three real runtimes: why a plain JS object usually isn't a hash table at all, why Python's dict probes instead of chaining (with a real perturbed-probe-sequence example), and why Java's HashMap quietly turns a crowded bucket into a red-black tree.
Hash Table Explained
How Map, dict, and HashMap get average O(1) lookups: a hash function folded character by character (verified against the exact algorithm in Hash Table Visualizer), why collisions are inevitable, separate chaining vs open addressing, load factor and resizing, and why a bad hash function collapses O(1) straight into O(n).
How to Fix "invalid compose project" in Docker Compose
"invalid compose project" is a single hardcoded sentinel string reused across roughly nineteen unrelated Compose validation failures — traced to the exact source line that produces it, with every confirmed trigger, the close look-alike errors that don't carry this suffix, and the separate invalid-project-name error people mistake for it.
Array vs Linked List
Every complexity difference between an array and a linked list traces back to one decision: contiguous memory vs pointer-chained nodes. O(1) vs O(n) random access, why front-insert flips the advantage, the LRU cache pattern that's a linked list's real justification, and the cache-locality gap Big O never counts.
Big O Notation Explained with Real Examples
The code-first companion to Algorithm Complexity Explained: real JavaScript snippets for O(1) through O(2ⁿ), the habit of spotting complexity by counting loops instead of syntax, and the classic O(n²) gotcha that doesn't look nested at all.
When O(n²) Becomes a Problem
A real before-and-after fix, with real numbers: the same nested-scan function at 100 rows (0.1ms) versus 1,000,000 rows (2.8 hours), why a Set turns that into 10 milliseconds, and — just as important — when O(n²) genuinely isn't worth touching.
Time Complexity Interview Guide
The interview-specific companion to the rest of the Big O series: a data-structure and algorithm complexity cheat sheet, a framework for stating complexity out loud, the space-complexity question almost everyone forgets (the recursion call stack counts), and two fully worked examples.
Space Complexity Explained
The code-first, space-only companion to the rest of the Big O series: real O(1) through O(n²) memory examples, why recursion depth counts as space with no data structure in sight, and why naive Fibonacci is O(2ⁿ) time but only O(n) space — the same function, two genuinely different growth rates.
Docker Bridge vs Host vs Overlay Networks
The five Docker network drivers compared: what isolation and DNS each one actually gives you, why overlay always requires Swarm mode even for standalone containers, and when macvlan or ipvlan is the right call.
Common Docker Compose Networking Errors
Five networking-specific Compose mistakes verified against a real install: the network_mode/networks conflict, a ports: mapping that silently does nothing under host mode, an external network that isn't found for a subtle reason, and more.
How Docker DNS Resolution Works
What Docker's embedded DNS server at 127.0.0.11 actually resolves, why the default bridge network gets none of it, how Compose aliases work, and how to reach the host machine itself from inside a container.
How AWS Evaluates Multiple IAM Policies
What happens beyond a single identity-based policy: why a permissions boundary or SCP can only narrow access and never grant it, the two resource-based-policy exceptions (role trust policies and KMS key policies), the newer RCP layer, and why cross-account access needs an explicit allow from both accounts independently.
AWS ARN Examples
A real, correctly formatted example ARN for 23 common resource types — S3, IAM, Lambda, DynamoDB, EC2, RDS, ECS, KMS, Secrets Manager, and more — grouped by service, for whenever you just need to see the shape for one specific thing.
IAM Policy Examples
Ten real, working IAM policy shapes: read-only S3 access, full admin, an explicit deny overriding a broad allow, requiring MFA for destructive actions, IP and Region restrictions, tag-based attribute access control, role trust policies, and a cross-account resource-based policy.
Enforcing Least Privilege at Scale
Beyond narrowing one policy by hand: permissions boundaries as a structural ceiling for delegating role creation safely, SCPs as the same ceiling applied to an entire account or OU, the deny-list vs allow-list tradeoff, and tag-based ABAC as a scalable alternative to rewriting a policy per resource.
Algorithm Complexity Explained: A Comprehensive Guide
Why complexity analysis matters, time and space complexity, best/worst/average case, and the formal difference between Big O, Big Omega, and Big Theta — including the most common mix-up in the whole topic: case and notation are independent axes, not the same thing.
Password Hashing Best Practices
The operational checklist for after you've picked bcrypt or Argon2: current OWASP parameters, the length-DoS bug that hit Django in 2013, upgrading cost factors without a migration, and what peppering actually is.
Understanding Salt and Pepper
Salt and pepper solve different problems for different attackers. The mechanics of rainbow tables and why salting defeats them, exactly where a salt lives inside a bcrypt or Argon2 hash, and how a pepper actually works — and why rotating one is hard.
Argon2 Explained
How Argon2 actually works inside: the difference between Argon2d, Argon2i, and Argon2id addressing, how the memory array gets filled through a BLAKE2b-based, ASIC-hardened compression function, the full parameter list, and why RFC 9106 and OWASP recommend different numbers.
SQL JOIN Explained
INNER, LEFT, RIGHT, FULL, and CROSS JOIN, what actually happens to unmatched rows in each, self-joins, ON vs USING, and why a comma join without a WHERE condition silently becomes a cartesian product.
LEFT JOIN vs INNER JOIN
The core difference verified against real query output, and the single most common LEFT JOIN bug in production code: a WHERE clause that silently turns it back into an INNER JOIN with no error at all.
GROUP BY Explained
One row per what? Aggregate functions and the COUNT(*) vs COUNT(column) split, HAVING vs WHERE, why databases enforce the grouping rule differently, and how a LEFT JOIN before GROUP BY can quietly inflate a SUM.
Common SQL Mistakes
Not syntax errors — queries that run without complaint and quietly return the wrong answer. NULL comparisons, the LEFT JOIN/WHERE trap, UNION vs UNION ALL, and a date-range filter that silently drops the last day, all verified against real output.
How Query Optimization Works
What a cost-based query planner actually does: access methods, the statistics behind every cost estimate, nested loop vs hash vs merge join, why join order search explodes with more tables, and the real causes of a bad plan.
String Escaping Explained
Escaping, encoding, and sanitizing get used interchangeably and shouldn't be — three different operations, three different guarantees. Why JSON, JavaScript, SQL, HTML, and regex each need their own escaping rules, and the double-escaping trap.
Why HTML Escaping Prevents XSS
The exact mechanism — a script tag that never becomes a tag because the character that starts it was replaced first — plus OWASP's core point: HTML body escaping doesn't cover attributes, JavaScript, URLs, or CSS, and why frameworks still ship an escape hatch.
How to Escape Special Characters in Regex
Why an unescaped user-supplied search term silently matches more than it should, the classic metacharacter-only escaping approach, and the more aggressive algorithm behind JavaScript's native ES2026 RegExp.escape() — verified against MDN's documented examples.
scrypt Explained
The first widely-adopted memory-hard password hashing algorithm, built by Colin Percival for his own Tarsnap backup service in 2009 — its three-phase construction, the ROMix memory-hard core, and why its N parameter couples memory and time in a way Argon2 deliberately doesn't.
PBKDF2 Explained
The oldest algorithm in this site's password-hashing coverage, standardized in 2000 and still running WPA2 and iOS/Android keychains today. Its chained-PRF construction, why it doesn't resist GPUs the way Argon2 or scrypt do, and when it's still the right choice.
Common GitHub Actions Errors
A field guide to the GitHub Actions mistakes that show up most often — mutually exclusive fields, needs: races, the ::set-output:: command that's been silently doing nothing since 2023, and the script-injection pattern behind real security incidents.
Configuration Best Practices
Failing fast on missing config instead of crashing three requests later, centralizing env var access behind one typed module, why a convenient default can silently mask a real misconfiguration, and keeping config precedence explicit.
Common Kubernetes Manifest Errors
A field guide to the manifest mistakes kubectl apply rejects most often — apiVersions Kubernetes has actually removed, uppercase resource names (never allowed), the stricter naming rule Services alone follow, and a Service with no selector that silently routes nowhere.
Bcrypt vs Argon2
Where each algorithm came from, why Argon2's memory-hardness actually matters against GPU/ASIC cracking, bcrypt's 72-byte ceiling, and honest guidance on which to pick.
Why SHA-256 Should Not Be Used for Passwords
SHA-256 isn't broken — that's exactly the problem. Real GPU and Bitcoin-ASIC throughput numbers, why PBKDF2 using SHA-256 internally isn't a contradiction, and how to migrate off it safely.
How to Validate JSON in JavaScript
JSON.parse and try/catch only prove a string is syntactically valid JSON — not that it has the shape your code expects. The difference, a hand-rolled shape check, and when to reach for a JSON Schema validator like ajv instead.
How to Validate OpenAPI Specifications
Schema validation only proves a document is well-formed OpenAPI — not that its operationIds are unique, its path parameters are declared, or its $refs resolve. The two layers of validation, the tools for each, and the 3.0-vs-3.1 gotcha that produces false errors.
Generate Postman Collections from OpenAPI
The mapping from an OpenAPI document to a Postman collection is mechanical — paths become requests, schemas become example bodies — which is exactly why hand-building one is wasted effort. What actually carries over, what doesn't (auth, cookies, response examples), and the CLI route for CI.
20 Common Regex Patterns
Ready-to-use JavaScript patterns for the things that come up constantly — email, URLs, IPv4, passwords, dates, UUIDs, currency, and more — each with what it deliberately doesn't handle, verified against real pass/fail cases.
How Checksums Work
A checksum is a fixed-size fingerprint of data — but a byte-sum, a CRC, and a SHA-256 hash all compute that fingerprint completely differently, with very different guarantees. What each catches, what each doesn't, and why only one is safe against a deliberate attacker.
Common SQL Syntax Errors
A field guide to the SQL mistakes that show up most often — trailing commas, unbalanced parens, quote-type mix-ups — verified against a real database, including the ones that don't error at all and just quietly return the wrong answer.
Common Docker Compose Errors
A field guide to the docker-compose.yml mistakes that only surface at docker compose up — undeclared volumes and networks, malformed ports, undefined depends_on references, and why the once-famous YAML boolean-coercion trap no longer reproduces in current Compose.
Helm Values Explained
How Helm actually merges multiple values files (deep merge for maps, full replacement for arrays, null deletes a key), why --set always wins over -f no matter the flag order, and the YAML 1.1 gotchas that silently turn "no" into false — all verified against a real Helm install.
What Is an ARN?
The string that uniquely identifies any AWS resource — its six-field format, why region and account ID are sometimes empty, the Lambda ARN shape that breaks a naive parser, wildcards, and AWS's own incomplete-ARN auto-completion quirk.
IAM Policy Basics
The anatomy of an IAM policy document — Version, Statement, Effect, Action, Resource — identity-based vs. resource-based policies, managed vs. inline, and the three-rule core of how AWS actually decides allow or deny.
Least Privilege Explained
Why a role with AdministratorAccess is a liability, AWS's own guidance that starting broad is fine as long as you narrow later, what narrowing an Action/Resource/Condition actually looks like, and the two AWS tools that automate most of it.
CloudFormation vs Terraform
AWS-only vs. multi-cloud, YAML/JSON vs. HCL, state managed for you vs. a .tfstate file you own, automatic rollback vs. manual cleanup, and Terraform's 2023 license change that led to OpenTofu.
AWS Regions Explained
Regions, Availability Zones, Local Zones, and Wavelength Zones aren't just different sizes of the same thing — plus the AZ-name-randomization quirk that can put your 'us-east-1a' and someone else's in different buildings, and AZ IDs, the fix for it.
What Is a Cron Expression?
A cron expression is the five-field string that tells cron (and Kubernetes, and GitHub Actions) when to run a job. Here's the short definition, where the format comes from, and where you'll run into it.
What Is YAML?
YAML is the indentation-based data format behind Kubernetes manifests, Docker Compose, and CI pipelines. Here's the short definition, the syntax basics, YAML vs. JSON, and the mistakes — tabs, the Norway problem — that actually cause failures.
JSON vs YAML
Every valid JSON document is valid YAML, so what actually differs? Comments and anchors YAML has and JSON doesn't, explicit vs. inferred typing, a security gotcha worth knowing, and when to reach for which.
Common YAML Mistakes
Most YAML bugs don't throw an error — they parse cleanly into the wrong value. Tabs, the colon-space trap, disappearing leading zeros, reserved first characters, null vs. empty string, and more, each verified against a real parser.
What Is JSON Schema?
Valid JSON and JSON with the right shape are different questions. JSON Schema is how you write down what "the right shape" means — a minimal example, the keywords that come up constantly, which draft to target, and where it quietly powers editor autocomplete.
JSON Schema Examples
A reference collection of schemas for shapes that actually come up: nested objects, array constraints, enums, regex patterns, formats, nullable fields, oneOf polymorphism, and tuple validation in both Draft-07 and 2020-12 — every example verified with ajv.
JSON Schema Validation Explained
How validation actually works underneath the vocabulary: why every applicable keyword gets checked instead of stopping at the first failure, reusing schemas with $ref/$defs, recursive self-references, if/then/else, and why some keywords describe instead of restrict.
What Is JSONPath?
A query language for pulling values out of JSON without a chain of brittle property access — where it came from (a 2007 blog post, an RFC seventeen years later), how it differs from JSON Pointer, JMESPath, and jq, and a real security note on script expressions.
JSONPath Examples
A reference collection of JSONPath expressions against realistic JSON: API responses, config search with recursive descent, log filtering, array slices, flattening nested arrays, script expressions, and combining recursive descent with a filter — every expression verified.
URL Encoding Explained
What percent-encoding actually does, why the same character is safe in one part of a URL and reserved in another, encodeURIComponent vs. encodeURI, and why query strings treat + as a space.
What Characters Need URL Encoding?
A direct reference: the unreserved characters that are always safe, what each reserved character means, exactly what encodeURIComponent vs. encodeURI leave alone, and the encoding rules by URL part.
How Query Parameters Work
Query string mechanics beyond encoding: why everything is a string, the three conventions for repeated keys, why .get() silently drops values, and when to use a query param instead of a path segment or request body.
URL Encoding Examples
A quick-reference table of real inputs and their encoded output: everyday text, email addresses, search queries, a URL nested inside a parameter, non-Latin scripts and emoji, and component vs. full-URI encoding side by side.
How to URL Encode JSON
Putting a JSON object in a query parameter: JSON.stringify + encodeURIComponent, decoding it back without double-decoding, the real size cost, and when flat query parameters are the better fit instead.
URL Encoding in React
Where React and its routers handle encoding for you, and where they don't: why Link href isn't reliably safe with raw interpolated values, why useSearchParams() already decodes, and the double-encode bug in state-to-URL syncing.
URL Encoding in Node.js
The legacy querystring module vs. the global URL/URLSearchParams API: why they encode a space differently (%20 vs. +), why querystring.parse groups repeated keys for free where URLSearchParams doesn't, and how to build an outbound request URL correctly.
URL Encoding in Python
urllib.parse's split API, verified: why quote() leaves / unescaped by default, quote vs. quote_plus for spaces, the unquote/unquote_plus mismatch that leaves a stray + behind, and the urlencode doseq trap for list values.
URL Encoding in Java
Verified: why URLEncoder is a form encoder, not a URI encoder (space becomes +, running it on a whole URL breaks the path), the ~ it escapes that RFC 3986 says it shouldn't, and why java.net.URI is the right tool for building a real URI.
Kubernetes YAML Explained
The declarative model behind kubectl apply, the four fields every manifest needs, why you'll rarely write a bare Pod, labels vs annotations, multi-document files, and why apiVersion isn't just a version number.
Kubernetes Resource Requests vs Limits
Why requests and limits are read by two entirely different parts of Kubernetes, what overcommitment actually means, the precise (and very different) consequences of exceeding a CPU limit versus a memory limit, and namespace-wide guardrails.
What Is JWT Authentication?
How JWT-based authentication actually works end-to-end: the login-to-request flow, access vs. refresh tokens, where to store them client-side, what the server checks on every request, and how it differs from session auth and OAuth2.
Managing Environment Variables
Why .env files are a local convenience rather than a production mechanism, why every environment variable is always a string, the parsing gotchas that fail silently, and keeping .env.example from drifting out of sync.
.env vs Secrets Managers
Why .env files are great for local development and a liability at team/production scale — access control, audit trails, rotation, and a practical guide to when a dedicated secrets manager actually earns its keep.
GitHub Actions for Beginners
A beginner-friendly tour of GitHub Actions: events, jobs, runners, steps, actions vs. run commands, secrets, and a complete worked example.
GitHub Actions Best Practices
Practical GitHub Actions habits: canceling superseded runs, caching dependencies, matrix testing, handling failures deliberately, sharing data between jobs, reusable workflows, least-privilege permissions, and pinning actions.
Understanding Cron Expressions
A practical guide to cron's five-field syntax: the symbols that do all the work, the day-of-month/day-of-week OR trap, @nickname shorthands, and the mistakes worth double-checking before you deploy a schedule.
Cron Examples for Daily Operations
Copy-pasteable cron expressions for backups, log cleanup, health checks, reports, and maintenance windows — plus why the popular "first Monday of the month" trick is actually broken, and how to avoid overlapping runs.
Docker Best Practices
Practical Dockerfile and Compose habits: ordering layers for cache efficiency, multi-stage builds, pinning tags, cleaning up in the same RUN layer, avoiding ARG for secrets, running as non-root, and why depends_on isn't a readiness check.
Understanding Docker Networks
Why containers on the default bridge can't resolve each other by name, what Compose actually sets up, why container-to-container traffic ignores published host ports, and what EXPOSE does and doesn't do.
SQL Formatting Best Practices
Practical SQL formatting conventions: uppercase keywords, one clause per line, indenting subqueries and CTEs, explicit JOIN syntax, and why automating it beats relying on discipline.
How to Read Complex SQL Queries
Practical techniques for reverse-engineering someone else's dense SQL: why execution order isn't written order, reading CTEs as a pipeline, tracing JOINs, and the LEFT JOIN + WHERE trap.
MD5 vs SHA-256 vs SHA-512
Why MD5 is broken for anything adversarial, how SHA-256 and SHA-512 differ under the hood, why the bigger digest can actually be faster, and which one to reach for.
Password Hashing Explained
Why fast hash functions like SHA-256 are wrong for passwords, what salting actually fixes (and doesn't), and how bcrypt, scrypt, Argon2, and PBKDF2 deliberately slow attackers down.
What Is Base64 Encoding?
How Base64 turns binary data into text-safe characters, why the padding and URL-safe variant exist, and why it's an encoding — not encryption.
Base64 vs URL Encoding: What's the Difference?
Base64 represents binary data as text; URL encoding escapes text for a URL. Why they get confused, why standard Base64 isn't URL-safe, and which one to use when.
Common Encoding Problems in APIs
The encoding bugs that actually show up in production: double encoding, standard Base64 breaking in URLs, padding mismatches, charset mojibake, unescaped API data in HTML, and more.
Regex Performance Tips: Avoiding Catastrophic Backtracking
Why some regular expressions hang on specific input, how to spot the nested-quantifier patterns that cause it, and smaller wins for everyday regex performance.
Regex for Beginners: A Practical Guide
A beginner-friendly tour of regular expressions: character classes, anchors, quantifiers, groups, and the mistakes that trip up newcomers.
Common OpenAPI Validation Errors
A field guide to the OpenAPI/Swagger mistakes that show up most often — broken $ref references, duplicate operationIds, missing response descriptions, and path parameter mismatches — and why each one breaks real tooling.
OpenAPI vs Swagger: What's the Difference?
Swagger and OpenAPI get used interchangeably, but they're not quite the same thing anymore. A brief history of how one became the other, and what actually changed structurally between Swagger 2.0 and OpenAPI 3.x.
JWT Claims Explained
A practical walkthrough of every registered JWT claim — iss, sub, aud, exp, nbf, iat, jti — plus the common OAuth2 claims and custom claims you'll run into in real tokens.
JWT Security Best Practices
A practical checklist for using JWTs safely: the algorithm-confusion attack, why alg:none must be rejected, key management, token lifetime, storage tradeoffs, and what to actually verify on every request.
How to Format JSON for Better Readability
Indentation conventions, why trailing commas and comments break strict JSON, when to pretty-print vs. minify, and how consistent formatting makes diffs and reviews easier.
Common JSON Errors and How to Fix Them
A field guide to the JSON syntax errors that show up most often — trailing commas, single quotes, unquoted keys, duplicate keys, bad escapes — and how to read the parser's error message to find them fast.
We're Live: DevTools Hub Launch Day
DevTools Hub is live with 16 free developer tools — secure, no cookies, no ads for now. Here's what we launched with and what's coming next.
What Is a JWT? A Practical Guide
A practical breakdown of JSON Web Tokens: their three-part structure, how signing actually works, JWTs vs. session cookies, and the mistakes that get teams in trouble.