Web Dev & Tooling Guides
Short, practical notes on the things our tools touch — encoding, auth, accessibility, data formats, and scheduling.
How to Read Any Regex, Token by Token
Regexes look like line noise until you read them left to right, one token at a time. Here's the decoding method, the six token types, and the traps.
YAML vs JSON: Differences, Gotchas, and When to Use Each
YAML is JSON with comments and less punctuation — and a few sharp edges. Here's how they differ, the Norway problem, and when to pick one over the other.
URL Encoding: What Gets Percent-Encoded and Why
URL encoding replaces unsafe characters with %XX escapes. Here's which characters are reserved, why spaces become %20 (or +), and the encodeURI vs encodeURIComponent trap.
WCAG Contrast Ratios: What 4.5:1 Actually Means
WCAG contrast is a ratio between text and background luminance. Here's how the 4.5:1 and 3:1 thresholds work, the large-text exception, and how to hit AA and AAA.
Why You Shouldn't Hash Passwords with SHA-256
SHA-256 is a great hash — and a terrible password hash. Here's why fast hashes fail at password storage, and what bcrypt does differently.
UUID v4 vs ULID: Which Should You Use for IDs?
UUID v4 is random and ubiquitous; ULID is sortable and compact. Here's how they differ, why random IDs hurt database indexes, and when each is the right choice.
Cron Expressions Explained, Field by Field
A cron expression is five fields that describe a schedule. Here's what each field means, how the special characters work, and the one gotcha that trips everyone up.
px, rem, and em in CSS: When to Use Each
px is absolute, rem is relative to the root, em is relative to the element. Here's a practical guide to choosing the right CSS unit — and avoiding em's compounding trap.
How JWT Signing Works (and Why You Can't Verify It in the Browser)
A JWT's signature is what makes it trustworthy. Here's how HS256 and RS256 signing actually work, and why verifying a token client-side is impossible.
Base64 vs Base64URL: What's the Difference?
Base64 and Base64URL encode the same bytes but use different alphabets. Here's why JWTs and URLs use the URL-safe variant, and how to convert between them.