Guides
In-depth articles explaining the concepts behind each tool. Learn the theory, then use the tool.
JWT tokens explained
8 minHow JSON Web Tokens work: structure, signing algorithms, authentication flow, security best practices, and common pitfalls.
Regex cheat sheet
7 minA complete reference for regular expression syntax: character classes, anchors, quantifiers, groups, lookaheads, flags, and common patterns.
bcrypt vs SHA-256: choosing the right hash
6 minWhy SHA-256 is wrong for passwords and bcrypt is wrong for data. How each algorithm works, when to use each, and what Argon2 is.
JSON vs YAML: which should you use?
5 minSide-by-side comparison of JSON and YAML: syntax differences, when to use each, common pitfalls, and how they convert to each other.
HTTP status codes explained
6 minEvery HTTP status code class explained: what 2xx, 3xx, 4xx, and 5xx mean, which codes to use in your API, and the ones you will see most often.
CORS explained
7 minWhat Cross-Origin Resource Sharing is, why browsers enforce it, how preflight requests work, and how to configure the right response headers.
Cookies vs localStorage vs sessionStorage
6 minSize limits, persistence, security characteristics, and the right storage choice for auth tokens, user preferences, and app state.
HTTP caching headers explained
7 minHow Cache-Control, ETag, Last-Modified, and Vary headers work, how browsers and CDNs interpret them, and the caching mistakes that hurt performance.
Base64 explained
5 minWhat Base64 encoding is, how the algorithm works, when to use it and when not to, the URL-safe variant, and the mistake of treating it as encryption.
URL encoding explained
5 minWhat percent-encoding is, which characters must be encoded, the difference between encodeURI and encodeURIComponent, and how query strings work.
Unicode and UTF-8 explained
6 minWhat Unicode is, how UTF-8 encodes it, why string lengths surprise you, what emoji do to your byte counts, and how to handle it correctly in code.
OAuth 2.0 and OpenID Connect explained
9 minHow OAuth 2.0 authorization flows work, when to use authorization code vs client credentials, what OpenID Connect adds, and where JWTs fit in.
SQL injection and XSS: how they work and how to stop them
8 minHow SQL injection and cross-site scripting attacks work, with real examples and the defenses that actually stop them: parameterized queries, CSP, and output encoding.
REST vs GraphQL vs gRPC: which API style to use
8 minHow REST, GraphQL, and gRPC differ in data fetching, typing, tooling, and performance, with clear guidance on when to reach for each.
Semantic versioning explained
5 minWhat MAJOR.MINOR.PATCH means, what the ^ and ~ range operators in package.json do, how pre-release versions work, and when to bump which number.
UUID vs ULID: which identifier should you use?
6 minHow UUIDs and ULIDs work, why random UUIDs fragment database indexes, when ULID time-sorting matters, and how to choose between them.