https://devtoolsonline.dev/blog/ Tutorials, guides, and deep dives on JSON, SQL, JWT, encoding, security, and the developer tools we build. en-us Sat, 09 May 2026 09:01:26 GMT https://devtoolsonline.dev/blog/wcag-color-contrast-aa-aaa/ https://devtoolsonline.dev/blog/wcag-color-contrast-aa-aaa/ Sat, 09 May 2026 00:00:00 GMT Light grey on white is the most common accessibility failure. Twenty percent of users can't read it. The fix is a 30-second check, but you have to know what to check for. noreply@devtoolsonline.dev (DevTools Online Team) Accessibility Color Reference https://devtoolsonline.dev/blog/uuid-v4-vs-v7/ https://devtoolsonline.dev/blog/uuid-v4-vs-v7/ Sat, 09 May 2026 00:00:00 GMT UUID v4 dominated for 15 years because it was 'good enough.' UUID v7 fixes the one real problem v4 had, random UUIDs are terrible primary keys. The migration is overdue. noreply@devtoolsonline.dev (DevTools Online Team) Identifiers Database Comparison https://devtoolsonline.dev/blog/user-agent-strings-mess/ https://devtoolsonline.dev/blog/user-agent-strings-mess/ Sat, 09 May 2026 00:00:00 GMT The User-Agent string is a 30-year-old archaeology site. Every browser still claims to be Mozilla 5.0. Chrome claims to be Safari. The reasons are historical and the parsing is a tax we still pay. noreply@devtoolsonline.dev (DevTools Online Team) HTTP Web Problem-solving https://devtoolsonline.dev/blog/url-encoding-cheatsheet/ https://devtoolsonline.dev/blog/url-encoding-cheatsheet/ Sat, 09 May 2026 00:00:00 GMT URL encoding looks like one rule until you realize space is %20 in paths and + in query strings, and there are four different JavaScript functions and they all do slightly different things. noreply@devtoolsonline.dev (DevTools Online Team) Encoding Web Reference https://devtoolsonline.dev/blog/totp-2fa-explained/ https://devtoolsonline.dev/blog/totp-2fa-explained/ Sat, 09 May 2026 00:00:00 GMT TOTP looks like magic, six digits that match between your phone and the server, refreshing every 30 seconds. The actual algorithm fits in 20 lines of code, and the failure modes are surprisingly mundane. noreply@devtoolsonline.dev (DevTools Online Team) Security Crypto Tutorial https://devtoolsonline.dev/blog/ssl-certificate-chains-debugging/ https://devtoolsonline.dev/blog/ssl-certificate-chains-debugging/ Sat, 09 May 2026 00:00:00 GMT Browsers fix incomplete certificate chains for you. curl, Java, Python, and most server-to-server tools don't. Half the 'TLS works in browser but fails everywhere else' bugs trace back to a missing intermediate cert. noreply@devtoolsonline.dev (DevTools Online Team) TLS Networking Problem-solving https://devtoolsonline.dev/blog/sql-formatting-readable-queries/ https://devtoolsonline.dev/blog/sql-formatting-readable-queries/ Sat, 09 May 2026 00:00:00 GMT Most SQL is unreadable because nobody formats it. Run it through a formatter once, agree on a style, and your team's queries become reviewable code instead of write-only blobs. noreply@devtoolsonline.dev (DevTools Online Team) SQL Formatting Tutorial https://devtoolsonline.dev/blog/secure-password-entropy/ https://devtoolsonline.dev/blog/secure-password-entropy/ Sat, 09 May 2026 00:00:00 GMT Your password isn't secure because it's long. It's secure because it's unguessable. The math that connects 'unguessable' to 'how many characters' is simpler than you'd think. noreply@devtoolsonline.dev (DevTools Online Team) Security Reference https://devtoolsonline.dev/blog/regex-2026-when-to-use/ https://devtoolsonline.dev/blog/regex-2026-when-to-use/ Sat, 09 May 2026 00:00:00 GMT If you've ever spent two days debugging a regex that 'worked on the test cases,' this post is for you. Regex has a sweet spot. Outside it, every problem is harder than the regex you're tempted to write. noreply@devtoolsonline.dev (DevTools Online Team) Regex Programming Comparison https://devtoolsonline.dev/blog/qr-codes-for-developers/ https://devtoolsonline.dev/blog/qr-codes-for-developers/ Sat, 09 May 2026 00:00:00 GMT QR codes are everywhere, and most teams generate them with no thought. The defaults are usually fine. The 5% of cases where you need to think, printed labels, branded codes, dynamic redirects, is where this post earns its keep. noreply@devtoolsonline.dev (DevTools Online Team) QR Codes Generators Reference https://devtoolsonline.dev/blog/prettier-vs-eslint/ https://devtoolsonline.dev/blog/prettier-vs-eslint/ Sat, 09 May 2026 00:00:00 GMT Prettier and ESLint do different jobs. Half the JavaScript ecosystem treats them as alternatives. The other half configures both badly and they fight. Here's how to wire them up so they don't. noreply@devtoolsonline.dev (DevTools Online Team) Tooling Formatting Comparison https://devtoolsonline.dev/blog/mermaid-diagrams-docs/ https://devtoolsonline.dev/blog/mermaid-diagrams-docs/ Sat, 09 May 2026 00:00:00 GMT ASCII art belongs in 1995. Mermaid diagrams are real diagrams, written as text, rendered automatically by GitHub, GitLab, Notion, and every modern docs platform. Here's the practical guide. noreply@devtoolsonline.dev (DevTools Online Team) Documentation Tools Tutorial https://devtoolsonline.dev/blog/md5-sha256-bcrypt-which-hash/ https://devtoolsonline.dev/blog/md5-sha256-bcrypt-which-hash/ Sat, 09 May 2026 00:00:00 GMT MD5 still has uses in 2026. Hashing passwords isn't one of them. Pick the algorithm based on what you're protecting against, collisions, brute force, or just integrity. noreply@devtoolsonline.dev (DevTools Online Team) Security Crypto Comparison https://devtoolsonline.dev/blog/jwt-decoded-debugging/ https://devtoolsonline.dev/blog/jwt-decoded-debugging/ Sat, 09 May 2026 00:00:00 GMT A JWT is three Base64URL strings separated by dots. The first two are JSON. The third is a signature. About half the JWT bugs in production come from people forgetting that last detail. noreply@devtoolsonline.dev (DevTools Online Team) Encoding Security Problem-solving https://devtoolsonline.dev/blog/json-validation-2026/ https://devtoolsonline.dev/blog/json-validation-2026/ Sat, 09 May 2026 00:00:00 GMT Compile-time TypeScript types catch the typos. Runtime validators catch what the API actually sent. The trick is knowing which validator to reach for, and when validation belongs at the boundary. noreply@devtoolsonline.dev (DevTools Online Team) JSON Validation Tutorial https://devtoolsonline.dev/blog/json-to-typescript-interfaces/ https://devtoolsonline.dev/blog/json-to-typescript-interfaces/ Sat, 09 May 2026 00:00:00 GMT Hand-typing TypeScript interfaces from a 4KB API payload is the work of a punished engineer. There are three good ways to skip that, pick the one that fits your trust level for the upstream API. noreply@devtoolsonline.dev (DevTools Online Team) JSON TypeScript Tutorial https://devtoolsonline.dev/blog/json-bom-byte-order-mark/ https://devtoolsonline.dev/blog/json-bom-byte-order-mark/ Sat, 09 May 2026 00:00:00 GMT Your JSON parser fails at character 0 and the error message tells you nothing. Nine times out of ten, it's a UTF-8 BOM that some Windows tool added when you weren't looking. noreply@devtoolsonline.dev (DevTools Online Team) JSON Encoding Problem-solving https://devtoolsonline.dev/blog/http-status-codes-2026/ https://devtoolsonline.dev/blog/http-status-codes-2026/ Sat, 09 May 2026 00:00:00 GMT There are 60+ HTTP status codes. About 25 matter. About 10 are the difference between a clear API and a confusing one. Here's the practical map. noreply@devtoolsonline.dev (DevTools Online Team) HTTP Web Reference https://devtoolsonline.dev/blog/html-entity-encoding-xss/ https://devtoolsonline.dev/blog/html-entity-encoding-xss/ Sat, 09 May 2026 00:00:00 GMT Modern frameworks escape HTML for you in JSX, templates, and components. They don't escape it in URL attributes, inline styles, or anything you build with innerHTML. That's where XSS lives. noreply@devtoolsonline.dev (DevTools Online Team) Encoding Security Tutorial https://devtoolsonline.dev/blog/favicon-2026-modern-setup/ https://devtoolsonline.dev/blog/favicon-2026-modern-setup/ Sat, 09 May 2026 00:00:00 GMT A single 16x16 ICO file used to be enough. Now you need PNG, SVG, multiple sizes, manifest entries, and a dark-mode variant. The good news: it's still ten lines of HTML. noreply@devtoolsonline.dev (DevTools Online Team) Web Generators Tutorial https://devtoolsonline.dev/blog/erd-from-sql-workflow/ https://devtoolsonline.dev/blog/erd-from-sql-workflow/ Sat, 09 May 2026 00:00:00 GMT Database design used to start with a hand-drawn ER diagram. In 2026, most teams write SQL first and generate the diagram. Both approaches work. Knowing when to use which is the trick. noreply@devtoolsonline.dev (DevTools Online Team) SQL Documentation Tutorial https://devtoolsonline.dev/blog/dns-records-explained/ https://devtoolsonline.dev/blog/dns-records-explained/ Sat, 09 May 2026 00:00:00 GMT DNS isn't black magic. It's a public lookup table with a dozen record types, each answering a specific question. If you know which question each one answers, you can debug 90% of DNS issues. noreply@devtoolsonline.dev (DevTools Online Team) DNS Networking Reference https://devtoolsonline.dev/blog/csv-vs-json/ https://devtoolsonline.dev/blog/csv-vs-json/ Sat, 09 May 2026 00:00:00 GMT Engineers love JSON. Analysts ask for CSV. Both groups are right, for different reasons. Here's how to pick the format that won't waste anyone's afternoon. noreply@devtoolsonline.dev (DevTools Online Team) JSON CSV Comparison https://devtoolsonline.dev/blog/css-gradients-modern/ https://devtoolsonline.dev/blog/css-gradients-modern/ Sat, 09 May 2026 00:00:00 GMT linear-gradient() is the gradient most teams know about. CSS has three more gradient types and a new color-space system that produces dramatically smoother gradients. Most teams don't use them. noreply@devtoolsonline.dev (DevTools Online Team) CSS Color Tutorial https://devtoolsonline.dev/blog/cron-expressions-decoded/ https://devtoolsonline.dev/blog/cron-expressions-decoded/ Sat, 09 May 2026 00:00:00 GMT Cron is the scheduling syntax that survived 50 years because it's compact and ubiquitous. Once you know the five fields and three special characters, you can read any cron line at a glance. noreply@devtoolsonline.dev (DevTools Online Team) Scheduling Reference https://devtoolsonline.dev/blog/cidr-notation-explained/ https://devtoolsonline.dev/blog/cidr-notation-explained/ Sat, 09 May 2026 00:00:00 GMT CIDR is just IP address ranges in shorthand. /24 means 256 addresses, /16 means 65,536, and the math for everything in between is the same boring power of two. noreply@devtoolsonline.dev (DevTools Online Team) Networking Reference https://devtoolsonline.dev/blog/bcrypt-vs-argon2/ https://devtoolsonline.dev/blog/bcrypt-vs-argon2/ Sat, 09 May 2026 00:00:00 GMT Both algorithms are good. The choice in 2026 is less about cryptographic merit and more about library maturity, parameter tuning, and whether you're willing to migrate an existing user base. noreply@devtoolsonline.dev (DevTools Online Team) Security Crypto Comparison https://devtoolsonline.dev/blog/base64-demystified/ https://devtoolsonline.dev/blog/base64-demystified/ Sat, 09 May 2026 00:00:00 GMT Stop using Base64 to 'hide' your API keys. It's not encryption. It's not compression. It's a 33% size penalty in exchange for ASCII safety, and that's all it'll ever be. noreply@devtoolsonline.dev (DevTools Online Team) Encoding Reference https://devtoolsonline.dev/blog/aes-encryption-explained/ https://devtoolsonline.dev/blog/aes-encryption-explained/ Sat, 09 May 2026 00:00:00 GMT AES is the symmetric encryption standard. AES-256-GCM is what you should reach for. The math is hard, the usage is short, half a dozen rules and you'll avoid the classic mistakes. noreply@devtoolsonline.dev (DevTools Online Team) Security Crypto Tutorial https://devtoolsonline.dev/blog/json-formatting-2026/ https://devtoolsonline.dev/blog/json-formatting-2026/ Fri, 08 May 2026 00:00:00 GMT Three ways to format JSON in 2026: online formatters, IDE plugins, and CLI tools. Each has trade-offs around privacy, speed, and integration. Here's when to use which. noreply@devtoolsonline.dev (DevTools Online Team) JSON Tools Tutorial