Developer tool guides

A working reference for JSON's grammar, how to read a parser's error offset, where numbers and strings quietly lose information, and why valid JSON still gets rejected.

How the three configuration formats differ in data model, comments and typing, which YAML scalars change type without warning, and what a conversion silently drops.

Flattening strategies for nested JSON, the header and sparsity problems they create, RFC 4180 quoting rules, CSV formula injection, and the cases where a table is simply the wrong shape.

A worked reference for JSONPath selectors, slices and filter expressions, what RFC 9535 standardised in 2024, where popular libraries still differ, and when to reach for jq or JSON Pointer instead.

The difference between well-formedness and schema validity, the five escapes that actually matter, how namespaces break XPath, why pretty-printing can change meaning, and how to shut off XXE.

How Java's map, collection, record and Lombok toString formats are built, why they are not JSON, a procedure for converting them back, and the ambiguities that no parser can resolve.

What Base64 is actually for, how the three-byte to four-character transform works, how Base64URL and padding differ, why UTF-8 comes first, and why Base64 hides nothing.

A repeatable workflow for regex: build a corpus of near-misses, read the match boundaries, understand what each flag changes, and recognise the patterns that will hang under load.

Which characters a URL reserves, why the rule changes per component, the difference between encodeURI and encodeURIComponent, when a plus means a space, and how internationalised domains are actually encoded.

Why escaping depends on where a value lands, the rules for text, attributes, URLs, JavaScript and CSS, how named and numeric entities differ, and why context-correct output encoding — not filtering — is the defence against XSS.

Choosing character, word or line granularity, removing whitespace and line-ending noise, reading a unified diff hunk header, spotting moved blocks, and reviewing generated output without rubber-stamping it.

Why Markdown renders differently everywhere, what CommonMark pinned down, what GitHub Flavored Markdown adds, how raw HTML is sanitised, and how to write documents that look the same in every destination.

What the three segments of a JWT contain, why decoding proves nothing, how the registered claims are meant to be enforced, and how algorithm confusion is prevented.

How the 128 bits of a UUID are laid out, what each version trades away, why random primary keys hurt database indexes, and what a UUID can leak about when and where it was made.

The entropy arithmetic behind password strength, why length beats character-class rules, why Math.random disqualifies a generator, and why forced rotation makes passwords worse.

What a hash function guarantees and what it does not, how to verify a download and what that verification is worth, why MD5 and SHA-1 were retired, and why password storage needs a deliberately slow algorithm.

What each field of an X.509 certificate means, how a chain is built and why it breaks, what PEM, DER, PFX and P7B actually contain, and how to read the browser errors that follow.

The exact bytes Basic authentication puts on the wire, why it is useless without TLS, what each htpasswd hashing algorithm is worth, how to pick a bcrypt cost, and where Basic auth is the right answer.

Field order in Unix and Quartz cron, what step and range syntax really mean, the day-of-month plus day-of-week OR rule, daylight-saving behaviour, and how to preview a schedule before you deploy it.

Epoch seconds versus milliseconds, UTC versus local time, ISO 8601 versus RFC 3339, why an offset is not a time zone, how to store an instant so it survives, and what leap seconds and 2038 actually change.

Positional notation, why hexadecimal won, the RFC 4648 byte encodings and how they differ from numeric bases, Base58, two's complement for signed values, and where each base actually turns up.

Reading a query by clause structure rather than line order, dialect-sensitive identifiers and case folding, a layout that survives code review, and the class of bugs formatting exposes — plus the performance questions it cannot answer.

How DEFLATE works, the difference between the gzip and zlib containers, Content-Encoding versus Transfer-Encoding, how gzip compares with brotli and zstd on real data, and the cases where compressing is worse than not compressing.

What an IP lookup can and cannot prove, how IPv4 and IPv6 results differ on the same machine, how to read WebRTC and DNS resolver signals in a browser, and how to use IP data responsibly.

How to check a site along the whole request path — DNS, TCP, TLS, HTTP — tell a timeout apart from a 5xx, read a redirect chain, compare regions, and turn a one-off check into a usable incident signal.

A diagnostic workflow for proxy testing: verify one endpoint before a batch, identify which stage failed, read the response correctly, compare regional exits, and handle credentials responsibly.

The real mechanics behind a browser-to-browser data channel: signalling, the SDP offer and answer, ICE candidate gathering, STUN and TURN, NAT behaviour, DTLS encryption, and when a relay becomes unavoidable.

How QR codes are structured, how versions and encoding modes decide capacity, what error-correction levels really trade away, why a code fails to scan, and why scanning an unknown code is clicking an unknown link.

Millimetre sizes and the pixel arithmetic behind them, DPI explained properly, head-height ratios, background rules, file-size limits on upload forms, and an honest account of what no tool can guarantee.