4 min read
How Long It Actually Takes to Crack a Password
The answer depends far more on which hashing algorithm protects the password than on how many symbols it contains. Here is the actual math, worked through for both.
Blog
Working notes on search, performance and developer tooling — written when something turned out to be more interesting than expected.
4 min read
JSON vs JavaScript Objects: Where the Differences Actually Bite
JSON looks like a JavaScript object literal, so people assume they behave identically. Undefined, dates, key order and duplicate keys all say otherwise.
4 min read
Are QR Codes Safe? What "Quishing" Actually Looks Like
A QR code is just a wrapper around a URL, with no way to preview the destination before you scan. That single gap is the entire attack, and it has a name now.
4 min read
When to Base64-Encode an Image (and When Not To)
Data URIs let you embed an image directly in HTML or CSS as Base64 text. It works, it's overused, and it makes some pages slower rather than faster.
2 min read
Base64 Is Not Encryption
Base64 is an encoding, not a cipher. It has no key, protects nothing, and is trivially reversible — here is what it is actually for.
4 min read
Can Two UUIDs Ever Collide? The Actual Math
UUIDs are said to be unique enough to ignore the possibility of a collision entirely. Here is the birthday-paradox math behind that claim, worked out in full.
4 min read
Why Forced Password Complexity Rules Make Passwords Weaker
Requiring a capital letter, a digit and a special character feels like it should help. NIST dropped the recommendation years ago, because in practice it mostly doesn't.
4 min read
How to Make a QR Code for Your WiFi Password
Scanning a QR code to join WiFi works because of a plain-text string format your phone's camera already understands. Here is exactly what's inside it.
4 min read
UUID vs GUID vs Nanoid vs Auto-Increment: Picking an ID Strategy
Four common ways to identify a row, and the trade-offs that actually distinguish them — size, coordination, what they leak, and whether anyone else uses the same format.
2 min read
Why Google Rewrites Your Meta Description (And When It Does Not)
Google replaces meta descriptions on roughly two thirds of queries. Here is when it happens, why, and the cases where your description still decides the click.
4 min read
Your JSON Is Valid and Still Wrong: Syntax vs Schema Validation
A JSON document can parse perfectly and still have the wrong shape entirely. Here is the difference between syntax validation and schema validation, and when you need both.
4 min read
What the Equals Signs at the End of Base64 Actually Mean
Base64 strings sometimes end in one or two equals signs and sometimes end in none at all. Here is the bit-level reason why, and when it's safe to drop them.
2 min read
UUID v7 vs v4 as a Database Primary Key
Random v4 UUIDs scatter writes across your index and cause page splits. Version 7 sorts by time and fixes it, without giving up global uniqueness.
2 min read
How to Compress Images Without Uploading Them Anywhere
Modern browsers can decode, resize and re-encode images locally using Canvas. Here is how it works, what quality setting to pick, and where the approach breaks down.