Developer guides from the workbench.
Practical, no-fluff guides on JSON, regex, JWTs, DNS, SSL, and email authentication, the things developers debug every day, written alongside the free tools that fix them.
Trailing commas in JSON: why they break parsing and how to fix it
Why the JSON spec forbids trailing commas, the exact error you get, why JSON5 and JSONC allow them, and safe ways to strip them before parsing.
JSON Formatter & ValidatorJSON Unicode escapes: \uXXXX, surrogate pairs, and emoji
How the \uXXXX escape works in JSON, why it only reaches the BMP, how surrogate pairs encode emoji and astral characters, and when raw UTF-8 is fine.
JSON Formatter & ValidatorAbsolute vs relative URLs
The four URL forms (absolute, relative, protocol-relative, root-relative), how the browser resolves each against the base, and when to use them.
URL Encoder & ParserCommonMark vs GitHub Flavored Markdown
Learn how CommonMark defines a strict Markdown spec, which extensions GitHub Flavored Markdown adds, and why different renderers disagree on the same text.
Markdown PreviewerEscape sequences in JSON strings: the complete valid set
Every valid backslash escape in a JSON string, which characters you must escape, and the invalid-escape errors from treating JSON like a regex or shell.
JSON Formatter & ValidatorHow breach lookup works with k-anonymity
How a breach lookup checks your password against billions of leaked hashes without ever sending it, using a SHA-1 prefix and local suffix matching.
Password Strength AnalyzerThe JWT alg none attack
How the alg none and HS versus RS confusion attacks forge JWTs, why you must never trust the header algorithm, and how pinning the expected one stops it.
JWT DecoderJWT vs session cookies
Compare stateless JWT tokens with server side sessions backed by a cookie, including the revocation tradeoff and when each approach fits best.
JWT DecoderFlattening nested JSON into flat columns for CSV or Excel
How to turn nested objects and arrays in JSON into flat spreadsheet columns using dot-path keys, how to handle arrays, and the lossy tradeoffs you accept.
JSON ↔ CSV ConverterJWT claims explained
A clear guide to the registered JWT claims iss, sub, aud, exp, nbf, iat, and jti, what each means, and why validating aud, exp, and iss matters.
JWT DecoderPassphrases vs passwords
Why length beats complexity for password strength, how a random multi-word passphrase compares to a short messy password, and the correct horse principle.
Password Strength AnalyzerSQL NULL and three-valued logic
Learn why NULL means unknown in SQL, why = NULL never matches, how three-valued logic changes WHERE and AND/OR, and how COUNT and COALESCE handle nulls.
SQL FormattersRGB, P3, and color gamuts
Learn what a color gamut is, how sRGB, Display P3, and Rec. 2020 compare, and how to use CSS color(display-p3) with safe fallbacks.
Color Converter & Contrast CheckerURL fragments and the hash
The fragment after the hash is never sent to the server. Learn how it works client side, its role in SPAs and deep links, and how it differs from the query string.
URL Encoder & ParserYAML anchors and aliases
Learn how YAML anchors and aliases reuse blocks, how merge keys extend maps for DRY config, and why anchors create the billion laughs expansion risk.
YAML ↔ JSON ConverterHSL vs HSV color models
Compare HSL and HSV, two cylindrical color models, including why they differ at the extremes and when each one is the intuitive choice for a picker.
Color Converter & Contrast CheckerPrivate IP ranges and RFC 1918
Understand the RFC 1918 private IPv4 ranges, why they are not routable on the internet, how NAT bridges them, plus CGNAT 100.64/10 and 169.254 link-local.
IPv4 Subnet CalculatorQuery string arrays and repeated params
There is no single standard for arrays in query strings. Compare repeated keys, bracket notation, and commas, and how servers differ.
URL Encoder & ParserRGBA and alpha compositing
Understand the alpha channel, how source over blends a foreground over a background, and why premultiplied versus straight alpha changes faint overlays.
Color Converter & Contrast CheckerSQL common table expressions: WITH, readability, and recursion
What SQL common table expressions do, why WITH beats deeply nested subqueries for readability, how recursive CTEs work, and the materialization caveat to know.
SQL FormatterWhen to escape HTML: XSS basics
Why contextual output encoding stops XSS, why you escape on output rather than input, and how HTML, attribute, and JavaScript contexts each need different handling.
HTML Entity Encoder / DecoderAre UUIDs really unique
UUID uniqueness is probabilistic, not guaranteed. See the birthday bound math for v4 random UUIDs and why collisions stay negligible in practice.
UUID & Token GeneratorNamed vs numeric HTML entities
The difference between &, & and &, the five characters you must escape, when numeric entities are safer, and how charset affects your choice.
HTML Entity Encoder / DecoderSQL window functions: OVER, PARTITION BY, and running totals
How SQL window functions work with OVER, PARTITION BY, and ORDER BY, how ROW_NUMBER, RANK, and running totals behave, and why they differ from GROUP BY.
SQL FormatterSRV records explained
Learn the SRV record format, how priority and weight select a target, and where services like SIP, XMPP, Minecraft, and autodiscover rely on them.
DNS LookupULID vs UUID
Compare ULID, a 26 character time sortable identifier, with UUID, covering database index locality, the Crockford base32 alphabet, and tradeoffs.
UUID & Token GeneratorWhy you cannot reverse a hash
Hashes are one-way functions. Learn why cracking is guessing and hashing rather than reversing, and why fixed output size loses information.
Hash GeneratorBase64 padding and the equals sign
Learn why Base64 output ends in one or two equals signs, how padding maps to input length, and when base64url drops it entirely.
Base64 Encode / DecodeReferrer-Policy explained
Understand what the Referer header leaks, the Referrer-Policy values from no-referrer to the strict-origin-when-cross-origin default, and the privacy tradeoff.
HTTP Header CheckerSalting and peppering password hashes
How a unique salt defeats rainbow tables, what a pepper adds, and why plain SHA-256 is the wrong choice for storing passwords.
Hash GeneratorSQL injection and parameterized queries: the root cause and the fix
How SQL injection actually works, why string concatenation is the root cause, and why parameterized queries and prepared statements are the real fix.
SQL FormatterUUID v1 vs v4
Compare UUID version 1 timestamp and MAC based IDs with version 4 random IDs, what each leaks, and which version to choose today.
UUID & Token GeneratorWhy hex is used for colors and memory
One hex digit is exactly four bits, so a byte is always two hex digits. That clean fit is why addresses, colors, and bytes all read naturally in hexadecimal.
Number Base ConverterBitwise operations explained
A practical guide to AND, OR, XOR, NOT and bit shifts, with real uses like permission flags, masking, and fast multiply or divide by powers of two.
Number Base ConverterCORS preflight requests explained
Learn when the browser sends an OPTIONS preflight, what makes a request non-simple, and how Access-Control headers and Max-Age caching control cross-origin calls.
HTTP Header CheckerHow Base64 encoding works
The three bytes to four characters math behind Base64, the 64 character alphabet, why output grows about a third, and why it is not encryption.
Base64 Encode / DecodeUnicode property escapes in regex
How \p{L} and \p{N} with the u flag match letters and numbers in any language, why \w is ASCII only, and how to match emoji correctly.
Regex TesterWhat is a hash collision
Why hash collisions must exist by the pigeonhole principle, and the difference between accidental collisions and deliberately crafted ones.
Hash GeneratorYAML multiline strings: literal, folded, and chomping indicators
How YAML block scalars work: literal | versus folded >, the chomping indicators - and +, and how to choose the right one for config, scripts, and prose.
YAML ↔ JSON ConverterRegex backreferences explained
How \1 and \k<name> backreferences match repeated or paired text, with examples and the performance caveat worth knowing.
Regex TesterRegex flags explained: g, i, m, s, u, y
What each regex flag does, from global and ignore case to dotall, unicode, and sticky, plus the combinations you reach for most.
Regex TesterTOTP vs HOTP: how one-time codes work
Compare counter-based HOTP and time-based TOTP from RFC 4226 and 6238, why authenticator apps use TOTP, and how the 30-second window and clock drift are handled.
TOTP Code GeneratorTwo's complement explained
How computers store negative integers with two's complement, the invert-and-add-one rule, why there is one extra negative, and how overflow wraps around.
Number Base ConverterUser-Agent reduction explained
Why browsers froze and trimmed the User-Agent string, what detail is now coarse, and how that affects analytics and feature detection.
User-Agent ParserXML namespaces: what xmlns does and why identical tags can differ
What xmlns does, the difference between prefixed and default namespaces, why two identical-looking tags can be different elements, and common parsing traps.
XML FormatterClient Hints vs the user-agent string
How User-Agent Client Hints replace parsing the UA string, with their opt-in model and the split between low and high entropy hints.
User-Agent ParserLeap seconds explained
Why leap seconds exist, why Unix time quietly ignores them, how clock smearing avoids the discontinuity, and the plan to retire leap seconds by 2035.
Timestamp ConverterNamed capture groups in regex
Learn how (?<name>...) groups compare to numbered groups, how to reference them in replacements and code, and why they improve readability.
Regex TesterRegex anchors and multiline mode
Learn how ^ and $ anchor positions, how \b matches word boundaries, and how the m flag changes anchors to match per line.
Regex Testerumask explained: how default permissions are set
Understand how umask subtracts from the 666 and 777 defaults to decide new file and directory permissions, how to read 022 versus 077, and where to set it.
Chmod CalculatorXML vs HTML: well-formedness, void elements, and why parsers differ
The real differences between XML and HTML: well-formedness, void elements, case sensitivity, self-closing tags, and why HTML parsers are lenient but XML strict.
XML FormatterCommon cron mistakes
The cron scheduling errors that bite most often, from the day-of-month and day-of-week trap to timezone assumptions and overlapping jobs.
Cron GeneratorDuplicate keys in JSON: what actually happens
The JSON spec allows duplicate object keys. Learn how parsers handle them, the last wins rule, and the security and data loss risks.
JSON Formatter & ValidatorPretty print vs minify JSON: when to use each
Learn when to beautify JSON for debugging and diffs, when to minify for wire size, and why formatting never changes the data.
JSON Formatter & ValidatorRegex character classes explained
How square-bracket character classes work: ranges, negation with a caret, which metacharacters lose meaning inside, and shorthand versus POSIX classes.
Regex Testersetuid, setgid, and the sticky bit explained
Learn what the fourth Unix permission digit does: setuid and setgid run-as semantics, the sticky bit on shared directories, and how they show in ls.
Chmod CalculatorThe year 2038 problem
Why signed 32-bit Unix time overflows in January 2038, how 64-bit time_t fixes it, and where legacy 32-bit systems can still bite you today.
Timestamp ConverterCron special characters explained
Learn what the star, step, range, and list characters mean in a cron expression, with worked examples for each of the five fields.
Cron GeneratorJSON5 vs JSON: what it adds and when to use it
Learn what JSON5 adds over strict JSON, including comments, trailing commas, and unquoted keys, and when it is safe to use.
JSON Formatter & ValidatorMilliseconds vs seconds in Unix timestamps
Why Unix time comes in seconds and JavaScript Date.now() in milliseconds, how to spot the difference by digit count, and how to avoid the x1000 bug.
Timestamp ConverterNDJSON and JSON Lines explained
Learn why newline delimited JSON beats one giant array for logs and streaming, and how to read and process it safely.
JSON Formatter & ValidatorRegex non-capturing groups explained
When to use non-capturing groups with a question mark colon instead of plain parentheses, how they affect backreference numbering, and a note on atomic groups.
Regex TesterRegex word boundaries explained
What the word boundary anchors match, how a word character is defined, why boundaries break on accented and Unicode text, and practical ways to fix it.
Regex TesterWhy there is no single correct phone number regex
Phone number formats vary by country, so no one regex validates them all. Learn the E.164 standard, pragmatic validation, normalization, and when to stop.
Regex TesterRegex substitution with capture groups
How replacement strings reference capture groups with dollar-one or backslash-one, named group replacement, reordering fields, and escaping a literal dollar sign.
Regex TesterWhen to use encodeURIComponent instead of encodeURI
The difference between encodeURI and encodeURIComponent, exactly which characters each leaves untouched, when to use which, and the classic double-encoding bug.
URL Encoder & ParserQuery string encoding gotchas
Space as plus versus percent twenty, the literal plus sign bug, encoding ampersand and equals in values, and how repeated keys become arrays on the server.
URL Encoder & ParserHashing files versus hashing text
Why a hash is computed over bytes, how text encoding and line-ending normalization change the result, and how to verify a downloaded file against a checksum.
Hash GeneratorChecksums versus cryptographic hashes
Why CRC32 and Adler-32 detect accidental corruption but cannot resist tampering, how SHA-256 differs, and why you cannot substitute one class for the other.
Hash GeneratorArgon2, bcrypt and scrypt compared for password hashing
A practical comparison of modern password hashing algorithms: memory-hardness, tuning parameters, resistance to GPU and ASIC attacks, and which to pick in 2026.
Password Strength AnalyzerNamed CSS colors explained: the keyword list, gray vs grey, and rebeccapurple
A tour of the CSS named colors: the keyword list, the gray and grey aliases, the story behind rebeccapurple, plus transparent and currentColor.
Color Converter & Contrast Checker8-digit hex colors with alpha: how #RRGGBBAA and #RGBA shorthand work
How 8-digit #RRGGBBAA and 4-digit #RGBA hex colors encode transparency, how the alpha byte maps to 0 to 1, browser support, and converting to rgba.
Color Converter & Contrast CheckerBuilding an accessible color palette that passes WCAG contrast
Practical steps to a color palette that passes WCAG contrast: choosing base hues, generating tints and shades, and testing every text pairing.
Color Converter & Contrast CheckerThe CSS steps() easing function explained: jump-start, jump-end, and sprite animation
How the CSS steps() timing function works: the jump-start and jump-end directions, sprite-sheet animation, and when to prefer it over cubic-bezier.
Cubic Bezier GeneratorCSS gradient color stops explained: positions, hard stops, and color hints
How CSS gradient color stops and positions work, how to make hard-edged stripes, how color hints move the midpoint, and how repeating gradients behave.
CSS Gradient GeneratorCron every N minutes: step values, ranges, and why */7 misbehaves
How cron step values like */5 work for every N minutes, why */7 drifts at the top of each hour, ranges with steps, and the common every-N mistakes.
Cron GeneratorWhat is a cron job? The five fields and where cron actually runs
What a cron job is, how the five time fields work, where cron runs across crontab, systemd timers, and cloud schedulers, and what happens when the machine is off.
Cron GeneratorISO 8601 vs Unix time: which timestamp format to store
Storing timestamps as ISO 8601 strings or Unix epoch integers: the tradeoffs in readability, arithmetic, timezone information, and which one to choose.
Timestamp ConverterHandling time zones in code: store UTC, convert at the edges
A practical rule for time zones in code: store UTC, convert at the edges, avoid the just-add-hours trap, and understand offsets versus named zones and DST.
Timestamp ConverterThe bcrypt work factor explained: cost, timing, and the 72-byte truncation
How the bcrypt cost factor maps to hashing time, how to choose a work factor in 2026, and the 72-byte password truncation gotcha that silently weakens hashes.
Password Strength AnalyzerHow anycast DNS works: one IP, many locations
How anycast announces a single IP from many sites over BGP, how routing finds the nearest node, and why it makes DNS both fast and DDoS resistant.
DNS LookupReading dig and nslookup output without guessing
A field guide to dig output: the ANSWER, AUTHORITY and ADDITIONAL sections, the TTL column, the header flags, and how to read nslookup results too.
DNS LookupWhat is a DNS glue record and when you need one
Glue records break the circular dependency when a nameserver lives inside its own zone. Here is why they exist, when they are required, and how to check them.
DNS LookupXXE and XML parser hardening: turning off the features you never wanted
External entities let an XML document read local files and make requests from your server. How XXE works, the settings that disable it, where XML hides.
XML FormatterQR codes that actually scan: error correction, capacity and print size
What the four error correction levels really buy you, how encoding mode changes the size, the quiet zone rule, and how big to print a code for a given scan distance.
QR Code GeneratorSubnetting cheat sheet: prefix, mask, and host counts
A prefix to mask to host count table for IPv4, how to count usable hosts, find the network and broadcast addresses, and do quick subnetting mental math.
IPv4 Subnet CalculatorCSV formula injection: when your export becomes code in someone's spreadsheet
A cell starting with = is executed when the file opens in Excel or Sheets. How the attack works, why quoting does not help, and the escaping that does.
JSON ↔ CSV ConverterVariable length subnet masks (VLSM) done right
VLSM lets you carve one block into right sized subnets. Learn the largest first rule, how to allocate without overlap, and how to avoid wasting addresses.
IPv4 Subnet CalculatorContent negotiation and the Accept headers
How Accept, Accept-Language, and Accept-Encoding let a client state its preferences, how q-values rank them, how the server picks, and why Vary matters.
HTTP Header CheckerPunycode and homograph domains: when apple.com is not apple.com
How internationalised domain names become xn-- labels, how lookalike domains exploit that, what browsers do, and how to find impersonations of yours.
Domain Registration LookupCron, timezones and daylight saving: the jobs that run twice or not at all
Why a 02:30 job vanishes in spring and runs twice in autumn, how cron, systemd timers and Kubernetes differ, and the scheduling rules that avoid all of it.
Cron Generatorgzip vs brotli vs zstd for HTTP compression
How Content-Encoding gzip, brotli, and zstd compare on ratio and CPU, when brotli is worth it, and why static and dynamic responses need different settings.
HTTP Header CheckerPlanning a DNS cutover: TTL strategy that avoids a split brain
A timeline for lowering TTLs before a server move, the caches that ignore them, negative caching traps, and why nameserver changes are slower still.
DNS LookupHTTP range requests explained
How Range and Accept-Ranges enable 206 Partial Content, resumable downloads, and media seeking, plus how multipart ranges and the 416 error work.
HTTP Header CheckerCertificate pinning explained, and why HPKP died
What certificate and public key pinning do, why browser HPKP was deprecated, how mobile apps still pin, and the bricking risk that makes pinning dangerous.
SSL CheckerIdempotency keys: retrying an API call without charging the customer twice
A timeout does not mean the request failed. How idempotency keys work, how to store and scope them, and the concurrency cases most implementations get wrong.
API TesterETags and conditional requests: 304s, revalidation and lost update protection
How ETag, If-None-Match and If-Match work, strong versus weak validators, why gzip breaks them, and using If-Match to stop concurrent writes overwriting each other.
HTTP Header CheckerOCSP stapling explained, and how to verify it
How OCSP checks certificate revocation, why stapling fixes its privacy and latency problems, what must-staple adds, and how to confirm stapling is on.
OCSP CheckerBytes, code points and graphemes: why string length lies
One emoji can be 1 character, 4 code points, 7 UTF-16 units and 25 bytes at the same time. Which count you need, and the bugs you get from picking wrong.
Text Statistics & Word CounterThe SPF 10 DNS lookup limit, nested includes, and why flattening is risky
How the SPF 10 DNS lookup limit works, why nested includes overflow it into a PermError, and why SPF flattening trades one problem for another.
SPF Record GeneratorDKIM key rotation explained, with zero downtime using multiple selectors
Why DKIM keys should be rotated, how to use multiple selectors for zero downtime rotation, and how to choose a key length that receivers accept.
DKIM Record GeneratorWhy large IDs break in JSON: numbers, precision and the 53 bit limit
JSON has no integer type. Here is why 64 bit IDs silently change value when they cross a JavaScript parser, and the four fixes that actually work.
JSON Formatter & ValidatorRolling out a DMARC policy safely, from p=none to reject
The safe path to enforce DMARC: start at p=none, read aggregate reports, ramp with pct, move to quarantine, then reject, without blocking real mail.
DMARC Record GeneratorUUIDs as primary keys: index fragmentation, storage, and why UUIDv7 helps
Why random UUIDv4 primary keys fragment B-tree indexes and inflate storage, and how UUIDv7 or ULID restore insert locality without losing uniqueness.
UUID & Token GeneratorBase32 vs Base64: alphabets, padding, and why TOTP secrets use base32
How base32 and base64 differ in alphabet, padding, and size overhead, and why TOTP secrets, DNS, and human-facing identifiers prefer base32.
Base64 Encode / DecodeDNS-01 vs HTTP-01: choosing an ACME challenge type
How the three ACME validation methods prove domain control, which one to use for wildcards and internal hosts, and the failures each one produces.
DNS LookupECDSA vs RSA certificates: which key type to use, and why
How elliptic curve and RSA certificates compare on security, handshake speed and client support, plus when serving both key types is worth the complexity.
SSL & CSR DecoderHSTS and the preload list: how to enable it without locking yourself out
What Strict-Transport-Security actually does, why the preload list is close to irreversible, and a safe rollout order that avoids taking subdomains offline.
HTTP Header CheckerJSON Schema: validating structure instead of trusting it
The keywords that matter, how drafts differ, why format does not validate by default, and the composition mistake that makes additionalProperties useless.
JSON Formatter & ValidatorHS256 vs RS256: choosing a JWT signing algorithm
The difference between symmetric and asymmetric JWT signing, when each is appropriate, and the algorithm confusion attack that defeats a careless verifier.
JWT DecoderReDoS and catastrophic backtracking: when a regex hangs your server
Why some regular expressions take exponential time on short input, how to recognise the dangerous patterns, and the fixes that actually work in JavaScript.
Regex TesterTLS cipher suites explained: reading the names and picking a set
How to read a cipher suite name, what changed in TLS 1.3, which suites to disable and why, and how to verify what your server actually negotiates.
SSL CheckerYAML gotchas: the Norway problem and other silent type coercions
Why NO becomes false, 1.10 becomes 1.1 and 08 throws an error, which YAML versions cause it, and how to stop parsers rewriting your config values.
YAML ↔ JSON ConverterHow TOTP setup works: the otpauth URI, the shared secret, and QR codes
A clear walkthrough of TOTP enrollment: the otpauth URI, the shared secret, how the QR code provisions an authenticator, and the period and digits parameters.
TOTP Code GeneratorMarkdown tables and formatting: alignment, escaping pipes, and GFM gotchas
How to write Markdown tables, align columns with colons, escape pipes inside cells, and avoid the rendering gotchas where GFM extends CommonMark.
Markdown PreviewerYAML vs JSON for configuration: comments, anchors, and the Norway problem
Comparing YAML and JSON for config files: comments, anchors, readability, and the type ambiguity costs like the Norway problem that make YAML risky.
YAML ↔ JSON ConverterSQL formatting conventions: keyword case, commas, and team style guides
Practical SQL formatting: keyword case, leading vs trailing commas, indentation, join alignment, and why an agreed team style beats individual taste.
SQL FormatterRegex inline flags and scoped modifiers across engines
How regex inline flags like (?i) and scoped modifier groups (?i:...) work, which engines support them, and where JavaScript and others differ.
Regex TesterARC: why forwarded mail fails SPF and DKIM
Forwarding rewrites the path and mailing lists rewrite the message, so authentication that passed at the origin fails at the destination.
Email Header AnalyzerThe bulk sender rules for Gmail and Yahoo, and how to meet them
Sending over 5,000 messages a day to Gmail means authentication, one-click unsubscribe and a spam rate under 0.3 percent.
Email Health (SPF, DKIM, DMARC)Why you cannot put a CNAME at your apex domain
Why a CNAME at your apex domain is illegal, what breaks when you force it, and how ALIAS, ANAME and CNAME flattening solve it.
DNS LookupThe 255 character limit that breaks long DKIM records
Why a 2048 bit DKIM key will not fit one DNS string, how records get split, and the concatenation mistake that silently breaks the key.
DNS LookupHow Let's Encrypt actually issues a certificate
The ACME protocol behind automated certificates: orders, challenges, key authorizations, CAA checks and rate limits.
Alt DCV CheckerHTTP 429: reading rate limit headers and backing off properly
A 429 is an instruction, not an error. How to read Retry-After and the rate limit headers, and why backoff needs jitter to actually work.
API TesterMTA-STS and TLS-RPT: enforcing TLS on inbound mail
STARTTLS can be stripped by anyone in the path. MTA-STS tells sending servers to require TLS for your domain, and TLS-RPT tells you when it fails.
DNS LookupSNI: how one IP address serves hundreds of certificates
TLS must send a certificate before HTTP says which site was wanted. How SNI solves that, and why you sometimes get the wrong certificate.
SSL CheckerWhat MCP is, and why an AI agent needs real network tools
The Model Context Protocol lets an AI assistant call real tools instead of guessing. How it works, and why network diagnostics are the sharp case.
DNS LookupCSV encoding: why Excel mangles your accents and how to fix it
Why Excel shows é instead of é in a UTF-8 CSV, what the byte order mark does, how delimiters change by locale.
JSON ↔ CSV ConverterNano ID vs UUID: choosing an identifier format
How Nano ID and UUID compare on collision risk, length, sortability, and URL friendliness, plus when a shorter ID is safe and when it quietly is not.
UUID & Token GeneratorGreedy vs lazy quantifiers: why your regex matches too much
Why .* swallows the whole line, how lazy quantifiers differ, when a negated character class beats both, and how backtracking causes catastrophic slowdowns.
Regex TesterTime zones and UTC offsets: why storing +05:00 is not enough
The difference between an offset and a time zone, why UTC is not GMT, how DST breaks stored times, and the rules for storing and displaying time correctly.
Timestamp ConverterOAuth 2.0 vs OpenID Connect: authorization is not authentication
Why OAuth 2.0 alone cannot log a user in, what OpenID Connect adds, the difference between an access token and an ID token, and which flow to use today.
JWT DecoderSMTP error codes explained: reading a bounce message
How to read SMTP reply codes and enhanced status codes, what 550 5.7.1 and 421 4.7.0 actually mean, and the difference between a hard and a soft bounce.
Email Health (SPF, DKIM, DMARC)SMTP ports explained: 25, 465, 587, and which one you should use
What each SMTP port is for, the difference between implicit and explicit TLS, why port 25 is blocked on most networks.
MX LookupWebhooks vs polling: choosing how services tell each other things
The real tradeoffs between webhooks and polling, why webhooks need retries and idempotency, when polling is the better engineering decision.
Webhook InspectorCAA records explained: telling CAs who may issue for your domain
What a CAA record does, the exact syntax of issue, issuewild, and iodef tags, how CAs check the tree.
DNS LookupDNSSEC explained: what it signs, what it does not, and how to enable it
How DNSSEC signs DNS answers, what DS, DNSKEY, RRSIG, and NSEC records do, what it does not protect, and the one mistake that takes your domain offline.
DNS LookupMutual TLS explained: when both sides present a certificate
How mTLS differs from ordinary TLS, what the client certificate actually proves, how to issue and verify one.
SSL CheckerServer sent events vs WebSockets: which one do you actually need
How server sent events compare to WebSockets on direction, reconnection, proxies, and cost, plus the event stream format and when polling still wins.
API TesterOKLCH and modern CSS color: why HSL lies about lightness
Why HSL colors at the same lightness look wildly different, what OKLCH fixes, how the three channels work.
Color Converter & Contrast CheckerSelf signed certificates: when they are fine and when they are not
What a self signed certificate is, why browsers reject it, how to generate one properly with SANs.
CSR GeneratorTLS 1.2 vs TLS 1.3: what changed and what you should disable
How TLS 1.3 cut the handshake to one round trip, removed every legacy cipher, what 0-RTT costs you, and which protocol versions to turn off today.
SSL CheckerWildcard vs SAN certificates: which one should you buy
What a wildcard certificate covers and what it does not, how SAN certificates differ, why one wildcard does not cover sub subdomains.
SSL & CSR DecoderContent Security Policy explained: what CSP blocks and how to write one
What a Content Security Policy actually blocks, every directive that matters, why unsafe-inline defeats the point.
HTTP Header CheckerCookie flags explained: SameSite, Secure, HttpOnly, and Domain
What every cookie attribute does, the difference between SameSite Lax, Strict, and None, why Domain widens scope more than you think.
HTTP Header CheckerPing and traceroute: reading what they actually tell you
How ping and traceroute work, why middle hops showing high latency or asterisks is usually normal, what MTR adds.
IP Address LookupWhat is a reverse proxy, and why is one in front of nearly every app
How a reverse proxy differs from a forward proxy, what it handles that your app should not, the headers it must forward, and a working nginx configuration.
Nginx Config GeneratorCan you use comments in JSON? No, and here is what to do
Why JSON has no comments, what error you get, and the real options: JSONC, JSON5, dummy keys, or a different format entirely.
JSON Formatter & ValidatorHow to flush your DNS cache on any system
The exact commands to clear the DNS cache on macOS, Windows, and Linux, plus the browser's hidden cache, when flushing actually helps.
DNS Propagation CheckerHTTP/1.1 vs HTTP/2 vs HTTP/3: what actually changed
What each HTTP version changed and why: head of line blocking, multiplexing, header compression, and why HTTP/3 abandoned TCP for QUIC.
HTTP Header CheckerSymmetric vs asymmetric encryption, explained properly
How symmetric and asymmetric encryption differ, why real systems always use both together, and where AES, RSA, and elliptic curves fit.
Encrypt / Decrypt TextWebSockets vs HTTP: when a request is not enough
How WebSockets work under the hood, the upgrade handshake, when they beat polling and SSE, and the operational costs of holding a connection open.
API TesterCache-Control explained: no-cache, no-store, max-age
How HTTP caching actually works: what each Cache-Control directive does, why no-cache does not mean what it sounds like, ETags and revalidation.
HTTP Header Checkercurl cheat sheet: the commands you actually need
A practical curl reference: GET and POST requests, sending JSON, auth headers, following redirects, saving files, inspecting TLS.
API TesterREST vs GraphQL: an honest comparison
How REST and GraphQL actually differ in practice: overfetching, N+1 queries, caching, error handling, and versioning.
API TesterISO 8601 explained: the only date format worth using
How ISO 8601 dates work: the syntax, what the Z and offsets mean, why the format sorts correctly as text.
Timestamp ConverterWhat is localhost? 127.0.0.1 and 0.0.0.0 explained
What localhost and 127.0.0.1 really are, why 0.0.0.0 is not an address you visit, why a server on 0.0.0.0 is reachable from other devices.
IPv4 Subnet CalculatorCommon network ports: the numbers worth memorizing
What ports are, how well known, registered, and ephemeral ranges work, and a reference table of the port numbers you meet in real work.
IP Address LookupWhere to store JWTs: localStorage vs cookies
The real tradeoff between localStorage and httpOnly cookies for JWT storage: XSS vs CSRF, what each attack can actually do.
JWT DecoderXML vs JSON: differences, and when XML still wins
A practical comparison of XML and JSON: syntax, data model, schemas, namespaces, and performance.
XML FormatterMD5 vs SHA-1 vs SHA-256: which hash should you use?
Why MD5 and SHA-1 are broken for security, where they are still fine, and why SHA-256 is the default.
Hash GeneratorRegex cheat sheet: the patterns you actually use
A practical regular expression reference: character classes, quantifiers, anchors, groups, and flags, plus ready to use patterns for emails, URLs, dates.
Regex TesterHow to check how strong a password really is
What password strength actually measures, why length beats symbol checklists, how crack-time estimates work.
Password Strength AnalyzerConvert CSV to JSON: headers to keys, rows to objects
How a CSV file maps to a JSON array of objects, what happens to types along the way, and the quoting, empty cell.
JSON ↔ CSV ConverterHEX, RGB, and HSL: how to convert colors between formats and when to use each
What HEX, RGB, and HSL actually represent, how conversion between them works, how alpha fits in.
Color Converter & Contrast CheckerHow to convert text between cases: UPPERCASE, camelCase, snake_case, and the rest
How to convert text between UPPERCASE, lowercase, Title Case, camelCase, snake_case, and kebab-case, plus the gotchas with acronyms, numbers.
Case Converter & SlugifyConvert a Unix timestamp to a date (and back) without the 1970 bug
How to turn a Unix timestamp into a readable date and a date back into a timestamp, spot seconds versus milliseconds, and handle timezones correctly.
Timestamp ConverterHow to generate a SHA-256 hash of any text
How to hash a string with SHA-256, SHA-1, or SHA-512, what a digest actually is, where hashes are useful.
Hash GeneratorHow to generate UUIDs online, one at a time or in bulk
What a UUID is, how the version 4 format works, why collisions are not a practical worry, and how to generate one UUID or hundreds at once in your browser.
UUID & Token GeneratorParse a URL into its parts: scheme, host, path, query, and fragment
How to break any URL into scheme, host, port, path, query, and fragment, read query string parameters correctly, and avoid the gotchas that skew results.
URL Encoder & ParserSlugify a title: how to turn any string into a clean URL slug
What a URL slug is and how to make one: lowercase, hyphens for spaces, strip punctuation, transliterate accents.
Case Converter & SlugifyURL-safe Base64 (base64url): what it is and how to encode and decode it
What base64url is, how it differs from standard Base64, why + / and = break URLs, and how to convert and decode it.
Base64 Encode / DecodeGET vs POST vs PUT vs PATCH: HTTP methods explained
What each HTTP method actually means, which ones are safe and idempotent, when to use PUT versus PATCH.
API TesterHTTP vs HTTPS: what the S actually changes
The real differences between HTTP and HTTPS: what TLS encrypts and what it does not, ports 80 and 443, certificates, SEO impact.
SSL CheckerPublic vs private IP addresses: ranges, NAT, and how to tell which is which
The difference between public and private IP addresses, the exact private ranges to memorize, how NAT connects the two.
IP Address LookupRegex for email validation: the pattern that actually works
A practical email regex for JavaScript, Python, and HTML, why the fully RFC-compliant pattern is a trap.
Regex TesterSQL joins explained: INNER, LEFT, RIGHT, and FULL with examples
Every SQL join type explained with the same two small tables: INNER, LEFT, RIGHT, FULL OUTER, CROSS, and self joins.
SQL FormatterTCP vs UDP: differences, ports, and when each one wins
How TCP and UDP actually differ, what reliability and ordering cost, which protocols and ports use each, and why DNS, gaming.
DNS LookupHow to check MX records, and what they actually mean
What MX records do, how to read priorities, the common reasons mail fails to deliver, and how to check a domain's mail servers in seconds.
MX LookupConvert SSL certificate formats: PEM, DER, PKCS#12, and PKCS#7
What PEM, DER, PKCS#7, and PKCS#12 actually are, which servers expect which, and how to convert between them without mangling the key.
SSL ConverterDoes my private key match my SSL certificate? How to check
Why a key and certificate must match, the modulus check that proves it, what the mismatch error looks like, and how to verify the pair safely.
Key MatcherEmbedding images as Base64 data URIs: when it helps and when it hurts
How data URIs inline an image directly into HTML or CSS, the real trade-offs in size and caching, and when embedding beats a normal image request.
Image to Base64Certificate Transparency logs: find every certificate issued for your domain
What CT logs are, why every public certificate is recorded in them, and how to use them to catch unexpected or unauthorized certificates for your domain.
CT Log LookupA secure nginx SSL config, explained directive by directive
The TLS directives that actually matter in an nginx server block: protocols, ciphers, HSTS, OCSP stapling, and the redirect, with what each one does.
Nginx Config GeneratorDomain Control Validation: proving you own a domain for SSL
The three ways a certificate authority checks you control a domain before issuing a cert: HTTP, DNS, and email, plus when to use the DNS alternative.
Alt DCV CheckerWhich CA signed this certificate? Verifying the issuer chain
How certificate signing works, why the issuer and the CA must match cryptographically, and how to confirm a CA actually signed a given certificate.
CA MatcherOCSP and certificate revocation: how browsers check a cert is still valid
Why certificates need a revocation mechanism, how OCSP and CRLs work, what OCSP stapling fixes, and how to check a certificate's revocation status.
OCSP CheckerRSA key formats: PKCS#1 vs PKCS#8 vs SPKI
What the different RSA key encodings mean, how to tell them apart from their PEM headers, which tools expect which, and how to convert safely.
RSA Key ConverterWhat happens when you type a URL and press enter
The full journey from a typed address to a rendered page: DNS, TCP, TLS, the HTTP request, and the response.
DNS LookupHow to decode an SSL certificate or CSR and read its fields
What is encoded inside a PEM certificate or CSR, the fields that matter most, and how to decode and inspect them without uploading anything.
SSL & CSR DecoderERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it
Chrome throws ERR_SSL_VERSION_OR_CIPHER_MISMATCH when the browser and server share no common TLS version or cipher. The usual causes and the fixes.
SSL CheckerIPv4 vs IPv6: what changed and why it matters
Why the internet ran out of IPv4 addresses, how IPv6 fixes it, what the addresses actually look like, and what you need to know as a developer.
IP Address LookupHow to monitor SSL certificate expiry across many domains
Why expired certificates still cause outages, what to track beyond the expiry date, and how to check many hosts at once before one lapses.
Bulk SSL CheckerWe checked SPF and DMARC on 21 well-known SaaS domains: here's what we found
A reproducible snapshot of the email authentication posture of 21 well-known SaaS companies.
DMARC Record GeneratorBIMI: how to get your logo to show next to your emails
What BIMI is, why it requires DMARC enforcement first, what a VMC certificate adds, and how to publish and check a BIMI record.
BIMI Record CheckerDMARC p=reject is bouncing legitimate email: how to find and fix the gap
When you move DMARC to p=reject, real mail can start bouncing because a sending source was never aligned.
DMARC Record GeneratorAn email deliverability checklist: why your mail lands in spam
The DNS and authentication records that decide whether your email reaches the inbox, in the order to check them, from SPF and DKIM to reverse DNS.
Email Health (SPF, DKIM, DMARC)The TLS handshake explained, step by step
How a browser and server agree on encryption before sending any data: certificates, key exchange, cipher suites, and what TLS 1.3 made faster.
SSL CheckerDNS propagation explained: why your change isn't live everywhere yet
Why a DNS change shows up in some places before others, how TTLs control the delay, and how to read a propagation checker when resolvers disagree.
DNS Propagation CheckerHow text diff works: line, word, and character comparisons
What a diff algorithm actually computes, the difference between line and word diffs, how to read a unified diff, and when each view is most useful.
Text Diff CheckerHow VPN and proxy detection works (and why you got flagged)
What a VPN detector actually checks: ASN and datacenter ranges, known provider lists, protocol probes, and reputation signals.
VPN & Proxy DetectorSPF PermError: too many DNS lookups, and how to get back under 10
SPF allows a maximum of 10 DNS lookups. Cross it and your record returns PermError and stops authenticating mail.
SPF Record GeneratorWhy is my IP blacklisted, and how to get it removed
What DNS blacklists are, the common reasons an IP lands on one, how to check which lists flag you, and the right way to request delisting.
Blacklist CheckWireGuard vs OpenVPN: what goes in a client config file
How the two main VPN protocols differ, what each field in a client config means, and how to generate a working configuration without guesswork.
VPN Config GeneratorNET::ERR_CERT_AUTHORITY_INVALID: why the browser does not trust your certificate
Chrome shows NET::ERR_CERT_AUTHORITY_INVALID when it cannot build a trusted path to a root CA.
SSL CheckerJSON vs TOML: choosing a config format, and converting between them
The strengths and weaknesses of JSON and TOML for configuration, why TOML exists, and how to convert between the two without losing structure.
JSON ↔ TOML ConverterWhat is lorem ipsum, and why placeholder text is still Latin
Where lorem ipsum comes from, why designers use scrambled Latin instead of real copy, and when placeholder text helps a layout and when it misleads.
Lorem Ipsum GeneratorWHOIS and domain lookups: what the records tell you
What a WHOIS lookup reveals about a domain, how registration and expiry data works, why privacy protection hides owners, and how to read the results.
Domain Registration LookupDKIM signature did not verify: the causes, in order of likelihood
A DKIM signature fails for a handful of concrete reasons: a missing or wrong public key, body changes in transit, the wrong selector.
DKIM Record GeneratorHTTP headers explained: the metadata behind every request
What request and response headers do, the ones that matter most for caching, security, and content type.
HTTP Header CheckerWord count, reading time, and readability: what text statistics tell you
How word and character counts, reading time, and readability scores are calculated, what each is good for, and where the numbers mislead.
Text Statistics & Word Counter301 vs 302 redirects: which to use, and why SEO cares
The difference between a 301 permanent and 302 temporary redirect, how each affects SEO and caching, and when 307 and 308 are the right choice instead.
HTTP Status Codestoolhq vs FreeFormatter: formatting XML and more in the browser
FreeFormatter is a broad, long running set of formatters and validators. toolhq does the common XML and JSON jobs entirely in your browser.
XML FormatterWhat's inside a CSR, byte by byte
A certificate signing request is a small ASN.1 structure: a subject, a public key, optional attributes, and a self-signature.
CSR GeneratorA record vs CNAME: when to use each
The difference between an A record and a CNAME, why you cannot put a CNAME at the domain root, and how to choose the right one for each hostname.
DNS Lookuptoolhq vs regex101: quick regex testing vs a full debugger
regex101 is a best in class regex debugger with explanations and multiple flavors. toolhq is for fast, distraction free testing.
Regex TesterAES-256-CBC vs AES-256-GCM: which mode, and why
The difference between AES in CBC and GCM modes, why GCM's built-in authentication matters, and which to choose for new encryption work.
Encrypt / Decrypt TextReverse DNS and PTR records explained
Reverse DNS maps an IP address back to a hostname using PTR records. Learn the in-addr.arpa zone, why mail servers check it, and how FCrDNS works.
Reverse DNS (PTR Lookup)Fixing SSL certificate chain errors: valid in the browser, broken everywhere else
Why a site can look fine in Chrome while curl fails with unable to get local issuer certificate: missing intermediates, AIA fetching.
SSL CheckerHow to read email headers: tracing a message hop by hop
Where to find raw headers in Gmail, Outlook, and Apple Mail, how to read the Received chain from the bottom up.
Email Header AnalyzerSPF, DKIM, and DMARC explained: what each one actually verifies
What SPF, DKIM, and DMARC each prove, why no single one stops spoofing on its own, the record mistakes that break delivery, and a minimal correct setup.
DMARC Record Generatortoolhq vs jwt.io: decoding tokens without sending them anywhere
How toolhq's JWT decoder compares to jwt.io. Both decode in the browser, and one rule matters most: never paste a production token anywhere untrusted.
JWT DecoderUnderstanding DMARC aggregate reports: what the XML is telling you
Why DMARC rua reports arrive as zipped XML, how to read the records inside, what alignment actually means.
DMARC Report ViewerHTML entities: when and how to encode them
Which characters must be escaped in HTML, named versus numeric entities, how encoding prevents broken markup and a class of XSS, and when you can skip it.
HTML Entity Encoder / DecoderCommon MIME types every developer should know
A clear reference to MIME types: what they are, how the Content-Type header works, the charset parameter.
MIME Type Lookuptoolhq vs IT Tools: two browser-first toolboxes compared
IT Tools is an excellent open source, self hostable toolbox. toolhq is a polished hosted set.
UUID & Token GeneratorHow to format SQL queries for readability
Why consistent SQL formatting speeds up review and debugging, the conventions worth adopting, and a before and after example that changes only whitespace.
SQL FormatterEncrypting text in your browser with AES
What AES encryption actually protects, why your passphrase carries the security, and how client side encryption keeps plaintext off every server you touch.
Encrypt / Decrypt TextUnix timestamps and epoch time explained: seconds, milliseconds, and the 2038 problem
What a Unix timestamp actually counts, why some are ten digits and some are thirteen, how time zones fit in.
Timestamp ConverterCIDR notation and subnetting explained: what /24 actually means
How to read CIDR notation, work out how many addresses a subnet holds, find the network and broadcast addresses.
IPv4 Subnet Calculatortoolhq vs CyberChef: when you want simple over a full workbench
CyberChef is a powerful client side workbench for chained operations. toolhq is for the quick single task. Here is when each one is the right call.
Base64 Encode / DecodeHow to verify webhook signatures with HMAC
Webhook endpoints are public, so anyone can POST to them. Learn how HMAC signatures prove a payload came from the real provider and how to verify them.
HMAC GeneratorCSS easing and cubic-bezier curves, made intuitive
What an easing function is, what the built-in keywords actually do, and how the four numbers in cubic-bezier map to a curve.
Cubic Bezier GeneratorUnderstanding chmod and Unix file permissions: what 755 and 644 actually mean
How Unix permissions are structured, how to read and write the octal numbers behind chmod, and the safe defaults for files, scripts, directories.
Chmod CalculatorConverting between binary, hex, and decimal
Understand number bases the practical way: how binary, hex, and decimal relate, why hex maps cleanly onto bytes, and how to convert by hand reliably.
Number Base ConverterHow to format JSON without uploading it anywhere
Most online JSON formatters upload what you paste. How to format and validate locally, and how to verify that for yourself in the network tab.
JSON Formatter & ValidatorHow TOTP authenticator codes work: the math behind the 6 digits
Why the codes in Google Authenticator and Authy change every 30 seconds, how the server verifies them offline.
TOTP Code Generatortoolhq vs CodeBeautify: a privacy-first take on online dev tools
How toolhq and CodeBeautify compare for everyday JSON work, where each one fits, and why a browser only formatter changes how your data is handled.
JSON Formatter & ValidatorURL encoding explained: why spaces become %20 and when you need it
What percent-encoding is, which characters are reserved, the difference between encodeURI and encodeURIComponent.
URL Encoder & ParserCSS gradients explained: linear, radial, and conic
How linear, radial and conic gradients work in CSS: angles, color stops, hard stops for stripes, and layering several in one background.
CSS Gradient GeneratorConvert YAML to JSON and back: the rules that trip people up
YAML and JSON map onto each other, mostly. The gotchas: indentation, types, the Norway problem, anchors and multi-document files.
YAML ↔ JSON ConverterHow to debug webhooks: see what Stripe, GitHub, and others actually send
Webhook integrations fail silently because you cannot see the request. How to capture and inspect real payloads before writing your handler.
Webhook InspectorCORS errors explained: why your API request works in curl but fails in the browser
The request works in curl and Postman but the browser says CORS error. What CORS actually is, why it exists, and how to fix it on the server.
API TesterHow to read an SSL certificate: subject, SAN, chain, and expiry
What the fields in a TLS certificate mean, how the chain of trust works, why the SAN matters more than the common name.
SSL CheckerWhen to use SHA-256 vs HMAC vs bcrypt
What a hash, a MAC and a password hash each guarantee, and which one to use for integrity, authentication and storing passwords.
Hash GeneratorWhat is actually inside a JWT, and why you can read it without the secret
JSON Web Tokens look like random strings but they are readable by anyone. What the three parts contain, what the signature does, and what JWTs cannot do.
JWT DecoderHow strong is your password really? Entropy explained
Password strength is about entropy, not symbols. How it is calculated, why length beats complexity, and what crack-time estimates mean.
Password Strength AnalyzerGenerate TypeScript types from JSON: stop hand-writing interfaces
Why turning a real API response into TypeScript interfaces beats writing them by hand, how optional and nullable fields are inferred.
JSON to TypeScriptWhat every HTTP status code actually means
A practical guide to HTTP status codes by class: when to send each common one, the ones people misuse (401 vs 403, 400 vs 422).
HTTP Status CodesHow to safely share logs and API keys in a bug ticket
Pasting logs into a ticket leaks tokens, emails and internal hosts. How to redact them consistently, and what attackers do with what leaks.
Encrypt / Decrypt TextcamelCase, snake_case, kebab-case, PascalCase: which goes where
A practical guide to the naming conventions you meet daily, why each ecosystem settled on its own.
Case Converter & SlugifyReading a user-agent string: a field-by-field guide
User-agent strings look like noise but follow a pattern. How to read browser, engine, OS, and device out of one, and why they are full of legacy lies.
User-Agent ParserJSON to CSV: turn an API response into a spreadsheet
How to convert a JSON array into clean CSV for Excel or Sheets, including the escaping rules and what happens to nested objects and missing fields.
JSON ↔ CSV ConverterHow to fix "Unexpected token" JSON errors
Unexpected token errors mean your JSON breaks one of five rules. Here is how to find the exact character that breaks parsing and fix it fast.
JSON Formatter & ValidatorGenerate QR codes locally in your browser
Most QR generators send your URL to a server and some add tracking redirects. How client-side QR generation works and why it matters for private links.
QR Code GeneratorOpen Graph tags: how to control how your links look when shared
The handful of meta tags that decide the title, description, and image when your page is shared on Slack, X, LinkedIn, and iMessage.
Open Graph Meta GeneratorMarkdown to HTML: a practical reference
The Markdown syntax that converts cleanly to HTML, the parts that vary between flavors, and how to preview the rendered output as you write.
Markdown PreviewerCron expressions explained with 12 real examples
Cron syntax in five minutes: what each field means, 12 copy paste examples from every minute to quarterly, and the day-of-week trap everyone hits.
Cron GeneratorUUID v4 vs v7: which should you use for database keys?
Random UUIDs fragment database indexes, time ordered ones do not. When v4 is fine, when v7 is better, and why auto increment integers still have a place.
UUID & Token GeneratorRegex lookahead and lookbehind, explained simply
Lookarounds let a regex check what comes before or after a match without consuming it. The four types, real examples, and when not to use them.
Regex TesterDNS records explained: A, AAAA, CNAME, MX, TXT, and NS
What each DNS record type does, how to check them, and how to debug the classic problems: propagation delays, wrong CNAMEs, and failing email.
DNS LookupWCAG color contrast: what AA and AAA actually require
The contrast ratios WCAG requires for text, what counts as large text, which elements are exempt, and how to check your colors in seconds.
Color Converter & Contrast CheckerBase64 is not encryption: what it is and when to use it
Base64 hides nothing. What encoding actually does, where Base64 shows up in web development, and the security mistakes it causes.
Base64 Encode / Decode