toolhq.io

guides

Developer guides from the workbench.

Practical, no-fluff guides on JSON, regex, JWTs, DNS, SSL, and email authentication, the things developers debug every day, written alongside the free tools that fix them.

Aug 18, 20267 min read

ARC: why forwarded mail fails SPF and DKIM

Forwarding rewrites the path and mailing lists rewrite the message, so authentication that passed at the origin fails at the destination.

Email Header Analyzer
Aug 18, 20268 min read

The bulk sender rules for Gmail and Yahoo, and how to meet them

Sending over 5,000 messages a day to Gmail means authentication, one-click unsubscribe and a spam rate under 0.3 percent.

Email Health (SPF, DKIM, DMARC)
Aug 18, 20267 min read

Why you cannot put a CNAME at your apex domain

Why a CNAME at your apex domain is illegal, what breaks when you force it, and how ALIAS, ANAME and CNAME flattening solve it.

DNS Lookup
Aug 18, 20267 min read

The 255 character limit that breaks long DKIM records

Why a 2048 bit DKIM key will not fit one DNS string, how records get split, and the concatenation mistake that silently breaks the key.

DNS Lookup
Aug 18, 20268 min read

How Let's Encrypt actually issues a certificate

The ACME protocol behind automated certificates: orders, challenges, key authorizations, CAA checks and rate limits.

Alt DCV Checker
Aug 18, 20267 min read

HTTP 429: reading rate limit headers and backing off properly

A 429 is an instruction, not an error. How to read Retry-After and the rate limit headers, and why backoff needs jitter to actually work.

API Tester
Aug 18, 20268 min read

MTA-STS and TLS-RPT: enforcing TLS on inbound mail

STARTTLS can be stripped by anyone in the path. MTA-STS tells sending servers to require TLS for your domain, and TLS-RPT tells you when it fails.

DNS Lookup
Aug 18, 20267 min read

SNI: how one IP address serves hundreds of certificates

TLS must send a certificate before HTTP says which site was wanted. How SNI solves that, and why you sometimes get the wrong certificate.

SSL Checker
Aug 18, 20268 min read

What MCP is, and why an AI agent needs real network tools

The Model Context Protocol lets an AI assistant call real tools instead of guessing. How it works, and why network diagnostics are the sharp case.

DNS Lookup
Aug 4, 20266 min read

CSV encoding: why Excel mangles your accents and how to fix it

Why Excel shows é instead of é in a UTF-8 CSV, what the byte order mark does, how delimiters change by locale.

JSON ↔ CSV Converter
Aug 4, 20266 min read

Nano ID vs UUID: choosing an identifier format

How Nano ID and UUID compare on collision risk, length, sortability, and URL friendliness, plus when a shorter ID is safe and when it quietly is not.

UUID & Token Generator
Aug 4, 20266 min read

Greedy vs lazy quantifiers: why your regex matches too much

Why .* swallows the whole line, how lazy quantifiers differ, when a negated character class beats both, and how backtracking causes catastrophic slowdowns.

Regex Tester
Aug 4, 20267 min read

Time zones and UTC offsets: why storing +05:00 is not enough

The difference between an offset and a time zone, why UTC is not GMT, how DST breaks stored times, and the rules for storing and displaying time correctly.

Timestamp Converter
Aug 3, 20268 min read

OAuth 2.0 vs OpenID Connect: authorization is not authentication

Why OAuth 2.0 alone cannot log a user in, what OpenID Connect adds, the difference between an access token and an ID token, and which flow to use today.

JWT Decoder
Aug 3, 20267 min read

SMTP error codes explained: reading a bounce message

How to read SMTP reply codes and enhanced status codes, what 550 5.7.1 and 421 4.7.0 actually mean, and the difference between a hard and a soft bounce.

Email Health (SPF, DKIM, DMARC)
Aug 3, 20266 min read

SMTP ports explained: 25, 465, 587, and which one you should use

What each SMTP port is for, the difference between implicit and explicit TLS, why port 25 is blocked on most networks.

MX Lookup
Aug 3, 20267 min read

Webhooks vs polling: choosing how services tell each other things

The real tradeoffs between webhooks and polling, why webhooks need retries and idempotency, when polling is the better engineering decision.

Webhook Inspector
Aug 1, 20266 min read

CAA records explained: telling CAs who may issue for your domain

What a CAA record does, the exact syntax of issue, issuewild, and iodef tags, how CAs check the tree.

DNS Lookup
Aug 1, 20268 min read

DNSSEC explained: what it signs, what it does not, and how to enable it

How DNSSEC signs DNS answers, what DS, DNSKEY, RRSIG, and NSEC records do, what it does not protect, and the one mistake that takes your domain offline.

DNS Lookup
Aug 1, 20267 min read

Mutual TLS explained: when both sides present a certificate

How mTLS differs from ordinary TLS, what the client certificate actually proves, how to issue and verify one.

SSL Checker
Aug 1, 20267 min read

Server sent events vs WebSockets: which one do you actually need

How server sent events compare to WebSockets on direction, reconnection, proxies, and cost, plus the event stream format and when polling still wins.

API Tester
Jul 31, 20267 min read

OKLCH and modern CSS color: why HSL lies about lightness

Why HSL colors at the same lightness look wildly different, what OKLCH fixes, how the three channels work.

Color Converter & Contrast Checker
Jul 31, 20267 min read

Self signed certificates: when they are fine and when they are not

What a self signed certificate is, why browsers reject it, how to generate one properly with SANs.

CSR Generator
Jul 31, 20267 min read

TLS 1.2 vs TLS 1.3: what changed and what you should disable

How TLS 1.3 cut the handshake to one round trip, removed every legacy cipher, what 0-RTT costs you, and which protocol versions to turn off today.

SSL Checker
Jul 31, 20266 min read

Wildcard vs SAN certificates: which one should you buy

What a wildcard certificate covers and what it does not, how SAN certificates differ, why one wildcard does not cover sub subdomains.

SSL & CSR Decoder
Jul 29, 20268 min read

Content Security Policy explained: what CSP blocks and how to write one

What a Content Security Policy actually blocks, every directive that matters, why unsafe-inline defeats the point.

HTTP Header Checker
Jul 29, 20268 min read

Cookie flags explained: SameSite, Secure, HttpOnly, and Domain

What every cookie attribute does, the difference between SameSite Lax, Strict, and None, why Domain widens scope more than you think.

HTTP Header Checker
Jul 29, 20267 min read

Ping and traceroute: reading what they actually tell you

How ping and traceroute work, why middle hops showing high latency or asterisks is usually normal, what MTR adds.

IP Address Lookup
Jul 29, 20267 min read

What is a reverse proxy, and why is one in front of nearly every app

How a reverse proxy differs from a forward proxy, what it handles that your app should not, the headers it must forward, and a working nginx configuration.

Nginx Config Generator
Jul 24, 20265 min read

Can you use comments in JSON? No, and here is what to do

Why JSON has no comments, what error you get, and the real options: JSONC, JSON5, dummy keys, or a different format entirely.

JSON Formatter & Validator
Jul 24, 20265 min read

How to flush your DNS cache on any system

The exact commands to clear the DNS cache on macOS, Windows, and Linux, plus the browser's hidden cache, when flushing actually helps.

DNS Propagation Checker
Jul 24, 20267 min read

HTTP/1.1 vs HTTP/2 vs HTTP/3: what actually changed

What each HTTP version changed and why: head of line blocking, multiplexing, header compression, and why HTTP/3 abandoned TCP for QUIC.

HTTP Header Checker
Jul 24, 20266 min read

Symmetric vs asymmetric encryption, explained properly

How symmetric and asymmetric encryption differ, why real systems always use both together, and where AES, RSA, and elliptic curves fit.

Encrypt / Decrypt Text
Jul 24, 20267 min read

WebSockets vs HTTP: when a request is not enough

How WebSockets work under the hood, the upgrade handshake, when they beat polling and SSE, and the operational costs of holding a connection open.

API Tester
Jul 22, 20267 min read

Cache-Control explained: no-cache, no-store, max-age

How HTTP caching actually works: what each Cache-Control directive does, why no-cache does not mean what it sounds like, ETags and revalidation.

HTTP Header Checker
Jul 22, 20267 min read

curl cheat sheet: the commands you actually need

A practical curl reference: GET and POST requests, sending JSON, auth headers, following redirects, saving files, inspecting TLS.

API Tester
Jul 22, 20267 min read

REST vs GraphQL: an honest comparison

How REST and GraphQL actually differ in practice: overfetching, N+1 queries, caching, error handling, and versioning.

API Tester
Jul 21, 20266 min read

ISO 8601 explained: the only date format worth using

How ISO 8601 dates work: the syntax, what the Z and offsets mean, why the format sorts correctly as text.

Timestamp Converter
Jul 20, 20266 min read

What is localhost? 127.0.0.1 and 0.0.0.0 explained

What localhost and 127.0.0.1 really are, why 0.0.0.0 is not an address you visit, why a server on 0.0.0.0 is reachable from other devices.

IPv4 Subnet Calculator
Jul 19, 20266 min read

Common network ports: the numbers worth memorizing

What ports are, how well known, registered, and ephemeral ranges work, and a reference table of the port numbers you meet in real work.

IP Address Lookup
Jul 18, 20267 min read

Where to store JWTs: localStorage vs cookies

The real tradeoff between localStorage and httpOnly cookies for JWT storage: XSS vs CSRF, what each attack can actually do.

JWT Decoder
Jul 17, 20266 min read

XML vs JSON: differences, and when XML still wins

A practical comparison of XML and JSON: syntax, data model, schemas, namespaces, and performance.

XML Formatter
Jul 16, 20266 min read

MD5 vs SHA-1 vs SHA-256: which hash should you use?

Why MD5 and SHA-1 are broken for security, where they are still fine, and why SHA-256 is the default.

Hash Generator
Jul 15, 20268 min read

Regex cheat sheet: the patterns you actually use

A practical regular expression reference: character classes, quantifiers, anchors, groups, and flags, plus ready to use patterns for emails, URLs, dates.

Regex Tester
Jul 14, 20265 min read

How to check how strong a password really is

What password strength actually measures, why length beats symbol checklists, how crack-time estimates work.

Password Strength Analyzer
Jul 14, 20265 min read

Convert CSV to JSON: headers to keys, rows to objects

How a CSV file maps to a JSON array of objects, what happens to types along the way, and the quoting, empty cell.

JSON ↔ CSV Converter
Jul 14, 20265 min read

HEX, RGB, and HSL: how to convert colors between formats and when to use each

What HEX, RGB, and HSL actually represent, how conversion between them works, how alpha fits in.

Color Converter & Contrast Checker
Jul 14, 20265 min read

How to convert text between cases: UPPERCASE, camelCase, snake_case, and the rest

How to convert text between UPPERCASE, lowercase, Title Case, camelCase, snake_case, and kebab-case, plus the gotchas with acronyms, numbers.

Case Converter & Slugify
Jul 14, 20264 min read

Convert a Unix timestamp to a date (and back) without the 1970 bug

How to turn a Unix timestamp into a readable date and a date back into a timestamp, spot seconds versus milliseconds, and handle timezones correctly.

Timestamp Converter
Jul 14, 20265 min read

How to generate a SHA-256 hash of any text

How to hash a string with SHA-256, SHA-1, or SHA-512, what a digest actually is, where hashes are useful.

Hash Generator
Jul 14, 20265 min read

How to generate UUIDs online, one at a time or in bulk

What a UUID is, how the version 4 format works, why collisions are not a practical worry, and how to generate one UUID or hundreds at once in your browser.

UUID & Token Generator
Jul 14, 20265 min read

Parse a URL into its parts: scheme, host, path, query, and fragment

How to break any URL into scheme, host, port, path, query, and fragment, read query string parameters correctly, and avoid the gotchas that skew results.

URL Encoder & Parser
Jul 14, 20264 min read

Slugify a title: how to turn any string into a clean URL slug

What a URL slug is and how to make one: lowercase, hyphens for spaces, strip punctuation, transliterate accents.

Case Converter & Slugify
Jul 14, 20265 min read

URL-safe Base64 (base64url): what it is and how to encode and decode it

What base64url is, how it differs from standard Base64, why + / and = break URLs, and how to convert and decode it.

Base64 Encode / Decode
Jul 8, 20268 min read

GET vs POST vs PUT vs PATCH: HTTP methods explained

What each HTTP method actually means, which ones are safe and idempotent, when to use PUT versus PATCH.

API Tester
Jul 8, 20268 min read

HTTP vs HTTPS: what the S actually changes

The real differences between HTTP and HTTPS: what TLS encrypts and what it does not, ports 80 and 443, certificates, SEO impact.

SSL Checker
Jul 8, 20267 min read

Public vs private IP addresses: ranges, NAT, and how to tell which is which

The difference between public and private IP addresses, the exact private ranges to memorize, how NAT connects the two.

IP Address Lookup
Jul 8, 20268 min read

Regex for email validation: the pattern that actually works

A practical email regex for JavaScript, Python, and HTML, why the fully RFC-compliant pattern is a trap.

Regex Tester
Jul 8, 20269 min read

SQL joins explained: INNER, LEFT, RIGHT, and FULL with examples

Every SQL join type explained with the same two small tables: INNER, LEFT, RIGHT, FULL OUTER, CROSS, and self joins.

SQL Formatter
Jul 8, 20268 min read

TCP vs UDP: differences, ports, and when each one wins

How TCP and UDP actually differ, what reliability and ordering cost, which protocols and ports use each, and why DNS, gaming.

DNS Lookup
Jun 24, 20265 min read

How to check MX records, and what they actually mean

What MX records do, how to read priorities, the common reasons mail fails to deliver, and how to check a domain's mail servers in seconds.

MX Lookup
Jun 23, 20266 min read

Convert SSL certificate formats: PEM, DER, PKCS#12, and PKCS#7

What PEM, DER, PKCS#7, and PKCS#12 actually are, which servers expect which, and how to convert between them without mangling the key.

SSL Converter
Jun 23, 20265 min read

Does my private key match my SSL certificate? How to check

Why a key and certificate must match, the modulus check that proves it, what the mismatch error looks like, and how to verify the pair safely.

Key Matcher
Jun 22, 20265 min read

Embedding images as Base64 data URIs: when it helps and when it hurts

How data URIs inline an image directly into HTML or CSS, the real trade-offs in size and caching, and when embedding beats a normal image request.

Image to Base64
Jun 22, 20265 min read

Certificate Transparency logs: find every certificate issued for your domain

What CT logs are, why every public certificate is recorded in them, and how to use them to catch unexpected or unauthorized certificates for your domain.

CT Log Lookup
Jun 22, 20266 min read

A secure nginx SSL config, explained directive by directive

The TLS directives that actually matter in an nginx server block: protocols, ciphers, HSTS, OCSP stapling, and the redirect, with what each one does.

Nginx Config Generator
Jun 21, 20265 min read

Domain Control Validation: proving you own a domain for SSL

The three ways a certificate authority checks you control a domain before issuing a cert: HTTP, DNS, and email, plus when to use the DNS alternative.

Alt DCV Checker
Jun 21, 20265 min read

Which CA signed this certificate? Verifying the issuer chain

How certificate signing works, why the issuer and the CA must match cryptographically, and how to confirm a CA actually signed a given certificate.

CA Matcher
Jun 20, 20265 min read

OCSP and certificate revocation: how browsers check a cert is still valid

Why certificates need a revocation mechanism, how OCSP and CRLs work, what OCSP stapling fixes, and how to check a certificate's revocation status.

OCSP Checker
Jun 20, 20265 min read

RSA key formats: PKCS#1 vs PKCS#8 vs SPKI

What the different RSA key encodings mean, how to tell them apart from their PEM headers, which tools expect which, and how to convert safely.

RSA Key Converter
Jun 20, 20266 min read

What happens when you type a URL and press enter

The full journey from a typed address to a rendered page: DNS, TCP, TLS, the HTTP request, and the response.

DNS Lookup
Jun 19, 20265 min read

How to decode an SSL certificate or CSR and read its fields

What is encoded inside a PEM certificate or CSR, the fields that matter most, and how to decode and inspect them without uploading anything.

SSL & CSR Decoder
Jun 19, 20266 min read

ERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it

Chrome throws ERR_SSL_VERSION_OR_CIPHER_MISMATCH when the browser and server share no common TLS version or cipher. The usual causes and the fixes.

SSL Checker
Jun 19, 20265 min read

IPv4 vs IPv6: what changed and why it matters

Why the internet ran out of IPv4 addresses, how IPv6 fixes it, what the addresses actually look like, and what you need to know as a developer.

IP Address Lookup
Jun 19, 20265 min read

How to monitor SSL certificate expiry across many domains

Why expired certificates still cause outages, what to track beyond the expiry date, and how to check many hosts at once before one lapses.

Bulk SSL Checker
Jun 19, 20268 min read

We checked SPF and DMARC on 21 well-known SaaS domains: here's what we found

A reproducible snapshot of the email authentication posture of 21 well-known SaaS companies.

DMARC Record Generator
Jun 18, 20265 min read

BIMI: how to get your logo to show next to your emails

What BIMI is, why it requires DMARC enforcement first, what a VMC certificate adds, and how to publish and check a BIMI record.

BIMI Record Checker
Jun 18, 20267 min read

DMARC p=reject is bouncing legitimate email: how to find and fix the gap

When you move DMARC to p=reject, real mail can start bouncing because a sending source was never aligned.

DMARC Record Generator
Jun 18, 20266 min read

An email deliverability checklist: why your mail lands in spam

The DNS and authentication records that decide whether your email reaches the inbox, in the order to check them, from SPF and DKIM to reverse DNS.

Email Health (SPF, DKIM, DMARC)
Jun 18, 20266 min read

The TLS handshake explained, step by step

How a browser and server agree on encryption before sending any data: certificates, key exchange, cipher suites, and what TLS 1.3 made faster.

SSL Checker
Jun 17, 20266 min read

DNS propagation explained: why your change isn't live everywhere yet

Why a DNS change shows up in some places before others, how TTLs control the delay, and how to read a propagation checker when resolvers disagree.

DNS Propagation Checker
Jun 17, 20265 min read

How text diff works: line, word, and character comparisons

What a diff algorithm actually computes, the difference between line and word diffs, how to read a unified diff, and when each view is most useful.

Text Diff Checker
Jun 17, 20266 min read

How VPN and proxy detection works (and why you got flagged)

What a VPN detector actually checks: ASN and datacenter ranges, known provider lists, protocol probes, and reputation signals.

VPN & Proxy Detector
Jun 17, 20266 min read

SPF PermError: too many DNS lookups, and how to get back under 10

SPF allows a maximum of 10 DNS lookups. Cross it and your record returns PermError and stops authenticating mail.

SPF Record Generator
Jun 17, 20265 min read

Why is my IP blacklisted, and how to get it removed

What DNS blacklists are, the common reasons an IP lands on one, how to check which lists flag you, and the right way to request delisting.

Blacklist Check
Jun 17, 20266 min read

WireGuard vs OpenVPN: what goes in a client config file

How the two main VPN protocols differ, what each field in a client config means, and how to generate a working configuration without guesswork.

VPN Config Generator
Jun 16, 20266 min read

NET::ERR_CERT_AUTHORITY_INVALID: why the browser does not trust your certificate

Chrome shows NET::ERR_CERT_AUTHORITY_INVALID when it cannot build a trusted path to a root CA.

SSL Checker
Jun 16, 20265 min read

JSON vs TOML: choosing a config format, and converting between them

The strengths and weaknesses of JSON and TOML for configuration, why TOML exists, and how to convert between the two without losing structure.

JSON ↔ TOML Converter
Jun 16, 20264 min read

What is lorem ipsum, and why placeholder text is still Latin

Where lorem ipsum comes from, why designers use scrambled Latin instead of real copy, and when placeholder text helps a layout and when it misleads.

Lorem Ipsum Generator
Jun 16, 20265 min read

WHOIS and domain lookups: what the records tell you

What a WHOIS lookup reveals about a domain, how registration and expiry data works, why privacy protection hides owners, and how to read the results.

Domain Registration Lookup
Jun 15, 20266 min read

DKIM signature did not verify: the causes, in order of likelihood

A DKIM signature fails for a handful of concrete reasons: a missing or wrong public key, body changes in transit, the wrong selector.

DKIM Record Generator
Jun 15, 20266 min read

HTTP headers explained: the metadata behind every request

What request and response headers do, the ones that matter most for caching, security, and content type.

HTTP Header Checker
Jun 15, 20265 min read

Word count, reading time, and readability: what text statistics tell you

How word and character counts, reading time, and readability scores are calculated, what each is good for, and where the numbers mislead.

Text Statistics & Word Counter
Jun 14, 20265 min read

301 vs 302 redirects: which to use, and why SEO cares

The difference between a 301 permanent and 302 temporary redirect, how each affects SEO and caching, and when 307 and 308 are the right choice instead.

HTTP Status Codes
Jun 14, 20265 min read

toolhq vs FreeFormatter: formatting XML and more in the browser

FreeFormatter is a broad, long running set of formatters and validators. toolhq does the common XML and JSON jobs entirely in your browser.

XML Formatter
Jun 14, 20268 min read

What's inside a CSR, byte by byte

A certificate signing request is a small ASN.1 structure: a subject, a public key, optional attributes, and a self-signature.

CSR Generator
Jun 13, 20265 min read

A record vs CNAME: when to use each

The difference between an A record and a CNAME, why you cannot put a CNAME at the domain root, and how to choose the right one for each hostname.

DNS Lookup
Jun 13, 20266 min read

toolhq vs regex101: quick regex testing vs a full debugger

regex101 is a best in class regex debugger with explanations and multiple flavors. toolhq is for fast, distraction free testing.

Regex Tester
Jun 12, 20265 min read

AES-256-CBC vs AES-256-GCM: which mode, and why

The difference between AES in CBC and GCM modes, why GCM's built-in authentication matters, and which to choose for new encryption work.

Encrypt / Decrypt Text
Jun 12, 20266 min read

Reverse DNS and PTR records explained

Reverse DNS maps an IP address back to a hostname using PTR records. Learn the in-addr.arpa zone, why mail servers check it, and how FCrDNS works.

Reverse DNS (PTR Lookup)
Jun 11, 20267 min read

Fixing SSL certificate chain errors: valid in the browser, broken everywhere else

Why a site can look fine in Chrome while curl fails with unable to get local issuer certificate: missing intermediates, AIA fetching.

SSL Checker
Jun 11, 20267 min read

How to read email headers: tracing a message hop by hop

Where to find raw headers in Gmail, Outlook, and Apple Mail, how to read the Received chain from the bottom up.

Email Header Analyzer
Jun 11, 20269 min read

SPF, DKIM, and DMARC explained: what each one actually verifies

What SPF, DKIM, and DMARC each prove, why no single one stops spoofing on its own, the record mistakes that break delivery, and a minimal correct setup.

DMARC Record Generator
Jun 11, 20265 min read

toolhq vs jwt.io: decoding tokens without sending them anywhere

How toolhq's JWT decoder compares to jwt.io. Both decode in the browser, and one rule matters most: never paste a production token anywhere untrusted.

JWT Decoder
Jun 11, 20268 min read

Understanding DMARC aggregate reports: what the XML is telling you

Why DMARC rua reports arrive as zipped XML, how to read the records inside, what alignment actually means.

DMARC Report Viewer
Jun 10, 20266 min read

HTML entities: when and how to encode them

Which characters must be escaped in HTML, named versus numeric entities, how encoding prevents broken markup and a class of XSS, and when you can skip it.

HTML Entity Encoder / Decoder
Jun 9, 20265 min read

Common MIME types every developer should know

A clear reference to MIME types: what they are, how the Content-Type header works, the charset parameter.

MIME Type Lookup
Jun 9, 20266 min read

toolhq vs IT Tools: two browser-first toolboxes compared

IT Tools is an excellent open source, self hostable toolbox. toolhq is a polished hosted set.

UUID & Token Generator
Jun 8, 20266 min read

How to format SQL queries for readability

Why consistent SQL formatting speeds up review and debugging, the conventions worth adopting, and a before and after example that changes only whitespace.

SQL Formatter
Jun 7, 20266 min read

Encrypting text in your browser with AES

What AES encryption actually protects, why your passphrase carries the security, and how client side encryption keeps plaintext off every server you touch.

Encrypt / Decrypt Text
Jun 7, 20265 min read

Unix timestamps and epoch time explained: seconds, milliseconds, and the 2038 problem

What a Unix timestamp actually counts, why some are ten digits and some are thirteen, how time zones fit in.

Timestamp Converter
Jun 6, 20265 min read

CIDR notation and subnetting explained: what /24 actually means

How to read CIDR notation, work out how many addresses a subnet holds, find the network and broadcast addresses.

IPv4 Subnet Calculator
Jun 6, 20266 min read

toolhq vs CyberChef: when you want simple over a full workbench

CyberChef is a powerful client side workbench for chained operations. toolhq is for the quick single task. Here is when each one is the right call.

Base64 Encode / Decode
Jun 6, 20266 min read

How to verify webhook signatures with HMAC

Webhook endpoints are public, so anyone can POST to them. Learn how HMAC signatures prove a payload came from the real provider and how to verify them.

HMAC Generator
Jun 5, 20266 min read

CSS easing and cubic-bezier curves, made intuitive

What an easing function is, what the built-in keywords actually do, and how the four numbers in cubic-bezier map to a curve.

Cubic Bezier Generator
Jun 5, 20265 min read

Understanding chmod and Unix file permissions: what 755 and 644 actually mean

How Unix permissions are structured, how to read and write the octal numbers behind chmod, and the safe defaults for files, scripts, directories.

Chmod Calculator
Jun 4, 20266 min read

Converting between binary, hex, and decimal

Understand number bases the practical way: how binary, hex, and decimal relate, why hex maps cleanly onto bytes, and how to convert by hand reliably.

Number Base Converter
Jun 4, 20265 min read

How to format JSON without uploading it anywhere

Most online JSON formatters upload what you paste. How to format and validate locally, and how to verify that for yourself in the network tab.

JSON Formatter & Validator
Jun 4, 20265 min read

How TOTP authenticator codes work: the math behind the 6 digits

Why the codes in Google Authenticator and Authy change every 30 seconds, how the server verifies them offline.

TOTP Code Generator
Jun 3, 20265 min read

toolhq vs CodeBeautify: a privacy-first take on online dev tools

How toolhq and CodeBeautify compare for everyday JSON work, where each one fits, and why a browser only formatter changes how your data is handled.

JSON Formatter & Validator
Jun 3, 20265 min read

URL encoding explained: why spaces become %20 and when you need it

What percent-encoding is, which characters are reserved, the difference between encodeURI and encodeURIComponent.

URL Encoder & Parser
Jun 2, 20266 min read

CSS gradients explained: linear, radial, and conic

How linear, radial and conic gradients work in CSS: angles, color stops, hard stops for stripes, and layering several in one background.

CSS Gradient Generator
Jun 2, 20266 min read

Convert YAML to JSON and back: the rules that trip people up

YAML and JSON map onto each other, mostly. The gotchas: indentation, types, the Norway problem, anchors and multi-document files.

YAML ↔ JSON Converter
Jun 1, 20265 min read

How to debug webhooks: see what Stripe, GitHub, and others actually send

Webhook integrations fail silently because you cannot see the request. How to capture and inspect real payloads before writing your handler.

Webhook Inspector
May 30, 20266 min read

CORS errors explained: why your API request works in curl but fails in the browser

The request works in curl and Postman but the browser says CORS error. What CORS actually is, why it exists, and how to fix it on the server.

API Tester
May 30, 20266 min read

How to read an SSL certificate: subject, SAN, chain, and expiry

What the fields in a TLS certificate mean, how the chain of trust works, why the SAN matters more than the common name.

SSL Checker
May 30, 20266 min read

When to use SHA-256 vs HMAC vs bcrypt

What a hash, a MAC and a password hash each guarantee, and which one to use for integrity, authentication and storing passwords.

Hash Generator
May 28, 20265 min read

What is actually inside a JWT, and why you can read it without the secret

JSON Web Tokens look like random strings but they are readable by anyone. What the three parts contain, what the signature does, and what JWTs cannot do.

JWT Decoder
May 27, 20265 min read

How strong is your password really? Entropy explained

Password strength is about entropy, not symbols. How it is calculated, why length beats complexity, and what crack-time estimates mean.

Password Strength Analyzer
May 24, 20265 min read

Generate TypeScript types from JSON: stop hand-writing interfaces

Why turning a real API response into TypeScript interfaces beats writing them by hand, how optional and nullable fields are inferred.

JSON to TypeScript
May 24, 20267 min read

What every HTTP status code actually means

A practical guide to HTTP status codes by class: when to send each common one, the ones people misuse (401 vs 403, 400 vs 422).

HTTP Status Codes
May 21, 20265 min read

How to safely share logs and API keys in a bug ticket

Pasting logs into a ticket leaks tokens, emails and internal hosts. How to redact them consistently, and what attackers do with what leaks.

Encrypt / Decrypt Text
May 18, 20264 min read

camelCase, snake_case, kebab-case, PascalCase: which goes where

A practical guide to the naming conventions you meet daily, why each ecosystem settled on its own.

Case Converter & Slugify
May 18, 20266 min read

Reading a user-agent string: a field-by-field guide

User-agent strings look like noise but follow a pattern. How to read browser, engine, OS, and device out of one, and why they are full of legacy lies.

User-Agent Parser
May 15, 20265 min read

JSON to CSV: turn an API response into a spreadsheet

How to convert a JSON array into clean CSV for Excel or Sheets, including the escaping rules and what happens to nested objects and missing fields.

JSON ↔ CSV Converter
May 12, 20264 min read

How to fix "Unexpected token" JSON errors

Unexpected token errors mean your JSON breaks one of five rules. Here is how to find the exact character that breaks parsing and fix it fast.

JSON Formatter & Validator
May 12, 20264 min read

Generate QR codes locally in your browser

Most QR generators send your URL to a server and some add tracking redirects. How client-side QR generation works and why it matters for private links.

QR Code Generator
May 12, 20265 min read

Open Graph tags: how to control how your links look when shared

The handful of meta tags that decide the title, description, and image when your page is shared on Slack, X, LinkedIn, and iMessage.

Open Graph Meta Generator
May 9, 20265 min read

Markdown to HTML: a practical reference

The Markdown syntax that converts cleanly to HTML, the parts that vary between flavors, and how to preview the rendered output as you write.

Markdown Previewer
May 8, 20265 min read

Cron expressions explained with 12 real examples

Cron syntax in five minutes: what each field means, 12 copy paste examples from every minute to quarterly, and the day-of-week trap everyone hits.

Cron Generator
May 5, 20265 min read

UUID v4 vs v7: which should you use for database keys?

Random UUIDs fragment database indexes, time ordered ones do not. When v4 is fine, when v7 is better, and why auto increment integers still have a place.

UUID & Token Generator
Apr 30, 20265 min read

Regex lookahead and lookbehind, explained simply

Lookarounds let a regex check what comes before or after a match without consuming it. The four types, real examples, and when not to use them.

Regex Tester
Apr 25, 20265 min read

DNS records explained: A, AAAA, CNAME, MX, TXT, and NS

What each DNS record type does, how to check them, and how to debug the classic problems: propagation delays, wrong CNAMEs, and failing email.

DNS Lookup
Apr 22, 20265 min read

WCAG color contrast: what AA and AAA actually require

The contrast ratios WCAG requires for text, what counts as large text, which elements are exempt, and how to check your colors in seconds.

Color Converter & Contrast Checker
Apr 14, 20264 min read

Base64 is not encryption: what it is and when to use it

Base64 hides nothing. What encoding actually does, where Base64 shows up in web development, and the security mistakes it causes.

Base64 Encode / Decode