Tips and references for developers and makers.
The same three letters keep showing up in every modern framework's docs — the real question each one answers is simply: at what point does the HTML a browser receives actually get built?
Both bring one branch's changes into another — the real difference is whether your history keeps an honest record of what actually happened, or gets rewritten into a straight line that never existed.
A CDN doesn't make your server faster — it puts copies of your content physically closer to the people requesting it, so the distance data has to travel shrinks instead of the server itself changing.
The real divide isn't "SQL is old, NoSQL is new" — it's whether your data fits neatly into consistent, related tables, or is naturally varied, nested, and easier to reason about as flexible documents.
An idempotent request can be safely retried as many times as a flaky network demands, without the risk of double-charging a card or double-creating an order — here's what actually makes a request idempotent.
An AI model can't reliably tell the difference between instructions you gave it and instructions hidden inside content it's reading — prompt injection is what happens when that confusion gets exploited.
Media queries respond to the whole viewport; container queries respond to the space a component actually has — which is what "responsive" should have meant for reusable components all along.
An API key is a single secret string; OAuth is an entire delegated-authorization protocol. Picking between them comes down to one question: are you authenticating a service, or a user who owns the data?
Both let you define cloud infrastructure as code instead of clicking through a console — the real difference is whether you'd rather write that code in a purpose-built configuration language or a general-purpose programming language you already know.
A 429 error isn't your code failing — it's an API telling you, quite specifically, to slow down. Here's what's actually enforcing that, and how to work with it instead of against it.
"Blocked by CORS policy" is one of the most common errors in web development — and one of the most commonly misunderstood, since the fix almost never lives where the error appears.
Both fetch data over HTTP. The real difference is who decides what comes back in the response — the server, or the client asking the question.
An API waits to be asked. A webhook doesn't wait — it tells you the moment something happens, without you having to keep checking.
Both lay out elements without floats or absolute positioning, and both are genuinely production-ready today — the real question isn't which is 'better,' it's whether your layout is fundamentally one-dimensional or two.
Every API call uses one of a small set of HTTP methods, and picking the wrong one — PUT instead of PATCH, POST instead of PUT — is a common source of subtle API bugs. Here's what each method actually means, and the mix-ups that trip developers up most.
All three let a website remember something about you between page loads, and it's genuinely easy to reach for the wrong one — cookies get sent to your server on every request whether you need them there or not, and the other two never leave the browser at all.
404 and 500 you already know. But 401 vs 403, 301 vs 302, and 429 trip up developers constantly — and getting them wrong quietly breaks debugging, SEO, and API integrations. Here's what each family actually means and when to use which.
That %20 you've seen in URLs isn't decoration — it's how the web safely represents characters a URL can't contain literally. Here's what URL encoding actually does, the characters that trip people up, and the mistakes that quietly break links and forms.
A publisher posting a SHA-256 checksum next to a download link is telling you exactly how to check the file wasn't corrupted or tampered with — here's how to actually use it.
An SVG exported straight from your design tool is carrying editor metadata, unused definitions and absurd decimal precision — none of which affects how it looks.
Both turn data into a fixed-length fingerprint, but MD5 is broken for anything security-sensitive while SHA-256 isn't — here's what that actually means in practice.
That 10-digit number in your API response or database log is counting seconds from a specific moment in 1970 — here's what it means and how to read it.
Not all "random" is equally random — Math.random() and crypto.getRandomValues() look similar but are built for completely different jobs.
Both add a shadow, both accept nearly identical values, and yet they behave completely differently the moment your element isn't a plain rectangle.
The small icon in a browser tab still matters for brand recognition and trust — here's how to generate every size you need, from a 16px tab icon to an Apple touch icon.
Turn a README, meeting notes, or documentation written in Markdown into a clean, shareable, printable PDF — right in your browser.
VPNs get marketed as a fix for almost everything online — here's what they actually do, what they don't, and when one is genuinely worth using.
The 's' in HTTPS stands for a real, meaningful difference in how your data travels across the internet — here's what it actually protects.
UUIDs show up everywhere in software — database keys, session tokens, file names — but it's not always obvious when you actually need one instead of a simple incrementing ID.
Base64 turns binary data into plain text so it can safely travel through systems built for text — here's what it actually does and when you'd use it.
Cron syntax looks cryptic until you know the pattern — here's what each field actually means, with real examples, and a free tool to build one without memorizing the syntax.
Same data, two very different shapes. Here's what actually changes when you convert a spreadsheet's CSV export into JSON, and when you genuinely need to.
From AI-native editors to terminal-based agents, these are the AI coding tools with a genuinely useful free tier — what each does best, and where to start.
Why JSON.parse errors are so unhelpful, how a proper JSON formatter pinpoints the exact broken character, and a practical workflow for cleaning up messy API responses.
What's actually inside a JWT, why you can read the payload without a secret key, and why decoding a token is not the same as verifying it.