Developer Guides & Best Practices
Knowing how to use a tool is good. the concepts behind it makes you a better developer. Our guides cover the data formats, protocols, encoding schemes, and patterns that professional developers work with every day. Each article explains the fundamentals, walks through common pitfalls, and provides practical tips you can apply immediately in your own projects.
Every guide links directly to the relevant tools on ThisDevTool so you can experiment as you learn. We also publish head-to-head comparisons of competing formats and technologies - JSON versus YAML, REST versus GraphQL, CSV versus JSON, and more - to help you choose the right tool for the job. Bookmark this page and check back as we add new guides regularly.
Guides & Articles
Regex Lookahead and Lookbehind: A Practical Guide
Master regex lookahead and lookbehind with hands-on examples: the four zero-width assertions, password validation, and JavaScript lookbehind caveats explained.
How to Format Messy One-Line SQL Into Readable Queries
Turn a dense one-line SQL query into clean, indented, cased, CTE-friendly code. Covers dialect choice, keyword case, comma style, and why formatting aids debugging.
Tailwind Arbitrary Values: The [Bracket] Syntax Guide
Learn when and how to use Tailwind arbitrary values like w-[237px] and bg-[#1da1f2]: type hints, calc(), underscores, arbitrary variants, and v4 changes.
Fix Python binascii.Error: Incorrect Padding
Fix Python's binascii.Error: Incorrect padding when decoding Base64. Restore = padding, strip data URI prefixes, handle URL-safe tokens, and the validate quirk.
Docker Compose depends_on service_healthy Not Waiting
Fix Docker Compose depends_on service_healthy not waiting: long vs short syntax, missing healthchecks, pg_isready, start_period, the run command, and migrations.
GitHub Actions Secrets Empty on pull_request: Fixes
GitHub Actions secrets are empty on pull_request by design, for forks and same-repo PRs. Learn why, plus safe fixes: push/workflow_dispatch, environments, ok-to-test.
Fix SPA 404 on Refresh with Nginx try_files
React or Vue route 404s on refresh? Fix it with Nginx try_files $uri $uri/ /index.html, keep static assets returning real 404s, and order your /api/ proxy first.
curl POST JSON With a Bearer Token: The Exact Command
The exact curl command to POST JSON with a Bearer token: -X POST, Content-Type and Authorization headers, -d body or -d @file.json, plus the token jq pattern.
How Long Should a Password Be? Entropy Explained
Calculate password entropy with H = L x log2(R), hit the 60/80/128-bit targets, see why a 20-char lowercase password beats 8 mixed chars, and why the hash matters.
Unix Timestamp Seconds vs Milliseconds: The 1000x Bug
Unix timestamp seconds vs milliseconds: how to tell 10-digit from 13-digit values, why JS Date wants ms, when to multiply by 1000, and dodge the 1000x bug.
CSS Gradient Text Not Showing? Safari background-clip Fix
CSS gradient text disappearing in Safari? Fix background-clip: text with -webkit prefixes, transparent text fill, box-decoration-break: clone, and @supports.
JWT Decode vs Verify: Is a Decoded Token Safe?
Decoding a JWT only reads its Base64url claims with no key check, while verifying confirms the signature. Trusting a decoded token causes auth bypass. Here is why.
Fix Excel Ruining CSV Leading Zeros & Scientific Notation
Excel turned 02116 into 2116 and your IDs into scientific notation? Here is the definitive fix for Excel destroying CSV leading zeros, plus a rescue guide.
Convert Nested JSON to CSV: Flatten Objects and Arrays
Learn to convert nested JSON to CSV and flatten arrays correctly. Four strategies for nested objects, line-item arrays, and tags, with a worked order example.
Markdown to HTML for Gmail & WordPress
Convert Markdown to HTML for Gmail and WordPress without raw asterisks or hashes. Four ranked workflows plus an honest email-client compatibility guide.
Base64url vs Base64: URL-Safe Encoding Explained
Base64url vs base64: the + / = characters break URLs, filenames, and JWTs. See the character map and copy-paste JS and Python to convert both ways.
AES-256-GCM in JavaScript with Web Crypto
Copy-paste AES-256-GCM JavaScript using the Web Crypto API: random 12-byte IVs, 128-bit tags, and PBKDF2 password-derived keys, with the gotchas devs trip on.
Bcrypt Cost Factor: How Many Rounds in 2026?
What bcrypt cost factor (salt rounds) should you use in 2026? Start at 12, tune to roughly 250ms, benchmark your own hardware, and migrate safely on login.
UUID vs Auto-Increment Primary Key
UUID vs auto-increment primary key: the real performance cost depends on your engine. How clustered indexes, heap storage, and UUIDv7 change the answer.
Store JWT in localStorage vs Cookie
Should you store a JWT in localStorage vs a cookie? An honest breakdown of the XSS vs CSRF trade-off, plus the in-memory access token + HttpOnly refresh pattern.
Resize an Image to a Specific KB (No Upload)
Need to resize an image to a specific KB for a form or upload limit? Hit an exact 20, 50, 100 or 200 KB target in your browser, with the file never uploaded.
CSS Animation Keyframes: Copy-Paste Examples
Copy-paste CSS animation keyframes examples: spinner, fade-in, bounce, pulse, shake, and a bouncing-dots loader. Plus the performance and accessibility rules.
curl Command Cheat Sheet (With Code Conversion)
A task-organized curl cheat sheet: POST JSON, bearer tokens, follow redirects, status-only, headers-only, plus one-click conversion to Python and JS.
How to Handle 429 Too Many Requests
Learn how to handle 429 Too Many Requests on the client: honor Retry-After, use exponential backoff with jitter, and a copy-paste fetchWithRetry helper.
Fix JSON Unexpected Token Error: Decode the Message
A JSON unexpected token error fix playbook: decode the exact message, find the real bug (usually 1-2 chars before the reported position), and repair it fast.
Fix Weird Characters From Copy-Paste (’ Mojibake)
Apostrophes and quotes turning into strange symbols after copy-paste? Learn why Word, Docs, and AI smart quotes become mojibake, and how to decode and fix it.
Fix the JWT Expired Token Error
Hit a "jwt expired" or "token not yet valid" error? This decision-tree guide shows how to read exp, iat, and nbf to fix the JWT token expired error fast.
Fix Base64 Decode Errors: Padding & Invalid Char
Fix Base64 invalid character and incorrect padding errors fast. The three real causes, copy-paste fixes for the mod-4 rule, whitespace, and URL-safe alphabets.
Bcrypt vs Argon2 vs Scrypt vs PBKDF2 (2026 Guide)
Bcrypt vs Argon2 vs scrypt vs PBKDF2: a 2026 decision framework for picking a password hashing algorithm, with safe parameters, gotchas, and a migration plan.
Glassmorphism CSS: The Honest Frosted-Glass Recipe
A complete glassmorphism CSS recipe: backdrop-filter blur, saturate to undo the gray wash, the 1px glass-edge border, Safari prefix, fallback, and contrast.
Backdrop-Filter Not Working in Safari? 5 Real Fixes
Backdrop-filter not working in Safari? Here are the 5 real causes ranked by likelihood, each with the exact fix and an @supports fallback for reliable blur.
OKLCH vs HSL vs HEX: Which CSS Color to Use
OKLCH vs HSL vs HEX explained with a clear decision rule: when to use each CSS color format, why HSL lightness lies, and how OKLCH fixes perceptual scales.
Fix "No Access-Control-Allow-Origin Header" Error
Fix the No 'Access-Control-Allow-Origin' header error: map each exact CORS console message to its header fix, with copy-paste Express, Flask & Nginx code.
Fix "Refused to Execute Inline Script" CSP Error
The "Refused to execute inline script" CSP error means a nonce or hash is required. Here is the secure fix, ranked best-first, with the exact console hash.
How to Enable CORS in Express, Flask, Spring & Nginx
How to enable CORS for real: copy-paste code for Express, Flask, Spring Boot, and Nginx/Apache, plus the two gotchas that break localhost dev setups.
GitHub Actions Cron Not Running: Ranked Fix Checklist
GitHub Actions cron not running? Work through this ranked checklist of the 7 real causes, each with a copy-paste fix and a gh run list command to verify it.
Fix Unexpected End of JSON Input
SyntaxError: Unexpected end of JSON input means your string ended too soon. A decision tree to find the cause: empty fetch body, truncated stream, or cutoff.
Compare Two JSON Files: Find the Real Differences
Compare two JSON files and find the real differences without diff noise. Format both sides consistently first, then diff API responses and config files cleanly.
Why Your Markdown Table Is Not Rendering
Markdown table not rendering? Five real causes with a broken-vs-fixed example for each: blank lines, separator row, column counts, renderer, escaping pipes.
Fix the JWT Invalid Signature Error
A developer's triage order for the JWT invalid signature error: read the alg, check the HS256 secret, rule out RS256-vs-HS256, and re-verify the key directly.
Decode a JWT Manually Without a Library
Learn to decode a JWT manually without a library. Why plain base64 fails, the base64url padding fix, and copy-paste JS, Python, and bash decoders.
Verify Webhook Signature with HMAC-SHA256
Provider-by-provider guide to verify a webhook signature with HMAC-SHA256: Stripe, GitHub, Shopify, plus raw-body and constant-time gotchas in Node and Python.
CSS Gradient Banding Fix: 4 Ranked Methods
A CSS gradient banding fix that works: why those visible color steps appear, plus four ranked solutions from an SVG noise overlay to a dithered fallback.
Layered Box-Shadows for Realistic Depth
Learn the layered box-shadow technique for realistic depth: why one shadow looks fake, the 3-layer recipe, low-opacity scaling, and copy-paste elevation tokens.
Colorblind-Safe Palette: A Developer's Guide
Build a colorblind-safe palette that survives deuteranopia and protanopia: the two rules that matter, the combos that fail, and ready-to-use hex palettes.
htaccess Redirect Rules: 301, www, Force HTTPS
Copy-paste htaccess redirect rules: 301 redirect www to non-www, force HTTPS, single-page and trailing-slash redirects, plus a combined canonical block.
Test Webhooks Locally and Verify HMAC Signatures
Learn to test webhooks locally and verify the HMAC signature: tunnel to localhost, capture the raw body, use timing-safe compare, and debug failures fast.
DNS Record Types Cheat Sheet: A vs CNAME vs MX vs TXT
A practical DNS record types cheat sheet: when to use A vs CNAME vs MX vs TXT, plus the apex-CNAME, MX-hostname, and SPF gotchas that break real setups.
JSON Formatting Best Practices for Developers
Learn JSON formatting best practices: indentation conventions, minified vs pretty-printed, common errors and fixes, and validation tips.
Regular Expressions Guide for Developers
Learn regex fundamentals: syntax, character classes, quantifiers, common patterns for email, URL, and phone validation, flags, and performance tips.
Base64 Encoding Explained: When and How to Use It
Understand what Base64 encoding is, how the algorithm works, common use cases like data URIs and email attachments, and when not to use it.
JWT Tokens Explained: Header, Payload & Signature
Learn how JSON Web Tokens work, decode each of the three parts, understand signing algorithms, and avoid common JWT security pitfalls.
CSS Flexbox vs Grid: When to Use Each Layout System
Compare CSS Flexbox and Grid layout systems with practical examples. Learn when to use each, how they differ, and when to combine them.
Meta Tags for SEO: The Complete 2026 Guide
Master every meta tag that matters for SEO in 2026: title, description, Open Graph, Twitter Cards, robots, canonical, and structured data.
HTTP Status Codes: The Complete Developer Reference
Every HTTP status code explained with examples, debugging tips, and when you'll encounter each one in REST APIs.
Password Security Best Practices for Developers
Entropy, hashing algorithms, NIST guidelines, and practical tips for building secure password systems.
CSS Layout Techniques in 2026: Grid, Flexbox & Beyond
Modern CSS layout with Grid, Flexbox, Container Queries, and Subgrid - when to use each with code examples.
API Testing Tools Guide: cURL, Postman & More
Compare API testing tools from cURL to Postman. Learn to debug endpoints, mock APIs, and automate testing.
Git Workflow Best Practices for Teams
Branching strategies, commit messages, PR reviews, and release management for professional Git workflows.
Web Typography Systems: Modular Scales, Fluid Type, and Design Tokens
Build professional typography systems with modular scales, CSS clamp() for fluid type, font pairing principles, and design tokens.
Docker Configuration Guide: Compose, Multi-Stage Builds, and Production Patterns
Master Dockerfile best practices, multi-stage builds, docker-compose.yml, networking, volumes, health checks, and production vs development configs.
OpenAPI Specification Guide: Designing, Documenting, and Testing APIs
Master OpenAPI 3.x: paths, operations, schemas, reusable components, API versioning, mock servers, and automated testing.
Content Security Policy Explained: A Developer's Guide to CSP Headers
Learn CSP from the ground up: what it prevents, directive reference, nonces vs hashes, report-only mode, common mistakes, and deployment strategies.
CSV Data Handling for Developers: Parsing, Converting, and Common Pitfalls
Master CSV parsing edge cases, delimiter detection, encoding issues, CSV vs JSON trade-offs, and strategies for working with large files.
Understanding JSON Schema: Validation, Types, and Best Practices
Learn JSON Schema from the ground up: basic types, required properties, pattern validation, nested schemas, $ref for reuse, and common mistakes.
Web Accessibility and Color Contrast: A Developer's Guide to WCAG Compliance
WCAG contrast ratios, AA vs AAA levels, testing methodology, designing for color blindness, and dark mode accessibility considerations.
Comparisons
Head-to-head format and technology comparisons. View all comparisons →
CSV vs JSON
Compare CSV and JSON for data storage and exchange. Learn the differences in structure, readability, nesting support, and ideal use cases.
JSON vs YAML
Compare JSON and YAML side by side. Learn the key differences in syntax, readability, features, and use cases for your project.
REST vs GraphQL
Compare REST and GraphQL API architectures side by side. Learn the key differences in data fetching, versioning, caching, and error handling.
SVG vs PNG
Compare SVG and PNG image formats side by side. Learn the key differences in scalability, file size, animation, and transparency.
Base64 vs URL Encoding
Compare Base64 encoding and URL encoding side by side. Learn the differences in purpose, output size, character sets, and when to use each.