57 guides on web. Showing the 48 most recent.
Formats, encodings, hashes and the numbers behind a page that loads quickly. These guides start from the specification and check it against a real file, and say where a limit is the standard's and where it is the browser's.
Ranked by how many pages of this site link to them, not by traffic.
Three nines sounds like a promise until you divide it into minutes. What 99.9 % buys per year, per month, per week and per day; why the measurement window matters far more than the extra nine; and the two different months this tool uses for the same slug.
Daniel Okonkwo · 10 min read
The generator's random source audited line by line, what SAE actually removes, why transition mode gives most of it back, and the thing every guest-network guide leaves out.
Daniel Okonkwo · 13 min read
Entropy prices one attack: offline guessing against a stolen hash. Above roughly 90 bits the number stops deciding anything — and the meter on this site under-reported a random 20-character password in 300 draws out of 300.
Daniel Okonkwo · 12 min read
Golden hour runs from +6° to −4° of solar elevation and blue hour from −4° to −6°, which is why it lasts forty minutes at the equator, over an hour at mid-latitudes, and above 72.6° in June does not happen at all. The thresholds this calculator uses, checked against its own output.
Daniel Okonkwo · 12 min read
Blur and pixelation are reversible — not by undoing the maths, but by guessing forwards. Against this tool's own blur and pixelate modes, a recovery attack returned the hidden value at rank 1 of 10,000. Both modes have since been removed. Here is what is left, and why it cannot be attacked the same way.
Daniel Okonkwo · 12 min read
Three encodings, one visible difference: %20 or +. The builder's form mode matches URLSearchParams byte for byte on seventeen values — but give it a base URL with a fragment and every parameter lands inside the hash, where no server sees it.
Daniel Okonkwo · 12 min read
Four real stylesheets run through the minifier, measured raw and after gzip. Stripping every space saved 48, 103, 104 and 147 compressed bytes; stripping comments saved 57, 1 358, 2 420 and 1 042. Plus the five inputs this minifier breaks.
Daniel Okonkwo · 14 min read
The encryption is the easy half. Here is exactly what the browser tool does to your file — cipher, key derivation, salt, nonce — and why an encrypted attachment with the passphrase in the same thread protects nothing at all.
Daniel Okonkwo · 12 min read
A comma is quoted, a quotation mark is doubled, and a two-line cue keeps both lines — verified byte-identical over three consecutive round trips. What can still change your file is the spreadsheet in the middle.
Daniel Okonkwo · 12 min read
Cue 12 of the English track is not cue 12 of the French one, because translators split and join sentences differently. Two strategies exist for pairing them; this merger uses neither — it interleaves. Here is what that gives you and when it is good enough.
Daniel Okonkwo · 15 min read
Removing the numbers and the timestamps is the easy half. The half that decides whether the transcript is readable is the italic tags, the dialogue dashes, the sound descriptions and the sentences broken across two cues — and this converter leaves every one of them for you.
Daniel Okonkwo · 13 min read
Measure the offset at two points instead of guessing it once. If it is constant, one shift fixes the file. If it grows, it is a frame-rate mismatch — 25 fps against 23.976 drifts 2.5625 seconds every minute — and no shift will ever fix that.
Daniel Okonkwo · 15 min read
Luhn is a checksum for catching typos, patented in 1960, and that is its entire job. A number that passes it tells you nothing about any account. For testing a payment integration you need your processor's published numbers, not a generated one.
Daniel Okonkwo · 15 min read
Swapping names for identifiers does not take a database out of the GDPR — Article 4(5) and Recital 26 say so directly. Genuinely synthetic data is outside the Regulation altogether. That single distinction decides how you seed a staging environment.
Daniel Okonkwo · 16 min read
RFC 8259 requires exactly three things to be escaped inside a JSON string. Everything else is optional. The one that actually breaks pipelines is a lone surrogate — legal in JSON text, impossible in UTF-8, and silently replaced the moment your data is written out.
Daniel Okonkwo · 13 min read
The smallest thing that is still a table is two lines: a header row and a delimiter row. Here is why the second one is mandatory in GitHub Flavored Markdown, where pipe tables do not exist at all, and what a generator does that hand-typing cannot.
Daniel Okonkwo · 13 min read
A Markdown table has exactly two forbidden characters in a cell: the pipe and the line break. Here is what each one does, how a converter handles them, why the escape has to be applied in the right order, and why padding never matters.
Daniel Okonkwo · 15 min read
Why the reader's language decides the delimiter, what the converter does to the quoting when you switch, what the sep= first line really is, and the count of quoted cells on the same export written five ways.
Daniel Okonkwo · 15 min read
What happens to the header row, what happens to rows of unequal length, what happens to types — and the one thing transposing is regularly mistaken for and cannot do.
Daniel Okonkwo · 13 min read
Two documents that differ only in how many children exist produce two different JSON shapes, and no converter can tell them apart without a schema. Plus what this one really does with attributes, mixed content and whitespace — and the one thing it still cannot record.
Daniel Okonkwo · 15 min read
The same two orders come out as five columns from one converter and ten from another, and neither is wrong. Dotted paths, arrays of scalars, arrays of objects and records with different keys — four decisions, made for you, usually silently.
Daniel Okonkwo · 16 min read
Quoted delimiters, embedded newlines, ambiguous types, duplicate headers and encoding. Each one was run through the converter and the exact output is printed here — including the two cases it does not rescue.
Daniel Okonkwo · 15 min read
Percent-encoding is decided per URL component, which is the whole source of the confusion. A slash is legal in a path and must be escaped in a query value; a space is %20 in a path and may be + in a form body. Here are the exact RFC 3986 sets, the three JavaScript functions that disagree, and the traps.
Daniel Okonkwo · 16 min read
Entropy measures the process that produced a password, not the characters in it. H = L x log2(R) is only true when every character was chosen at random — which is exactly why a meter scoring a human-invented password on its character classes is measuring the wrong thing.
Daniel Okonkwo · 16 min read
A JWT is signed, not encrypted. Anyone holding the token can decode the payload and read every claim in it. Here is a real token, decoded without any key, plus the three attacks the signature is supposed to stop and the one problem it cannot solve.
Daniel Okonkwo · 16 min read
MD5 is broken and MD5 is fine, depending on which of three security properties you needed. Here is what collision resistance, second-preimage resistance and preimage resistance actually mean, which algorithm still has which, and why none of them belongs near a password.
Daniel Okonkwo · 15 min read
Four directives, two wildcards, one file at the host root. It is a crawl instruction and nothing more — it does not remove a page from search results, it does not restrict access, and it publishes every path you list in it.
Daniel Okonkwo · 9 min read
Minute, hour, day of month, month, day of week. The traps are that a step is a stride through a range and not an interval, and that the two day fields are combined with OR — so 0 0 1 * 1 fires on the 1st and on every Monday.
Daniel Okonkwo · 9 min read
301 against 308, 302 against 307, 401 against 403, 404 against 410 — plus what Retry-After on a 429 or a 503 actually promises. The pairs where picking the wrong code changes behaviour, not just wording.
Daniel Okonkwo · 8 min read
Read is 4, write is 2, execute is 1, and each of the three digits describes a different party. The part most explanations get wrong is what the execute bit does on a directory — it grants traversal, not the right to run anything.
Daniel Okonkwo · 7 min read
Length beats complexity. Here's why a four-word passphrase is strong, why you should never reuse a password, and how a manager makes it effortless.
Daniel Okonkwo · 3 min read
JSON and XML both store structured data as text, but they trade off differently. Here's how each looks, where each wins, and how to choose.
Daniel Okonkwo · 2 min read
Base64 turns binary data into safe text. Here's what it does, why it exists, why it isn't encryption, and the size cost it adds.
Daniel Okonkwo · 2 min read
A QR code is a 2D barcode a camera reads to open a link or text. Here's what it is, why it holds so much, its anatomy, and a safety note on scanning.
Daniel Okonkwo · 3 min read
A regular expression is a pattern for matching text. Here are the building blocks — character classes, quantifiers and anchors — with a worked example.
Daniel Okonkwo · 3 min read
A hash function turns any input into a fixed-size fingerprint. Here's what it does, its key properties, common uses, and which algorithms are safe.
Daniel Okonkwo · 2 min read
Format plain text with a few symbols: # for headings, ** for bold, - for lists. Here's what markdown is, the core syntax, why it's everywhere, and the gotchas.
Daniel Okonkwo · 3 min read
HEX and RGB are two notations for the same colours. Here's how to read each, convert between them, and add transparency.
Daniel Okonkwo · 3 min read
A JWT is a compact, signed token used to carry identity between services. Here's its three parts, how it's used for auth, and its security limits.
Daniel Okonkwo · 2 min read
A word count is words separated by spaces. Here's how it's counted, why limits exist, how it maps to pages and reading time, and when characters count instead.
Daniel Okonkwo · 3 min read
A UUID is a 128-bit identifier that's unique without any central authority. Here's what it looks like, why it's useful, the versions, and when to use one.
Daniel Okonkwo · 2 min read
Frames = duration × rate is trivial until the rate is 29.97. Non-drop timecode then drifts exactly 3.6 seconds an hour. Drop-frame corrects it by skipping 108 frame numbers — the same 108 — but the correction is not perfect: counting every frame shows a residual of 3.6 milliseconds per hour.
Daniel Okonkwo · 18 min read
Uncompressed audio size is exact arithmetic: sample rate × bit depth × channels × seconds ÷ 8. CD audio is 176,400 bytes per second. A 320 kbps MP3, by contrast, is bitrate × duration and does not depend on the sample rate at all — 2,400,000 bytes a minute whether it came from 44.1 or 48 kHz.
Daniel Okonkwo · 15 min read
Interpolating in sRGB averages gamma-encoded numbers, so the midpoint of red to green is #808000 when the half-light answer is #bcbc00 — 57.2% too little light. Banding is a separate arithmetic problem: 8 bits give 256 steps, and a dark gradient may have only 28 of them. Here is both, computed.
Daniel Okonkwo · 17 min read
Complementary, triadic, analogous and split-complementary are just rotations: add 180°, 120°, 30° or 150° to a hue. The arithmetic is trivial. The problem is that the HSL hue circle is not perceptually uniform — yellow and blue at the same HSL lightness differ in luminance by 12.85 times — so a generated palette has to be contrast-checked afterwards.
Daniel Okonkwo · 15 min read
A diagonal plus an aspect ratio gives you width and height by Pythagoras, and the answer is not what the marketing implies: a 27-inch 21:9 has 16.2% less area than a 27-inch 16:9. Then pixels per degree, which shows the highest-PPI phone is not the sharpest thing you own.
Daniel Okonkwo · 17 min read
Building an IN list by string concatenation is both the classic injection vector and a performance cliff. Parameterisation fixes the first structurally, because the plan is compiled before any value arrives. The second needs arithmetic: the vendors' documented parameter ceilings, and what a query whose text changes with every list length does to a plan cache.
Daniel Okonkwo · 19 min read
YAML is JSON plus a type-inference layer, and the inference is the dangerous part. The same file run through a YAML 1.2 parser and a YAML 1.1 parser: no is a string in one and false in the other, 01234 is 1234 in one and 668 in the other, and 12:30:00 is a number in one of them.
Daniel Okonkwo · 17 min read