Tutorials, tips, and insights for modern developers
HTML escaping is one of those things you either do correctly or pay for with an XSS bug. Here's a practical rundown of what it is, when to reach for it, and the gotchas that bite people....
Bcrypt has been the sensible default for password storage for two decades. Here's what it actually does, when to reach for it, the gotchas that trip people up, and a short worked example....
A practical guide to hashing passwords with bcrypt — why it exists, how the cost factor works, the gotchas that bite people in production, and a short worked example....
MD5 still shows up everywhere in real codebases. Here's what it actually does, when it's fine to use, and the mistakes that'll get you burned....
MD5 still shows up everywhere in real codebases, but half the time it's used for the wrong thing. Here's a practical rundown of when to reach for it, when to run, and a quick worked example....
Bcrypt is still the sensible default for hashing passwords in most apps. Here's how it works, when to use it, the gotchas that trip people up, and a worked example....
MD5 gets a bad rap, and for good reason in security contexts. But it's still genuinely useful for checksums, cache keys, and dedup. Here's when to reach for it — and when not to....
Percent-encoding trips up developers constantly — spaces that break query strings, plus signs that turn into spaces, double-encoded messes. Here's how URL encoding really works and the gotchas to watch for....
MD5 gets a bad rap, and for security it deserves it. But it's still genuinely useful for checksums, deduplication, and cache keys. Here's when to reach for it and when to run....
Bcrypt is still one of the safest defaults for storing passwords. Here's how it works, when to use it, the gotchas that bite people, and a quick worked example....
Base64 shows up everywhere from data URIs to JWTs, and it's just as often misused. Here's a practical rundown of what it is, when it helps, and the gotchas that trip people up....
A practical look at MD5 for working developers — where it still earns its keep, where it'll get you in trouble, and a quick worked example....
