DeveloperUpdated 17 October 2026
Encoding, formats and everyday developer problems
JSON errors, Base64, JWTs, UUIDs, regex, URL encoding and mojibake, explained by what the specification actually says rather than by folklore.
Most of the problems in this section are specification problems that folklore has papered over. JSON does not allow trailing commas and never did; Base64 is an encoding with no secrecy in it; a JWT's payload is readable by anyone holding the token, and only the signature makes it trustworthy. Each guide here takes one of those, states what the relevant specification actually says, and then works through the failure it explains: the mojibake, the double-encoded URL, the regex that matches almost the right thing.
20 guides5 subjects
20 guides
MIME types, magic bytes and why a file opens as the wrong thing
An upload rejects your PNG for not being a PNG. The extension says one thing, the first eight bytes say another, and the server believes the bytes.
What a user agent string actually says about you
Every browser claims to be Mozilla. The string is part identification, part historical fiction, and it is a weaker signal every year.
QR codes: what is actually encoded, and how to make one that scans
There is no database behind a QR code. Everything it knows is printed in the squares, which is why a long URL makes a code nobody can scan.
Prettify or minify: what formatters actually do to your code
A formatter throws your whitespace away and prints the syntax tree again. Everything surprising about formatters follows from that.
URL encoding, HTML entities and MIME types: three things people mix up
The same ampersand needs three different treatments depending on where it is going. Getting them confused is how & ends up on a page.
Cleaning a block of text: the operations worth doing in order
Removing duplicates before trimming whitespace leaves you with duplicates. Most text-cleaning frustration is an ordering problem, not a tool problem.
YAML, JSON and TSV: picking a format for config and interchange
YAML turns the country code NO into the boolean false. That is not a bug report, it is in the specification, and it is why config formats need choosing carefully.
Gradients and palettes: why yours goes grey in the middle
Blend blue into yellow and you get a muddy grey halfway. That is not your eye, it is the colour space doing arithmetic that does not match perception.
Find, replace and extract: getting structure out of unstructured text
Replace all instances of "cat" and you have just changed "category", "concatenate" and "location". Word boundaries exist for a reason.
HTTP status codes: the handful that decide what search engines do
Moving a page with the wrong redirect code throws away everything that page had earned. The difference is one digit.
Cron expressions: reading the five fields without guessing
A schedule that should fire monthly fires every Monday as well. The two day fields are combined with OR, not AND.
What you are actually sharing when you paste a link
The link you copied from your address bar may identify you to everyone you send it to, and occasionally log them in as you.
Why your text turns into é: Unicode, UTF-8 and mojibake explained
When "café" arrives as "café", the bytes are fine, something decoded them with the wrong assumption. The garbled output tells you which assumption.
The JSON errors everyone hits, and what the spec actually says
JSON is a deliberately tiny format. Most parse errors come from writing JavaScript object syntax and expecting a JSON parser to accept it.
Base64, explained properly: what it is for and what it is not
Base64 shows up in data URIs, email attachments, JWTs and API payloads. It also shows up in security incident reports, because people mistake it for protection.
How diff tools work, and why they sometimes show the wrong change
A diff tool has no idea what your code means. It is solving a sequence-matching problem, which is why moved blocks look like a delete plus an unrelated insert.
JWTs: what is inside one, and why decoding is not verifying
Anyone holding a JWT can read every claim in it. That is by design, and it is the single most misunderstood thing about the format.
Regex without the mystique: the patterns that actually come up
Most regex frustration comes from three things: forgetting anchors, not knowing greedy matching exists, and trying to validate email addresses.
UUID v4 or v7? What changed and which to use for database keys
v4 is 122 random bits and has served well for twenty years. v7 fixes the one place it hurts: as a primary key in a B-tree index.
Colour contrast: what the WCAG numbers mean and how to hit them
Low-contrast text is the most common accessibility failure on the web, and one of the easiest to fix, once you know which number you are aiming at and why.