Guides

Original tutorials and reference articles for developers and automation engineers. Each guide links to related Flashman tools you can use immediately in your browser.

95 guides · also read our blog

• JWT explained: how to decode tokens safely

  Learn JSON Web Token structure, common claims, and why decoding is not the same as verification.

  2026-06-01 · 6 min read

• JSON formatting and validation: a practical guide

  How to pretty-print, minify, and validate JSON for APIs, configs, and logs—without leaking data.

  2026-06-01 · 5 min read

• Base64 encoding explained (and why it is not encryption)

  What Base64 is for, when to use it, and common pitfalls with Unicode and padding.

  2026-05-28 · 4 min read

• YAML vs JSON: when to use each format

  Compare readability, tooling, and trade-offs for configuration and APIs.

  2026-05-28 · 5 min read

• Cron expressions: schedule jobs with confidence

  Understand five-field cron syntax and avoid timezone surprises in production.

  2026-05-25 · 5 min read

• URL encoding: common mistakes and fixes

  Percent-encoding rules for query strings, paths, and plus signs in form data.

  2026-05-25 · 4 min read

• Why client-side developer tools protect your data

  How in-browser processing reduces leak risk for tokens, configs, and customer data.

  2026-05-20 · 4 min read

• MATLAB & Simulink: JSON workflows for engineers

  Bridge JSON configuration and MATLAB matrices or structs for automation and calibration.

  2026-05-20 · 6 min read

• SHA hashing explained for developers

  What SHA-256 and SHA-512 do, when to use them, and what hashing is not.

  2026-05-18 · 4 min read

• Markdown writing guide: syntax, preview, and export

  Learn Markdown basics — headings, lists, code blocks, tables — and how to preview or export to PDF in your browser.

  2026-06-02 · 7 min read

• Regex testing workflow: match with confidence

  How to prototype regular expressions safely before shipping validation logic.

  2026-05-18 · 5 min read

• Portainer stack environment variables: a safe deploy guide

  Prepare Portainer stack variables, Docker Compose references, secrets, domains, ports, and rollback notes before updating self-hosted services.

  2026-07-23 · 7 min read

• API payload debugging checklist for production incidents

  A practical checklist for inspecting API payloads, encoded fields, tokens, and diffs during production debugging.

  2026-07-09 · 7 min read

• QR codes for developers: URLs, Wi-Fi, and vCard

  When to use QR codes, what to encode, and how to generate them safely for apps and documentation.

  2026-06-03 · 5 min read

• Hex, RGB, and contrast: a color guide for UI work

  Convert between color formats, check contrast, and avoid common mistakes in design systems.

  2026-06-03 · 6 min read

• UUIDs and correlation IDs in distributed systems

  Generate UUID v4 values, trace requests across services, and avoid ID collisions.

  2026-06-04 · 5 min read

• Password generators: length, entropy, and storage

  Create strong passwords in the browser and learn why generation is only half the problem.

  2026-06-04 · 5 min read

• Unix timestamps and ISO dates: conversion guide

  Convert epoch seconds, milliseconds, and ISO-8601 strings without timezone bugs.

  2026-06-05 · 5 min read

• Text and JSON diff: compare changes with confidence

  Side-by-side diffs for configs, API payloads, and code review prep.

  2026-06-05 · 5 min read

• XML formatting and minification for configs and APIs

  Pretty-print XML, validate structure, and ship readable configs to operations teams.

  2026-06-06 · 5 min read

• SQL formatting for readable queries and code review

  Indent SELECT statements, align JOINs, and share queries your team can maintain.

  2026-06-06 · 4 min read

• CSS beautify and minify for production bundles

  Format messy CSS for debugging and minify for faster page loads.

  2026-06-07 · 4 min read

• HTML entities: encode text for safe markup

  Escape &, <, >, and quotes to prevent XSS and fix broken HTML snippets.

  2026-06-07 · 4 min read

• camelCase, snake_case, and kebab-case: naming guide

  Convert identifiers between conventions for JSON, APIs, CSS, and databases.

  2026-06-08 · 4 min read

• Binary, octal, decimal, and hex conversion

  Convert between number bases for low-level debugging, flags, and hardware docs.

  2026-06-08 · 5 min read

• JSON API type contracts: numbers, strings, nulls, and IDs

  Design and debug stable JSON API types across schemas, serializers, databases, generated clients, and production payloads.

  2026-08-26 · 8 min read

• JWT client identity claims: aud, azp, client_id, and sub

  Map JWT identity claims to OAuth clients, resource servers, users, and gateway authorization rules without weakening token verification.

  2026-08-26 · 8 min read

• Cron calendar semantics across Linux, Kubernetes, and cloud schedulers

  Understand cron day-field logic, dialect differences, timezones, daylight saving, retries, and idempotency before scheduling production jobs.

  2026-08-26 · 8 min read

• Base64 across MIME, JSON, URLs, and environment variables

  Move Base64 data safely across transport boundaries by handling alphabets, padding, line wrapping, escaping, size, and byte-level checks.

  2026-08-26 · 8 min read

• Regex performance and ReDoS safety guide

  Design, test, and bound regular expressions so ambiguous backtracking on untrusted input does not become a production performance incident.

  2026-08-26 · 8 min read

• JSON Patch concurrency: indexes, identities, and safe updates

  Design reliable JSON Patch APIs with stable identities, conditional requests, ordered operations, conflict handling, and regression fixtures.

  2026-08-27 · 8 min read

• OAuth certificate-bound tokens and JWT cnf claims

  Implement and debug certificate-bound access tokens across OAuth servers, mTLS gateways, JWT validation, certificate rotation, and trusted proxy hops.

  2026-08-27 · 8 min read

• Scheduler clock corrections, duplicate runs, and idempotency

  Operate scheduled jobs safely through NTP steps, VM resumes, clock jumps, failover, retries, and duplicate dispatches with durable execution keys.

  2026-08-27 · 8 min read

• Binary-safe Base64: bytes, Unicode, and round-trip validation

  Preserve arbitrary binary bytes through Base64 workflows by separating text encoding from file data, checking hashes, limiting size, and testing round trips.

  2026-08-27 · 8 min read

• YAML schema type safety across CI and application parsers

  Prevent YAML implicit-type bugs by understanding schemas, quoting ambiguous strings, comparing parsed JSON, and testing CI and application parser behavior.

  2026-08-27 · 8 min read

• SQL NULL and three-valued logic in production queries

  Write reliable SQL around NULL with explicit predicates, safe joins, predictable anti-joins, typed parameters, and representative database fixtures.

  2026-08-28 · 8 min read

• Signed URL canonicalization and verification guide

  Build and debug signed URLs with deterministic paths, query ordering, percent-encoding, duplicate parameters, expiry checks, and reusable test vectors.

  2026-08-28 · 8 min read

• HTML output encoding by context without double-escaping

  Prevent XSS and visible entity bugs by separating canonical text, HTML encoding, URL validation, DOM sinks, rich-text sanitization, and regression tests.

  2026-08-28 · 8 min read

• CSS custom properties, fallbacks, and cascade layers

  Design resilient CSS tokens by understanding computed values, inheritance, fallback semantics, layer order, themes, typed properties, and browser diagnostics.

  2026-08-28 · 8 min read

• Portable Markdown code fences and nested examples

  Write nested Markdown examples that survive CommonMark, GFM, documentation generators, syntax highlighting, sanitization, and PDF export.

  2026-08-28 · 8 min read

• XML namespaces and SOAP integration guide

  Build reliable XML integrations by understanding expanded names, default namespaces, XPath bindings, SOAP versions, schema validation, and safe test fixtures.

  2026-08-29 · 8 min read

• Timestamp instants, offsets, and safe API round trips

  Design time-safe APIs by separating instants, local times, dates, offsets, zones, epoch units, precision, storage behavior, and browser presentation.

  2026-08-29 · 8 min read

• UUID contracts across APIs and databases

  Use UUIDs consistently across text, JSON, binary storage, database drivers, validation, indexing, logging, authorization, and version-aware application contracts.

  2026-08-29 · 8 min read

• YAML multiline scalars and exact whitespace

  Control YAML multiline strings with literal and folded styles, indentation, chomping, line endings, interpolation boundaries, and byte-aware deployment tests.

  2026-08-29 · 8 min read

• Reliable QR codes for URLs and mobile deep links

  Ship dependable QR flows by designing safe URLs, encoding components, controlling payload density, testing physical output, handling app routing, and providing fallbacks.

  2026-08-29 · 8 min read

• JSON Merge Patch API design and safe partial updates

  Design predictable JSON Merge Patch endpoints with explicit null semantics, stable object contracts, concurrency controls, validation, authorization, and test fixtures.

  2026-08-30 · 8 min read

• Nested JWT validation with typ and cty headers

  Validate nested JWTs safely by defining token profiles, processing encryption and signatures in order, constraining algorithms, and assigning claims to trust boundaries.

  2026-08-30 · 8 min read

• Base64 API size budgets and memory-safe transport

  Set reliable Base64 payload budgets by calculating expansion, including JSON and protocol overhead, enforcing decoded limits, choosing streaming transports, and testing gateways.

  2026-08-30 · 8 min read

• Scheduled job jitter, capacity, and thundering herd control

  Design scheduled workloads that avoid synchronized spikes with deterministic jitter, queues, concurrency limits, idempotency, deadlines, backpressure, and capacity tests.

  2026-08-30 · 8 min read

• Unicode-safe regex and normalization guide

  Build Unicode-aware text matching by separating code units, code points, grapheme clusters, normalization, locale rules, security boundaries, and runtime regex support.

  2026-08-30 · 8 min read

• JSON depth limits and safe complexity budgets

  Protect JSON APIs from deeply nested input by measuring structural complexity, bounding parsers and validators, replacing unsafe recursion, and testing clear limits.

  2026-08-31 · 8 min read

• JWT x5c certificate chains and trust validation

  Validate JWT x5c headers safely by separating token signatures from PKI trust, building certificate paths, constraining key use, and planning rollover.

  2026-08-31 · 8 min read

• Canonical Base64 encoding and strict decoding

  Define interoperable Base64 boundaries with explicit alphabets, padding and whitespace rules, zero pad bits, canonical re-encoding, and signature-safe handling.

  2026-08-31 · 8 min read

• Cron calendar edge cases for month-end and leap years

  Design reliable calendar schedules across short months, leap years, business-day rules, timezones, missed dates, retries, and next-run monitoring.

  2026-08-31 · 8 min read

• Safe SQL parameter binding across drivers

  Build portable parameterized SQL by understanding driver placeholders, binding order, data types, collection expansion, prepared statements, and safe diagnostics.

  2026-08-31 · 8 min read

• Safe JSON object mapping and prototype pollution prevention

  Map untrusted JSON safely with explicit schemas, controlled object construction, secure merge behavior, authorization boundaries, dependency updates, and regression tests.

  2026-09-01 · 8 min read

• OAuth DPoP proof validation and proxy-safe deployment

  Validate OAuth DPoP proofs with constrained JWT algorithms, request binding, nonce handling, replay prevention, key thumbprints, trusted proxies, and clear diagnostics.

  2026-09-01 · 8 min read

• CSS stacking contexts, z-index, and reliable overlay layers

  Design reliable CSS overlay layers by understanding stacking contexts, paint order, clipping, portals, the browser top layer, accessibility, and responsive tests.

  2026-09-01 · 8 min read

• XML CDATA, character data, and serializer-safe text

  Handle XML text safely by choosing escaped character data or CDATA deliberately, splitting terminators, preserving encodings, using serializers, and testing signatures.

  2026-09-01 · 8 min read

• Portable Markdown links, images, and document assets

  Build portable Markdown documents by choosing stable relative paths, encoded URLs, renderer-compatible anchors, packaged assets, accessible text, and link checks.

  2026-09-01 · 8 min read

• Exact integers in JSON API contracts

  Preserve exact JSON integers by defining string and numeric contracts, tracing parser limits, selecting safe database types, and testing cross-runtime round trips.

  2026-09-02 · 8 min read

• Portable regex replacement and capture groups

  Design reliable regex replacements by separating pattern and replacement grammars, using stable captures, controlling escape layers, and testing engine differences.

  2026-09-02 · 8 min read

• XML byte encodings, declarations, and parser boundaries

  Process XML bytes reliably by reconciling declarations, BOMs, transport charsets, Unicode decoding, parser security, signatures, and round-trip fixtures.

  2026-09-02 · 8 min read

• CSS dimensions in calc and custom properties

  Build dependable CSS calculations by defining token dimensions, composing compatible units, handling var fallbacks, tracing the cascade, and testing layouts.

  2026-09-02 · 8 min read

• URL path decoding across proxies and routers

  Design unambiguous URL paths by controlling percent-decoding, separator handling, proxy normalization, canonicalization, authorization, caches, and signatures.

  2026-09-02 · 8 min read

• HTTP content encoding and safe decompression

  Handle compressed HTTP responses safely by separating content coding from transfer framing, enforcing limits, preserving metadata, and testing every proxy boundary.

  2026-09-03 · 8 min read

• SQL deadlocks, transactions, and safe retries

  Design database transactions that reduce deadlocks with stable lock ordering, useful indexes, bounded retries, idempotent effects, observability, and concurrency tests.

  2026-09-03 · 8 min read

• QR code print and scanning reliability

  Create dependable printed QR codes by controlling payload density, quiet zones, module dimensions, contrast, error correction, export quality, and device testing.

  2026-09-03 · 8 min read

• Cross-platform text files and stable checksums

  Create reliable text checksums by defining exact bytes, encodings, line endings, terminal newlines, canonical forms, artifact boundaries, and cross-platform tests.

  2026-09-03 · 8 min read

• Alpha colors and accessible contrast

  Evaluate accessible contrast for transparent CSS colors by compositing real backgrounds, tracing opacity and blending, testing states, and validating rendered themes.

  2026-09-03 · 8 min read

• HTTP cache validators, ETags, and conditional requests

  Design reliable HTTP revalidation with ETags, modification dates, cache keys, 304 responses, representation variants, proxies, and observable test cases.

  2026-09-04 · 8 min read

• Strict JSON processing for JWT headers and claims

  Harden JWT processing by rejecting duplicate JSON names, constraining algorithms, preserving signed segments, validating claim types, and testing parser boundaries.

  2026-09-04 · 8 min read

• YAML alias expansion and parser resource safety

  Process YAML safely with explicit byte, depth, alias, expansion, tag, time, and memory limits while reviewing effective configuration and parser upgrades.

  2026-09-04 · 8 min read

• Stable SQL pagination with offsets and keysets

  Design predictable SQL pagination with total ordering, compound cursors, correct predicates, useful indexes, snapshot boundaries, and concurrent-write tests.

  2026-09-04 · 8 min read

• Password Unicode, byte limits, and safe hashing boundaries

  Handle passwords safely across Unicode input, UTF-8 byte limits, normalization policy, hashing-library constraints, migrations, and non-secret test fixtures.

  2026-09-04 · 8 min read

• JSON contracts for NaN, Infinity, and invalid numbers

  Design portable JSON number contracts by detecting non-finite calculations, choosing explicit domain representations, validating schemas, and testing language boundaries.

  2026-09-05 · 8 min read

• PEM key containers: PKCS#1, PKCS#8, and public keys

  Handle PEM keys safely by identifying PKCS#1, PKCS#8, SubjectPublicKeyInfo, certificates, encryption, algorithms, line endings, and deployment boundaries.

  2026-09-05 · 8 min read

• Portainer and Docker Compose variable precedence

  Deploy predictable stacks by separating Compose interpolation, container environment precedence, build arguments, Portainer values, secrets, and recreation behavior.

  2026-09-05 · 8 min read

• HMAC verification across hex, Base64, and raw bytes

  Implement reliable HMAC verification by defining exact message and key bytes, digest algorithms, output encodings, replay controls, constant-time comparison, and tests.

  2026-09-05 · 8 min read

• IPv6 URL authorities, brackets, ports, and safe parsing

  Handle IPv6 URLs correctly by parsing bracketed host literals, ports, canonical forms, zone identifiers, proxies, allowlists, signed requests, and test fixtures.

  2026-09-05 · 8 min read

• Multipart filenames, upload parsing, and safe storage

  Handle multipart uploads safely by parsing boundaries and filename parameters, validating bytes, separating display names from storage keys, and testing clients.

  2026-09-06 · 8 min read

• JWT audience validation across gateways and APIs

  Validate JWT audiences safely by handling string and array claims, requiring exact recipient identifiers, aligning gateway profiles, and testing trust boundaries.

  2026-09-06 · 8 min read

• Idempotent SQL migrations and interrupted deploy recovery

  Design recoverable SQL migrations with explicit transactions, postcondition checks, restartable backfills, locking plans, compatibility windows, and rehearsed repairs.

  2026-09-06 · 8 min read

• Scheduler misfires, catch-up windows, and safe backfills

  Choose safe missed-run behavior by defining catch-up windows, deadlines, idempotency, ordering, concurrency, outage capacity, observability, and backfill controls.

  2026-09-06 · 8 min read

• Two's complement, bit width, and signed integer boundaries

  Interpret signed integers correctly by defining bit width, two's complement ranges, sign extension, byte order, overflow behavior, transport types, and fixtures.

  2026-09-06 · 8 min read

• CORS preflight policy, caching, and proxy behavior

  Design CORS preflight handling with exact origin policy, method and header validation, credential rules, cache bounds, proxy behavior, and browser tests.

  2026-09-07 · 8 min read

• Content Security Policy deployment with nonces and hashes

  Deploy Content Security Policy safely with directive fallbacks, per-response nonces or hashes, report collection, third-party inventories, and rollout tests.

  2026-09-07 · 8 min read

• WebSocket handshakes, proxies, and connection lifecycle

  Operate reliable WebSockets through browsers, proxies, and load balancers with correct handshakes, origin policy, timeouts, heartbeats, close codes, and tests.

  2026-09-07 · 8 min read

• Secure XML entity processing and resource limits

  Parse untrusted XML safely by controlling DTDs and entity resolution, bounding expansion and document work, isolating parsers, and validating effective data.

  2026-09-07 · 8 min read

• Timestamp precision across APIs, runtimes, and databases

  Preserve timestamp precision across JSON, runtimes, and databases by defining units, fractional digits, rounding rules, storage types, and round-trip tests.

  2026-09-07 · 8 min read

• Designing reliable JSON Schema composition

  Design predictable JSON Schema variants with oneOf, anyOf, allOf, explicit tags, non-overlapping branches, draft-aware validators, and contract fixtures.

  2026-09-08 · 8 min read

• Bearer token handling across proxy boundaries

  Carry Bearer authentication safely across browsers, redirects, proxies, and services with explicit trust ownership, bounded headers, redacted logs, and tests.

  2026-09-08 · 8 min read

• Streaming Base64 without corrupting byte boundaries

  Stream Base64 safely by carrying incomplete byte groups, separating transport chunks from messages, bounding memory, and verifying exact byte round trips.

  2026-09-08 · 8 min read

• SQL temporal types and timezone-safe data contracts

  Model SQL dates, local times, and instants safely by defining temporal meaning, session zones, driver mappings, DST policy, precision, and round-trip tests.

  2026-09-08 · 8 min read

• Container query architecture for reusable components

  Build container-query components with explicit boundaries, named containers, stable sizing, cascade-aware styles, progressive fallbacks, and layout tests.

  2026-09-08 · 8 min read