Journal
The IO Tools Journal
Guides, deep dives and field notes on the tools, formats and protocols developers use every day.

CryptographyFeatured
The Playfair cipher: why pairing letters actually worked
Caesar, Atbash and ROT13 all fall to counting letters. Playfair's one change — encrypting two letters at a time instead of one — was enough to make that attack useless. Here's the grid, the rules, and where it still breaks.
Sep 5, 2026·7 min

Cryptography
The Vigenère cipher: the code that called itself unbreakable
Sep 2, 2026 · 7 min

Databases
UUID versions explained: v4, v7, and ULID
Sep 1, 2026 · 4 min

Configuration
YAML vs JSON vs TOML: which config format should you actually use?
Sep 1, 2026 · 3 min

Databases
Snowflake IDs: how Twitter and Discord pack a sortable ID into 64 bits
Aug 31, 2026 · 8 min

Naming
Fáfnir, Smaug and Ao Guang Are Not the Same Kind of Name
Aug 24, 2026 · 5 min

Naming
Almost Every Dwarf Name You Know Comes From One Norse Poem
Aug 24, 2026 · 6 min

Naming
Harry Potter Names Are Latin Homework in a Cloak
Aug 24, 2026 · 5 min

Naming
How Japanese Names Actually Work (And Why the Order Flipped Back)
Aug 24, 2026 · 6 min

Naming
Skyrim Names by Race: What Actually Makes a Nord, Elf, or Khajiit Name Sound Right
Aug 24, 2026 · 6 min

Naming
Where Surnames Come From (And Why Yours Is Newer Than You Think)
Aug 24, 2026 · 6 min

Sports
Beyond batting average: unlocking advanced baseball stats
Aug 10, 2026 · 6 min

Gardening
DIY landscaping: accurate area calculations for your garden
Aug 10, 2026 · 5 min

Encoding
The hidden language of computers: how text-to-ASCII/binary conversion powers every digital interaction
Aug 10, 2026 · 5 min

DNS
DNSChecker.org Alternative: DNS + IP Lookup vs. a Propagation Checker
Aug 3, 2026 · 6 min

JSON
JSONFormatter.org Alternative: A JSON Toolkit vs. One Generic Formatter
Aug 3, 2026 · 5 min

Unit Conversion
UnitConverters.net Alternative: Purpose-Built Converters vs. One Sprawling Hub
Aug 3, 2026 · 8 min

Writing Tools
WordCounter.net Alternative: A Word Counter vs. a Writing Workbench
Aug 3, 2026 · 7 min

Games
5 fun games you can play with a yes/no randomizer
Aug 2, 2026 · 12 min

Career
6 developer skills worth building in 2026 ("learn AI" is not one of them)
Aug 2, 2026 · 12 min

SEO
Automated OG image generation: dynamic social cards, with or without a screenshot API
Aug 2, 2026 · 8 min

Security
Content Security Policy: writing a CSP header that actually works
Aug 2, 2026 · 10 min

css
Debugging CSS gradients: muddy midpoints, banding, and rotated angles
Aug 2, 2026 · 8 min

Security
OTP codes and 2FA: how TOTP actually works, and where it stops protecting you
Aug 2, 2026 · 8 min

Parenting
Choosing a baby name: the checks worth running before you commit
Aug 2, 2026 · 9 min

Browsers
Six lesser-known browsers worth installing, and what each one costs you
Aug 2, 2026 · 11 min

Markdown
Markdown vs HTML for docs: READMEs, API reference, and where each one breaks
Aug 2, 2026 · 8 min

Education
Teaching with a random animal generator: five classroom activities that hold up
Aug 2, 2026 · 9 min

Regex
Regex cheat sheet: how to read a pattern you didn't write
Aug 2, 2026 · 12 min

CSS
RGBA colors: the alpha channel is a mix ratio, not a dimmer switch
Aug 2, 2026 · 9 min

Cryptography
ROT13: the encoder/decoder that was never trying to be encryption
Aug 2, 2026 · 6 min

Unicode
The evolution of emoji: from 176 pictograms to a composable writing system
Aug 2, 2026 · 9 min

AI
The future of AI in content creation is human editorial review
Aug 2, 2026 · 10 min

Design
Turn typed text into handwriting: what works, and what gives it away
Aug 2, 2026 · 8 min

Databases
Understanding ULID: what those 26 characters actually encode
Aug 2, 2026 · 6 min

Dates
1735689600 is a date: how to read and convert Unix timestamps
Aug 2, 2026 · 7 min

Writing
A random animal generator is a creative constraint: roll a pangolin, get a character
Aug 2, 2026 · 9 min

Databases
UUID vs ULID vs CUID2: which unique ID should you use?
Aug 2, 2026 · 9 min

Linux
chmod explained: Linux file permissions without the cargo cult
Jul 21, 2026 · 2 min

Networking
CIDR subnets explained: read the slash, find the range, stop guessing
Jul 21, 2026 · 5 min

Docker
Container graceful shutdown: SIGTERM is the beginning, not the shutdown
Jul 21, 2026 · 1 min

HTTP
Content-Type and MIME types: what the header controls and why charset breaks JSON parsers
Jul 21, 2026 · 1 min

CSS
CSS color formats: hex, RGB, HSL, and OKLCH
Jul 21, 2026 · 1 min

CSS
CSS container queries: responsive components that finally don't care about the viewport
Jul 21, 2026 · 1 min

APIs
Cursor vs offset pagination: choose based on data movement, not taste
Jul 21, 2026 · 2 min

Databases
Database connection pooling: why your app crashes at 100 users
Jul 21, 2026 · 2 min

DNS
DNS records for developers: the records you actually configure
Jul 21, 2026 · 1 min

Docker
Docker ENTRYPOINT vs CMD: your container lied to you
Jul 21, 2026 · 1 min

Docker
Docker multi-stage builds: shrink your image without breaking the deploy
Jul 21, 2026 · 2 min

Security
dotenv mistakes: secrets, GitHub, and the leak you cannot delete
Jul 21, 2026 · 1 min

Security
Env files and secrets management: `.env` is configuration, not a vault
Jul 21, 2026 · 2 min

Deployments
Feature flags done right: patterns that do not become permanent debt
Jul 21, 2026 · 2 min

Git
Git bisect: find the breaking commit without guessing
Jul 21, 2026 · 1 min

Git
Git interactive rebase: squash, reorder, and rewrite commits before they hit main
Jul 21, 2026 · 2 min

GitHub Actions
GitHub Actions secrets: inject configuration without leaking it to logs
Jul 21, 2026 · 2 min

GraphQL
GraphQL schema SDL: how to read the contract before you write resolvers
Jul 21, 2026 · 1 min

APIs
gRPC and Protocol Buffers: what `.proto` files compile to and why it matters
Jul 21, 2026 · 4 min

HTTP
Gzip, Brotli, and Zstd: HTTP compression without accidental identity encoding
Jul 21, 2026 · 3 min

HTTP
HAR files: the HTTP debug log you didn't know you needed
Jul 21, 2026 · 2 min

Security
Hashing algorithms: MD5, SHA-2, bcrypt, and Argon2 are not interchangeable
Jul 21, 2026 · 4 min

HTTP
HTTP/2 vs HTTP/3: what changed for your API and what did not
Jul 21, 2026 · 3 min

APIs
Idempotency in APIs: make retries safe before the network makes them necessary
Jul 21, 2026 · 3 min

JavaScript
JavaScript memory leaks: the reference that won't die and how to find it
Jul 21, 2026 · 4 min

JSON
jq one-liners: filter and transform JSON without writing a script
Jul 21, 2026 · 3 min

TypeScript
JSON to TypeScript interfaces: the generated type is a guess, not a contract
Jul 21, 2026 · 3 min

jwt
JWT decoder online: decode a JWT token without mistaking it for verification
Jul 21, 2026 · 2 min

Make
Makefiles for developers: a command interface, not a second language
Jul 21, 2026 · 3 min

Documentation
Mermaid diagrams in Markdown: architecture views that survive code review
Jul 21, 2026 · 3 min

CSS
Modular type scales in CSS: pick a ratio, then check it against real copy
Jul 21, 2026 · 2 min

Security
OAuth 2.0 flows: authorization code with PKCE, and client credentials
Jul 21, 2026 · 3 min

CSS
OKLCH and modern CSS colors: why your palette looks off in some browsers
Jul 21, 2026 · 3 min

SEO
Open Graph tags: stop your links looking terrible on Slack
Jul 21, 2026 · 2 min

APIs
OpenAPI and Swagger spec validation: catch contract bugs before clients do
Jul 21, 2026 · 3 min

QR Codes
QR codes are just URLs in a trench coat (and what else is in there)
Jul 21, 2026 · 3 min

JavaScript
Regex patterns every developer should know (and the traps beside them)
Jul 21, 2026 · 3 min

AWS
S3 presigned URLs: direct uploads without handing the browser AWS credentials
Jul 21, 2026 · 8 min

npm
Semantic versioning and package.json: versions only work if you mean them
Jul 21, 2026 · 3 min

Logging
Server access logs: the fields that make an incident solvable
Jul 21, 2026 · 3 min

SQL
SQL EXPLAIN query plans: read what the database actually did
Jul 21, 2026 · 3 min

SQL
SQL indexes: why your query is slow even after you added one
Jul 21, 2026 · 3 min

ssh
SSH keys explained: Ed25519 vs ECDSA vs RSA, and the config that stops key roulette
Jul 21, 2026 · 3 min

TLS
SSL/TLS certificates: what those fields and expiry dates actually mean
Jul 21, 2026 · 3 min

Observability
Structured logging: stop console-logging strings and start logging JSON
Jul 21, 2026 · 3 min

Unicode
UTF-8 and Unicode: why that emoji broke your database
Jul 21, 2026 · 3 min

Security
Webhook signature verification with HMAC: verify the bytes before you parse
Jul 21, 2026 · 3 min

Web
WebSockets vs SSE vs long polling: pick the smallest real-time tool
Jul 21, 2026 · 3 min

Security
Why `Pssword1!` is not actually secure
Jul 21, 2026 · 3 min

xml
XML is not dead: read it, diff it, and convert it to JSON without losing meaning
Jul 21, 2026 · 2 min

Databases
Zero-downtime database migrations: schema changes without the 3am rollback
Jul 21, 2026 · 3 min

Cryptography
AES encryption modes: GCM vs CBC, and why the choice isn't cosmetic
Jul 20, 2026 · 4 min

Cryptography
BIP39 seed phrases: what those 12 words actually are and how HD wallet derivation works
Jul 20, 2026 · 4 min

Web
CORS explained: why the browser blocks your request and what to actually do about it
Jul 20, 2026 · 4 min

Git
Git hooks: pre-commit, pre-push, and stopping bad code at the door
Jul 20, 2026 · 5 min

Git
git stash: more than a panic save — partial stash, named stashes, and the rest
Jul 20, 2026 · 4 min

Web
HTTP Cache-Control headers: what no-cache, no-store, and max-age actually mean
Jul 20, 2026 · 3 min

Web
localStorage vs sessionStorage vs IndexedDB vs cookies: browser storage without the 3am regret
Jul 20, 2026 · 4 min

Security
PDF signature verification: what developers need to know
Jul 20, 2026 · 5 min

APIs
Rate limiting: how to stop getting 429'd by every API you touch
Jul 20, 2026 · 4 min

SRE
99.9% uptime sounds great — until you do the downtime math
Jul 20, 2026 · 3 min

Security
SSH key types: RSA vs Ed25519 (and when ECDSA fits in)
Jul 20, 2026 · 3 min

Networking
TCP vs UDP for developers: when the protocol actually matters
Jul 20, 2026 · 4 min

TypeScript
TypeScript utility types: the ones worth memorizing and the rest
Jul 20, 2026 · 4 min

Networking
Why IPv6 ULA addresses are your network's best-kept secret
Jul 20, 2026 · 3 min

Productivity
Free online tools that will boost your productivity in minutes
Jul 5, 2026 · 2 min

Encoding
Base64 encoding, explained: what it is, what it isn't, and when to use it
Jul 2, 2026 · 2 min

Cryptography
The Caesar Cipher: the 2,000-year-old encryption that still slaps
Jun 28, 2026 · 3 min

Cryptography
The Atbash cipher: the ancient code that decodes itself
Jun 20, 2026 · 2 min

http
HTTP status codes: 404 vs 410 vs 301
Apr 24, 2026 · 2 min

cron
Cron expressions: calculate the next run before trusting the schedule
Apr 21, 2026 · 2 min

json
A JSON toolkit: six browser tasks that save debugging time
Apr 19, 2026 · 2 min

curl
Build curl requests without memorising every flag
Apr 16, 2026 · 1 min

docker
Docker workflow tools: generate, lint, and size containers before they ship
Apr 13, 2026 · 1 min

macos
You cannot hide a window from Zoom on macOS 15
Apr 12, 2026 · 1 min

git
gitignore: the file that saves you from committing node_modules
Apr 10, 2026 · 1 min

git
CRLF vs LF: the line-ending bug that breaks CI
Apr 9, 2026 · 1 min

webhooks
HMAC: how webhooks know you are not lying
Apr 7, 2026 · 1 min

images
PNG vs JPG vs WebP: choose the format from the image, not habit
Apr 6, 2026 · 1 min

time
Time zones are a lie: handle them as data in code
Apr 4, 2026 · 1 min

javascript
JavaScript key events: use key and code, not keyCode
Apr 3, 2026 · 1 min

css
CSS gradients: generate them visually, then ship the simple version
Mar 31, 2026 · 1 min

javascript
Whitespace bugs: trim before they wreck your day
Mar 27, 2026 · 1 min