Developer & IT

01 What Is Base64 Encoding?

Base64 is a binary-to-text encoding scheme that represents binary data using a set of 64 printable ASCII characters: uppercase A-Z (26 chars), lowercase a-z (26 chars), digits 0-9 (10 chars), and the symbols + and / (2 chars), with = used as padding. The name "Base64" directly references this 64-character alphabet.

The encoding algorithm works by processing input data in 3-byte groups (24 bits). Each 24-bit group is split into four 6-bit values, and each 6-bit value is mapped to one Base64 character. This 3-to-4 ratio is why Base64-encoded data is always exactly 33% larger than the original input — a critical consideration when embedding large images in CSS or HTML.

When Should You Use Base64?

• Data URIs: Embedding images directly in HTML/CSS to eliminate HTTP requests — src="data:image/png;base64,iVBORw0K..."
• JSON APIs: Transmitting binary data (PDF, images, certificates) inside a JSON string field
• Email (MIME): Encoding binary attachments for email transport (SMTP is text-only)
• HTTP Basic Auth: Authorization: Basic dXNlcjpwYXNz (Base64 of "user:pass")

URL-Safe Base64

Standard Base64 uses + and / characters which have special meaning in URLs. URL-safe Base64 (RFC 4648 §5) replaces + with - and / with _, and often omits the = padding. This variant is used in JWT tokens, OAuth tokens, and modern web authentication protocols like WebAuthn.

02 JWT Tokens Explained

JSON Web Tokens (JWT, RFC 7519) are a compact, URL-safe means of representing claims transferring between two parties. A JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature. Each part can be decoded independently without any secret key.

JWT Structure Deep Dive

• Header: Contains the token type and signing algorithm: {"alg":"HS256","typ":"JWT"}. Common algorithms: HS256 (HMAC-SHA256), RS256 (RSA), ES256 (ECDSA P-256).
• Payload: Contains "claims" — statements about the user and additional metadata. Registered claims: iss (issuer), sub (subject/user ID), aud (audience), exp (expiration Unix timestamp), iat (issued-at), jti (JWT ID for blacklisting).
• Signature: HMACSHA256(base64url(header) + "." + base64url(payload), secret_key). Only verifiable by the party holding the secret.

Algorithm Selection Guide

Token Storage Best Practices

localStorage is vulnerable to XSS attacks — any injected script can steal the token. HttpOnly cookies prevent JS access but are vulnerable to CSRF. The recommended pattern: store JWT in a HttpOnly; Secure; SameSite=Strict cookie which mitigates both attack vectors when used with CSRF tokens. Access tokens should expire in 15 minutes; refresh tokens in 7-30 days.

03 JSON: The Universal Data Format

JSON (JavaScript Object Notation, RFC 8259) has become the de-facto standard for data interchange on the web. It is a text-based format derived from JavaScript object literal syntax, but language-independent and supported natively in every modern programming language.

JSON Data Types

Common JSON Errors

• Trailing comma: {"a":1,} — illegal in JSON, valid in JavaScript. The #1 cause of parse errors when hand-writing JSON.
• Single quotes: {'key': 'value'} — JSON requires double quotes for both keys and string values.
• Comments: // comment — not valid in JSON. Use JSON5 or strip comments before parsing.
• Undefined/NaN/Infinity: Not representable in JSON. JSON.stringify(NaN) returns "null".
• Unquoted keys: {name: "John"} — keys must be quoted strings in JSON.

JSON Ecosystem Tools

• JSON5: Superset allowing comments, trailing commas, single quotes — useful for config files
• NDJSON: Newline-Delimited JSON — one JSON object per line, ideal for streaming and log files
• JSON Schema: Draft-07/2020-12 — validates JSON structure, types, and constraints
• JSON Path: $.store.book[0].title — XPath-like query language for JSON
• JSON Patch (RFC 6902): Standard format for describing changes to a JSON document

04 Cryptographic Hash Functions

A cryptographic hash function takes an arbitrary-length input and produces a fixed-length output (the "digest" or "hash"). A good hash function must satisfy: determinism (same input always produces same output), the avalanche effect (changing one bit flips ~50% of output bits), pre-image resistance (cannot reverse hash to find input), and collision resistance (computationally infeasible to find two inputs with the same hash).

The Hash Function Timeline

• MD5 (1992): Designed by Ron Rivest. 128-bit output. Full collision attacks demonstrated in 2004 by Xiaoyun Wang. Two different files can now be crafted with the same MD5 hash in seconds on consumer hardware. Do not use for any security purpose. Still used for non-security checksums (Docker image layers, file deduplication).
• SHA-1 (1995): NSA-designed, 160-bit. The 2017 "SHAttered" attack by Google/CWI demonstrated the first practical SHA-1 collision. Cost: ~$75,000 in cloud compute. Deprecated by all major certificate authorities and browsers since 2017.
• SHA-256 (2001): Part of the SHA-2 family designed by NSA. 256-bit output. Used in: TLS 1.3 certificates, Bitcoin proof-of-work, AWS S3 ETags, code signing (Authenticode, APK), and most modern security protocols.
• SHA-512 (2001): Also SHA-2 family. 512-bit output. Counter-intuitively, SHA-512 is faster than SHA-256 on 64-bit processors because it uses 64-bit word operations internally, while SHA-256 uses 32-bit operations requiring more rounds.
• SHA-3 / Keccak (2015): Fundamentally different "sponge" construction versus SHA-2's Merkle-Damgård. Quantum-resistant. Not yet widely deployed but standardized by NIST as a parallel option to SHA-2.

05 Secure Password Generation

Password security is fundamentally an entropy problem. Entropy — measured in bits — quantifies how unpredictable a password is. The formula is straightforward: entropy = length × log₂(charset_size). The higher the entropy, the longer a brute-force attack takes.

Why Math.random() Is Dangerous

Math.random() in JavaScript uses a pseudo-random number generator (PRNG) — specifically the xorshift128+ algorithm in V8. It is seeded and deterministic: if an attacker can observe several values from Math.random(), they can reconstruct the seed and predict all future values. This is a well-documented attack against weak random number generators.

The correct approach is crypto.getRandomValues(new Uint32Array(length)) which calls the operating system's CSPRNG (Cryptographically Secure Pseudo-Random Number Generator): /dev/urandom on Linux, CryptGenRandom on Windows. These sources use hardware entropy (CPU timing jitter, hardware random number generators on modern CPUs).

Strength Benchmarks (at 1 trillion guesses/second)

06 UUID: Universally Unique Identifiers

UUIDs (RFC 4122 / RFC 9562) are 128-bit identifiers formatted as 32 hexadecimal characters in five groups separated by hyphens: xxxxxxxx-xxxx-Mxxx-Nxxx-xxxxxxxxxxxx. The M digit indicates version and N indicates variant.

UUID Versions Compared

• v1 (Time + MAC): Encodes timestamp and network MAC address. Sortable but leaks the generating machine's MAC address — a privacy risk that led to v4.
• v3 (MD5 Name-based): Deterministic UUID from a namespace + name using MD5. Same inputs always produce the same UUID.
• v4 (Random): 122 bits of randomness. The most widely used variant. crypto.randomUUID() in modern browsers.
• v5 (SHA-1 Name-based): Same as v3 but using SHA-1. Preferred over v3.
• v7 (RFC 9562, 2024): Time-ordered monotonically increasing UUID. First 48 bits = Unix timestamp milliseconds. Dramatically better for database primary keys as they maintain B-tree locality (no page splits like random v4).

ULID — The Modern Alternative

ULID (Universally Unique Lexicographically Sortable Identifier) offers 26-character Base32 encoding, millisecond timestamp precision, and URL-safe output — with no hyphens. Like UUID v7, it is monotonically sortable. Format: 01ARZ3NDEKTSV4RRFFQ69G5FAV. Increasingly preferred for modern distributed systems.

07 IPv4 Subnetting & CIDR

IPv4 addresses are 32-bit numbers, typically written in dotted-decimal notation (e.g. 192.168.1.0). CIDR (Classless Inter-Domain Routing, RFC 4632, 1993) replaced the original classful addressing system and enabled efficient allocation of IP space by allowing arbitrary prefix lengths.

IPv4 Address Classes (Historical)

• Class A (/8): 1.0.0.0 – 126.255.255.255 — 16.7 million hosts per network. 127.x.x.x reserved for loopback.
• Class B (/16): 128.0.0.0 – 191.255.255.255 — 65,534 hosts per network
• Class C (/24): 192.0.0.0 – 223.255.255.255 — 254 hosts per network
• Class D: 224.0.0.0 – 239.255.255.255 — Multicast

Private Address Ranges (RFC 1918)

• 10.0.0.0/8 — 16,777,214 usable hosts (large enterprises)
• 172.16.0.0/12 — 1,048,574 usable hosts (medium networks)
• 192.168.0.0/16 — 65,534 usable hosts (home/small office)
• 169.254.0.0/16 — APIPA (Automatic Private IP Addressing, link-local)
• 127.0.0.0/8 — Loopback (only 127.0.0.1 is commonly used)

Subnet Math Reference

08 Binary, Octal, Decimal, and Hexadecimal

Computers operate exclusively in binary (base-2) at the hardware level. Higher-level number systems like decimal (base-10) and hexadecimal (base-16) are abstractions for human convenience. Understanding all four systems is fundamental to low-level programming, networking, permissions, and debugging.

Why Hexadecimal?

Hexadecimal is so pervasive in computing because each hex digit exactly represents 4 binary bits (a "nibble"). This means one byte (8 bits) is always exactly 2 hex digits. FF hex = 11111111 binary = 255 decimal. Memory addresses, color codes (#FF5733), MAC addresses (00:1A:2B:3C:4D:5E), and error codes all use hex for this compact, unambiguous representation.

Bitwise Operations

• AND (&): 1 only if both bits are 1. Used for masking: ip & mask gives the network address
• OR (|): 1 if either bit is 1. Used to set bits: permissions | 0x04
• XOR (^): 1 if bits differ. Used for toggling and simple encryption
• NOT (~): Inverts all bits. ~mask gives the wildcard mask in subnet calculations
• Left Shift (<<): Multiplies by 2^n. 1 << 8 = 256
• Right Shift (>>): Divides by 2^n. Used for extracting octets from an IP integer

Unix File Permissions (Octal)

Unix chmod permissions are expressed in octal. Each permission digit (0-7) encodes read (4), write (2), execute (1) in 3 bits. chmod 755 = owner: rwx (7=111), group: r-x (5=101), others: r-x (5=101). chmod 644 = owner: rw- (6=110), group: r-- (4=100), others: r-- (4=100). Understanding this requires knowing octal-to-binary conversion.

09 URL Encoding vs Base64

Both URL encoding and Base64 convert data to safe ASCII representations, but for fundamentally different purposes and contexts. Confusing the two is a common source of bugs.

JavaScript Encoding Functions

• encodeURIComponent() — encodes everything except A-Z a-z 0-9 - _ . ! ~ * ' ( ). Use for query parameter values.
• encodeURI() — preserves URI structure characters (: / ? # [ ] @ ! $ & ' ( ) * + , ; =). Use for complete URLs.
• btoa() / atob() — Base64 encode/decode. Fails on characters outside Latin-1. Use TextEncoder for Unicode.

10 Regular Expressions

Regular expressions (regex) are a domain-specific language for describing text patterns. They are implemented in virtually every programming language and are an essential tool for data validation, text transformation, and parsing. The syntax originates from formal language theory, specifically the theory of regular languages.

Core Regex Components

• Literals: Match exactly — cat matches the string "cat"
• Character classes: [aeiou] matches any vowel. [^aeiou] matches any non-vowel. . matches any character (except newline by default)
• Shorthand classes: \d (digit), \w (word char: [a-zA-Z0-9_]), \s (whitespace), and their uppercase negations \D, \W, \S
• Quantifiers: * (0 or more), + (1 or more), ? (0 or 1), {n} (exactly n), {n,m} (n to m). Add ? after for lazy/non-greedy: +?
• Anchors: ^ (start of string/line), $ (end), \b (word boundary), \B (non-word boundary)
• Groups: (pattern) capturing group, (?:pattern) non-capturing, (?P<name>pattern) named group

11 Cron Job Scheduling

Cron is a time-based job scheduler originating in Unix (AT&T Bell Labs, circa 1979). The name derives from Chronos, the Greek god of time. It remains the most widely used scheduling mechanism for server-side task automation, running from simple database backups to complex ETL pipelines.

Field Reference

Common Patterns

• */5 * * * * — Every 5 minutes
• 0 2 * * * — 2:00 AM daily (e.g. database backup)
• 0 9 * * 1-5 — 9:00 AM Monday–Friday (business hours jobs)
• 0 0 1 * * — Midnight on the 1st of every month (monthly reports)
• 0 */6 * * * — Every 6 hours (health checks)
• 30 23 * * 5 — 11:30 PM every Friday (weekly maintenance)

12 The Web Crypto API

The Web Cryptography API (window.crypto.subtle) is a browser-native cryptographic interface providing access to common cryptographic operations without any external library. It is available in all modern browsers (Chrome 37+, Firefox 34+, Safari 11+) and Node.js 15+. All operations are Promise-based and asynchronous, and the implementation is typically FIPS 140-2 compliant.

Key Capabilities

• Hashing: SHA-1, SHA-256, SHA-384, SHA-512 via crypto.subtle.digest()
• HMAC: Message authentication with SHA-256/512
• AES-GCM: Authenticated symmetric encryption (256-bit key)
• RSA-OAEP: Asymmetric encryption
• ECDH: Elliptic-curve Diffie-Hellman key exchange
• ECDSA: Digital signatures (P-256, P-384, P-521)
• PBKDF2 / HKDF: Key derivation functions

13 Developer Security Best Practices

The OWASP Top 10 2021 identifies the most critical web application security risks. Three dominate developer-caused vulnerabilities:

• A01 — Broken Access Control: 94% of applications had some form of broken access control. Always enforce permissions server-side. Never rely on hiding UI elements.
• A02 — Cryptographic Failures: Formerly "Sensitive Data Exposure". Using MD5/SHA-1 for passwords, transmitting data over HTTP, storing secrets in source code.
• A03 — Injection: SQL injection, command injection, XSS. Always use parameterized queries. Never concatenate user input into queries or HTML.

Essential Security Headers

• Content-Security-Policy: Prevents XSS by allowlisting trusted script/style sources
• X-Content-Type-Options: nosniff — Prevents MIME-type sniffing attacks
• Strict-Transport-Security: max-age=31536000; includeSubDomains — Enforces HTTPS for 1 year
• X-Frame-Options: DENY — Prevents clickjacking via iframes
• Permissions-Policy: Restricts access to browser APIs (camera, microphone, geolocation)

Secrets Management

• Never hardcode secrets in source code (API keys, passwords, tokens). Use environment variables.
• Rotate secrets regularly. Assume any secret that touches a developer machine is compromised.
• Use secret managers: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, GCP Secret Manager.
• Scan commits for secrets: git-secrets, GitGuardian, Trufflehog. Every public GitHub repo is scanned by bots within minutes of a push.

14 Frequently Asked Questions

15 Related Calculators & Tools

Explore our full suite of professional calculators — all free, private, and running entirely in your browser.