Developer Blog

Markdown to Word: Native Style Mapping and the Inline-Format Downgrade List

Turning a Markdown draft into a deliverable .docx: pandoc CLI vs in-browser local conversion, how headings/tables/code blocks map to native Word styles, which inline formats degrade to plain text, and why 'editable' beats 'looks right'.

px, rem, em: What Each CSS Unit Actually Answers, and How to Convert Without Surprises

The boundary between px, rem, and em (root-relative vs parent-relative), the px-to-rem formula and size table, the 62.5% trick's hidden costs, the Safari media-query rem trap, and browser minimum font size — with an online converter.

VIN Check Digit Explained: How to Calculate and Validate Position 9

How the VIN check digit works: 17-character structure (WMI/VDS/VIS), the transliteration and weight tables, a worked mod-11 example, the 30-year model-year code, and the four most common validation failures. Includes an online VIN validator.

Word to Markdown: Two Clean Paths and What Survives the Conversion

How to convert .docx to Markdown cleanly: pandoc CLI vs in-browser local conversion, a format fidelity table for headings/tables/images/auto-numbering, and fixes for the .doc legacy format, image bloat, and merged-cell tables.

PDF to JPG: How to Pick the Right Resolution (DPI Guide + 3 Ways)

A complete guide to converting PDF pages to JPG: how DPI maps to sharpness, two-page and batch conversion, three approaches compared (in-browser local, command line, desktop software), plus a quality settings cheat sheet.

PDF Too Large for Email? How to Choose the Right Compression Quality (3 Local Levels)

How PDF compression works: lossy rasterization vs. lossless structure optimization, which of the three quality levels fits which use, and how to compare sizes before and after — entirely in your browser.

China License Plate Rules and Validation: Standard, New Energy, and Special Formats Explained

Mainland China plate encoding rules in full: the standard blue plate, the GA36D-2018 new-energy format, armed police and embassy plates, province abbreviations and issuing-authority letters — with an online validator.

How to Split a PDF and Extract Pages: Range Syntax, Common Cases, and a Local Workflow

A complete guide to splitting PDFs by page range: the 1-3,5 range syntax, page-by-page extraction, and split-then-merge workflows — all in your browser, nothing uploaded.

How to Merge PDFs: 3 Ways Compared (Local, CLI, Desktop)

Three ways to merge PDF files: in-browser local merging, the qpdf command line, and desktop software. Covers page-ordering tricks, encrypted-file handling, and how to verify a tool never uploads anything.

Test Data Compliance Boundary: Why Copying Real User Data Into Test Environments Is Already Illegal

Using real user data in test environments violates purpose limitation under PIPL and GDPR: testing is a brand-new processing purpose. The four legal alternatives (anonymization/synthetic/public test ranges/hand-made), how format-valid-but-random works (national checksum standards), and the red-line list. With checksum algorithm tables for CN IDs, phones, and credit codes.

Incomplete HTTPS Certificate Chain: Browser Distrusts a “Valid” Leaf

Leaf dates and SAN look fine, but clients still reject the cert? Usually a missing intermediate or misordered fullchain. Verify Issuer→Subject with openssl s_client and a local decoder.

JWT exp/nbf Clock Skew: Seconds vs Milliseconds, Leeway, and “Expired on Issue”

When JWT verification says Token expired or used before issued, check NumericDate units (seconds vs ms), NTP, and 30–60s leeway. Use the on-site decoder timeline and alg=none warning — and separate TLS cert failures from app-token 401s.

JSON Integer Precision Trap: When Snowflake IDs Are Silently Rewritten

JSON numbers beyond 2^53-1 are rounded by JSON.parse. Compare naive formatters with a lossless path, and cross-link JWT, Base64, and this site’s JSON tools.

Base64 vs Base64URL: Padding, JWT Segments, and PEM Line Wraps

Standard Base64 and Base64URL differ in alphabet and padding. Learn how JWT’s three segments use Base64URL, why PEM wraps at 64 characters, and how to stop decode failures when tools disagree.

HTTP Status Codes Reference: Quick Lookup Guide

Complete HTTP status code reference. Understand 1xx, 2xx, 3xx, 4xx, 5xx categories, common scenarios, and correct usage in API development.

Online CSS Minifier: Reduce CSS File Size for Better Performance

Learn how to minify CSS safely: whitespace, comments, hex shortening, zero-unit elision, calc protection, and UTF-8 byte savings — with an online tool you can use locally.

Complete Guide to HTTP API Testing: From Basics to Advanced Debugging Techniques

Master the core skills of HTTP API testing, including GET/POST/PUT/DELETE requests, header configuration, request body formats, authentication methods, and debugging techniques. Boost your development efficiency with an online API testing tool.

What Is GEO? Generative Engine Optimization: The New Traffic Frontier of AI Search

GEO (Generative Engine Optimization) is to AI search what SEO is to Google — when ChatGPT, Perplexity, and Google's AI Overviews answer questions directly, users stop clicking links, and being cited by AI becomes the new traffic entry. This post breaks down the four essential differences from SEO, the four core practices (crawlability, structure, citability, fact density), and real GEO data from a working tool site.

llms.txt, Explained: A Site Manual for LLMs — and Whether Yours Deserves One

llms.txt is a 2024-proposed markdown file at your site root that tells large models what's worth reading. This post breaks down the spec structure (H1 + summary + tiered links), how it divides labor with robots.txt and sitemap, multi-file digests (zh / full), common failure modes, and a real auto-generated implementation — with a skeleton and annotation recipes you can copy.

Allow or Block AI Crawlers: GPTBot, ClaudeBot, PerplexityBot — a robots.txt Decision Guide

Training crawlers and search crawlers are different agents — blocking GPTBot does not remove you from ChatGPT Search. A crawler-by-crawler table aligned with this site's robots.txt generator AI preset, a three-type decision framework, copy-paste rules, and how to measure payoff after allowing.

Post-Quantum Migration Self-Check: From Algorithm Inventory to Hybrid TLS — 12 Things to Do in 2026

A practical self-check framework for PQC migration: why three overlapping regulatory timelines make 2026 the starting line, how to build a cryptographic bill of materials (CBOM), ranking by HNDL exposure, enabling X25519+ML-KEM hybrid TLS, and what crypto-agility means in practice. With a 12-item checklist.

PIPL PIA Self-Check: The Five Triggering Scenarios, Three Assessment Elements, and a Working Framework

China's Personal Information Protection Law (Articles 55-56) requires a prior Personal Information Protection Impact Assessment (PIA) for five categories of processing. This post covers the triggers, the statutory three-element report structure, the three-year retention requirement, and a data-map → risk-matrix → controls framework. With the MLPS/miping/PIA three-pillar relationship.

Passkeys, Explained: Why the Server Can No Longer Hold a Copy of Your Password

Passkeys (WebAuthn/FIDO2) deepened: registration vs assertion ceremonies, platform authenticators and roaming keys, synced passkeys, how they relate to passwords/TOTP/JWT, and why origin binding makes phishing resistance structural. Servers store public keys only; note that this site has no dedicated Passkey tool page.

MLPS 2.0 (China's Cybersecurity Multi-Level Protection Scheme) Self-Check: GB/T 22239, Layer by Layer

A practical self-check framework before China's MLPS level-protection evaluation (dengbao ceping): the filing workflow, high-frequency items across the five technical and five management layers, level-2 vs. level-3 differences, how MLPS relates to the cryptographic assessment (miping), and a remediation order ranked by points-per-effort.

ML-KEM, Explained: How Kyber Got Into Your TLS Handshake

An engineering tour of ML-KEM (FIPS 203, formerly Kyber): Kyber-to-standard naming, encapsulate/decapsulate and IND-CCA, the three parameter sizes, how X25519+ML-KEM feeds the TLS 1.3 HKDF schedule, the ClientHello-bloat middlebox trap, OpenSSL 3.5 / nginx enablement, and browser-side implementation boundaries.

Miping × Post-Quantum: A Dual-Stack Assessment Framework for Chinese Compliance Systems

SM2's elliptic-curve foundation sits on Shor's list right next to RSA — Chinese cryptographic compliance carries no quantum exemption. This post lays out a dual-stack evaluation framework on top of miping (GB/T 39786): an algorithmic quantum-exposure inventory, parallel TLCP + hybrid TLS deployment, dual protection for long-lived data, and where the domestic standards process currently stands. A forward-looking guide for compliance teams and critical-infrastructure operators.

HKDF: How TLS 1.3 Grows One Shared Secret Into a Whole Key Tree

A TLS handshake yields one shared secret (or two concatenated in a hybrid group), but a session needs dozens of keys: bidirectional write keys, IVs, per-stage Finished keys, exporters, resumption PSKs. HKDF (RFC 5869) does that job in Extract + Expand. This post covers structure, salt/info domain separation, boundaries with HMAC and PBKDF2, and common misuses.

Harvest Now, Decrypt Later: Whose Data Needs Post-Quantum Crypto First

The HNDL attack model, taken apart: why Shor's algorithm kills RSA/ECC while AES-256 stays standing, how data lifetime sets migration priority, which systems can relax, and how Chinese cryptographic compliance (SM/TLCP) and PQC stack rather than compete.

China Generative AI Filing Checklist: Algorithm Registration vs. Large-Model Launch Filing

Offering generative AI services to the public in China means passing two filings: the algorithm registration under the Deep Synthesis Provisions and the large-model launch filing under the Interim Measures for Generative AI Services. This post maps the trigger conditions, the materials framework, the corpus and security-assessment pain points, and a self-check order. Practical guidance; always defer to the latest CAC templates.

Why Ed25519 Won: Deterministic Signatures and ECDSA's k-Leak Incident History

ECDSA tripped over the same trap three times in fifteen years (Sony PS3's fixed k, Android Bitcoin wallets' weak randomness, the RFC 6979 patch). Ed25519 eliminates that entire class of failure by design. This post breaks down EdDSA's engineering advantages: no randomness dependence, a fixed curve, hard-to-misuse implementations, tiny keys and signatures — and the fact that it won on engineering properties, not mathematical strength.

Chinese Cryptographic Assessment (Miping) Self-Check Checklist: GB/T 39786, Layer by Layer

A pre-assessment framework for commercial cryptography application security evaluation: the four technical layers (physical, network, device, application) plus management, the quantitative red lines (algorithm/product/key compliance), the most common findings, and a remediation order ranked by points-per-effort.

ID Photo Size Guide: What 1-Inch and 2-Inch Really Mean, Plus Exam Registration Scenarios

The 1-inch 25×35mm vs 2-inch 35×49mm reference with pixel conversions, background-color conventions (white/blue/red) for certificates and exams, and the full workflow from phone photo to compliant ID picture — including JPG export and file-size boundaries.

HEIC to JPG: The Complete Guide — Why Systems Reject iPhone Photos and Three Ways Through

The root cause behind format-not-supported errors on exam registrations, visa uploads and government portals: what HEIC is, why legacy systems only accept JPG, and the trade-offs between capture settings, transfer-time conversion, and after-the-fact conversion — plus orientation, naming, and failure triage.

Guomi HTTPS Deployment Guide: TLCP Protocol, SM2 Dual Certificates, and nginx with Tongsuo

Guomi HTTPS under assessment / MLPS pressure: TLCP (GB/T 38636) vs RFC 8998, how signing and encryption certificates differ, building nginx with Tongsuo, dual-stack coexistence, handshake troubleshooting order, and what browser SM tools can and cannot prove.

GB/T 32907, GM/T 0004, RFC 8998: Decoding the Standard Numbers Behind SM2/SM3/SM4

A decoder ring for Chinese national crypto standard numbers: GM/T vs GB/T vintages, ISO/IEC adoption, RFC 8998 ShangMi suites versus the TLCP (GB/T 38636) track, and which number each project document should cite.

Linux Crontab in Practice: Commands, Logs, and Debugging

Crontab beyond syntax: three must-know commands, /etc/cron.d vs user crontabs, five-step debugging, PATH/timezone/% escaping, MAILTO, and what to do when you need second-level scheduling.

SM2/SM3/SM4 in Practice: Choosing, Integrating, and Debugging Chinese National Cryptography

A field guide to Chinese national crypto: SM4 vs SM3 vs SM2, plus the integration traps that dominate real work — C1C3C2 vs C1C2C3, hex vs Base64, CBC IVs — with browser-local tools for known-answer checks.

The Complete Guide to PDF Tools: Merge, Split, Compress, and Convert — All in Your Browser

Everything you need to work with PDF files without uploading them: when to merge vs split, how PDF compression actually works, converting PDF to JPG and back, and why browser-local processing matters for contracts and ID documents.

Image Formats Explained: JPG, PNG, WebP, HEIC, and SVG — Which One, When, and How to Convert

A practical guide to choosing image formats: what JPG, PNG, WebP, HEIC and SVG are actually good at, when compression hurts, why transparency changes everything, honest boundaries of browser converters, and how to convert without stacking damage.

SHA-256 Hash Algorithm: How It Works, Applications, and Online Tools

Understand SHA-256 internals, comparison with MD5/SHA-1, and real-world applications in password storage, blockchain, file integrity, and HMAC signing.

Regex Not Matching? Troubleshoot These 6 Common Pitfalls

How to troubleshoot when a regex doesn't match or matching fails? This article walks through 6 common pitfalls — greedy quantifiers, missing flags, unescaped special chars, lookaround assertions, newline handling, and Unicode properties — with before/after examples to help you quickly locate regex debugging issues.

PGP Encryption Complete Guide: Protect Your Private Communications

Learn PGP / OpenPGP hybrid encryption, how to verify public-key fingerprints, and how a browser PGP-style tool differs from GnuPG mail interop.

Complete Guide to MD5 Hash: How It Works, Uses, and Security

Deep dive into the MD5 algorithm, its common uses, and security vulnerabilities. Learn the differences between MD5, SHA-1, and SHA-256, and when MD5 is still okay to use.

JSON Parse Error 'Unexpected token'? 5 Common Causes and How to Fix Them

Getting a JSON parse error 'Unexpected token'? This article covers the 5 most common causes of JSON format errors — trailing commas, single quotes, unescaped characters, BOM headers, and comments — with fixes and code examples for each.

HTTP GET vs POST: When to Use Each? Semantics, Safety, and Best Practices

GET vs POST semantics, idempotency, caching, URL length limits, security tradeoffs, REST conventions, and common mistakes. Includes curl examples and a decision table for picking the right method.

What is a Hash Collision? MD5 and SHA-256 Security Deep Dive

Hash collisions explained: birthday attacks and the birthday bound, identical-prefix vs chosen-prefix, MD5/SHA-1 status in 2026, and how HMAC changes the threat model.

Online CSV to SQL Tool: Import Tabular Data into Databases

CSV to INSERT with empty cells → NULL, MySQL backticks or PostgreSQL quotes, BOM stripping, Markdown pipe escaping, and when to switch to COPY/LOAD instead.

Online Base64 to Image Converter: Decode Base64 Strings to Image Files

Learn how to convert Base64 encoded strings back to image files. Understand Base64 decoding principles, common image MIME types, and real-world Web development use cases.

Why Does Base64 Make Files 33% Larger? Encoding Overhead Explained

Base64 size increase is ~33%: every 3 bytes become 4 characters. Worked examples for Hi, Hello, and 1MB files, plus when the overhead matters.

Base64 Encoding Explained: Unicode, URL-Safe Variants, and Size Increase

Understand Base64 encoding internals, why Base64 size increase is ~33%, Unicode-safe Chinese/Emoji handling, and URL-safe variants for web development.

ASCII vs Unicode vs UTF-8: Character Encoding Finally Explained

ASCII has 128 characters, Unicode covers 140k+, UTF-8 is Unicode's variable-length encoding. Learn the difference, byte vs character length, and why most encoding bugs happen.

SM3 vs SHA-256: Comparing the Chinese and NIST Hash Algorithms

SM3 versus SHA-256: same 256-bit digest strength, structural similarities (Merkle-Damgård), the standard test vectors for integration debugging, hardware acceleration differences, when Chinese compliance mandates SM3, and HMAC's algorithm-agnostic construction.

SM2 vs RSA: How to Choose Between Chinese and International Public-Key Crypto

SM2 versus RSA compared: security strength (256-bit SM2 ≈ 3072-bit RSA), performance (signing vs verification tradeoffs), key sizes, the C1C3C2/C1C2C3 ciphertext format pitfall, Chinese compliance requirements, and how to verify with an online SM2 tool.

Chinese National Cryptography (SM2/SM3/SM4/SM9/ZUC): A Developer's Introduction

Introduction to China's commercial cryptography: what SM2, SM3, SM4, SM9 and ZUC each do, how they map to RSA/SHA/AES, a selection decision tree, TLCP vs RFC 8998 boundaries, compliance drivers, and what browser tools can and cannot verify.

docker run to docker-compose: The Complete Migration Guide (with Flag Map)

Migrate docker run commands to docker-compose.yml: five advantages of compose over raw run, a flag-by-flag mapping table (ports, volumes, env, restart, networks), the classic pitfalls (bare -e passthrough, anonymous volumes, --rm semantics), and an online converter that runs locally in your browser.

Unexpected token '<' is not valid JSON — 5 Reasons Your API Returned HTML Instead

fetch throws SyntaxError: Unexpected token '<' when the response body is HTML, not JSON. Covers the 5 root causes: SPA history fallback returning index.html, auth 302 redirects, gateway 502 error pages, wrong baseURL, and missing res.ok checks — with curl diagnostics.

Permission denied (publickey): 6 Reasons Git Push Fails Over SSH (and the Fix for Each)

git clone or push rejected with Permission denied (publickey) fatal: Could not read from remote repository? Covers missing keygen, key not loaded in the agent, public key not added to GitHub/GitLab, multi-account key routing with ~/.ssh/config, deploy key limits, and wrong remote URLs — with ssh -v diagnostics.

npm ERR! ERESOLVE: peer dependency conflicts — the complete fix guide

npm install fails with ERESOLVE peer dependency conflicts? Understand what peer dependencies are, why npm 7+ enforces them, and 4 resolution strategies (force, legacy-peer-deps, overrides, manual) with trade-offs.

error:0308010C digital envelope routines::unsupported — Fixing Node 17+ Breakage in Older Projects

Node 17+ crashes webpack 4 builds with error:0308010C because OpenSSL 3.0 dropped MD4 from the default provider. Compare --openssl-legacy-provider, upgrading to webpack 5, and pinning an EOL Node — plus Node 22 / Next.js notes.

ECONNREFUSED: Connection Refused — 5 Causes Explained (Including Docker)

Node, Java, or curl reporting connect ECONNREFUSED 127.0.0.1:3306? It means nothing is listening on that port. Covers service not running, wrong port, 127.0.0.1-only binding, Docker container networking, and firewall REJECT rules — with ss/lsof diagnostic commands.

Docker permission denied on docker.sock: the Right Fix (and Its Security Cost)

docker commands fail with permission denied while trying to connect to the Docker daemon socket? The cause: your user isn't in the docker group. One-step fix with usermod -aG, the newgrp trick to avoid re-login, why chmod 777 is a trap, and why docker group membership equals passwordless root — plus the rootless alternative.

docker pull access denied: 5 Reasons Image Pulls Get Rejected (and the Fix)

docker pull fails with pull access denied for xxx, repository does not exist or may require docker login? Covers misspelled image names, missing tags, private registry login, Docker Hub rate limits, and registry mirrors for mainland China networks — with a one-minute triage flow.

Docker port is already allocated: Finding and Freeing the Taken Port

docker run fails with port is already allocated or bind: address already in use? The host-side port you mapped is taken — by another container's docker-proxy or a host process. How to tell the two apart, the compose project-name collision scenario, and why 127.0.0.1 and a specific IP binding can coexist.

Docker no space left on device: the Complete Cleanup Ladder, Safe to Aggressive

Docker build or run failing with no space left on device? Dangling images, stopped containers, build cache, and unbounded container logs — see exactly who eats the disk with docker system df. The prune ladder from container prune to system prune -a, the --volumes danger zone, and the log-rotation config that stops it coming back.

docker manifest unknown: 4 Reasons the Tag Can't Be Found

docker pull reports manifest for xxx:tag not found or manifest unknown? Covers tag typos, the latest-tag trap, renamed official images, and architecture mismatches (arm64/amd64 manifests) — with docker manifest inspect and the Hub Tags API for verification.

Executable File Not Found: 4 Reasons Docker Containers Exit Instantly (incl. exec format error)

Container fails with OCI runtime exec failed: executable file not found or standard_init_linux.go errors? Covers Windows CRLF breaking shebangs, ENTRYPOINT shell vs exec form, PATH and relative paths, and architecture mismatches — with docker inspect and --entrypoint debugging.

Cannot connect to the Docker daemon — 5 Reasons and How to Diagnose Each

docker ps fails with Cannot connect to the Docker daemon at unix:///var/run/docker.sock? Covers the Linux service not running, Docker Desktop not started, WSL2 integration reset, daemon.json syntax errors killing the daemon, wrong docker context, and missing rootless DOCKER_HOST — with journalctl diagnostics.

Container Name Is Already in Use: Resolving the Conflict Error

docker run fails with Conflict. The container name /xxx/ is already in use? An old container with the same name still exists — stopped containers keep their names too. Covers finding the squatter with docker ps -a, rm -f to free it, compose down for project leftovers, --rm for one-shot runs, and restart-policy resurrections.

Cannot find module: 6 Reasons Node.js Can't Find Your Module (and How to Fix Each)

Node.js ERR_MODULE_NOT_FOUND or Cannot find module errors decoded: require vs import path rules, node_modules corruption, case sensitivity, ESM/CommonJS mixing, monorepo workspaces — with fix commands for each.

Port Already in Use? The Complete EADDRINUSE Fix Guide (macOS/Linux/Windows)

Getting EADDRINUSE: address already in use or Port 3000 is already in use on startup? One set of commands to find and free the occupying process on every platform, plus prevention and the tricky cases (ControlCenter, TIME_WAIT, Docker).

npm ERR! network: How to Fix npm Install Timeouts with a Registry Mirror

Complete fix guide for npm install network failures (ETIMEDOUT, ECONNRESET, ERR_SOCKET_CONNECTION_TIMEOUT): switching to a fast registry mirror, cleaning caches, purging stale proxy configs, and the package-lock resolved-URL trap.

How to Fix 'Hydration failed / Text content does not match' in Next.js

The complete guide to Next.js/React SSR hydration errors: why server and client renders diverge, the three usual suspects (timestamps, random values, localStorage), correct suppressHydrationWarning usage, and a ClientOnly pattern for browser-only widgets.

How to Fix 'Cannot read properties of undefined (reading map)'

A complete debugging guide for the most common React runtime error: why undefined.map throws, handling async data correctly, optional chaining and default guards, empty-state rendering, and using our JSON tools to inspect the real payload.

JSON Troubleshooting Handbook: From Error Message to Fix (Symptom Index)

JSON errors that make no sense? This handbook organizes fixes by symptom — syntax errors, Unicode escaping, encoding mojibake, and Schema validation failures, with a diagnostic tree and a general debugging workflow.

Character Encoding Troubleshooting Handbook: Mojibake, URL Encoding, and Base64 Explained

Chinese turning into ??? or é”±? %E4%B8%AD unreadable? This handbook classifies by symptom — real mojibake, URL percent-encoding, Unicode escaping, and Base64 with Chinese, plus an encoding primer and a debugging workflow.

Subnetting / CIDR Explained: What Is 192.168.1.0/24 and How to Calculate

What does CIDR like 192.168.1.0/24 mean, how to get the subnet mask, how to compute usable hosts? Explains subnetting with intuitive examples, plus our CIDR / subnet calculator.

SHA256 vs MD5: What Is the Difference and Which to Use?

SHA256 vs MD5 difference, why MD5 is no longer safe, and which hash to use for file verification? Compares length, security, and use cases, with our SHA256/MD5 tools.

Regex Matches Nothing / Greedy .* Swallows Results — How to Fix

Online regex test matches nothing, or greedy .* eats too much, or groups capture nothing? Explains greedy vs lazy, escaping special chars, and anchors — with a step-by-step debug using our regex tester.

How to Generate a Styled QR Code with Custom Colors (No Third-Party Host)

Want colored modules and rounded finders? Aligned with this site's designer: what you can change, logo limits, PNG vs SVG export, density and contrast pitfalls.

Can MD5 Be "Decrypted"? What Is a Collision?

People say "MD5 decrypt" — can MD5 actually recover the original? What is a collision attack and why is it dangerous? Clears the misconceptions, with our MD5 / SHA256 tools.

JWT Decoded Shows "signature invalid" / Verification Failed — Is That Normal?

JWT decoded but shows signature invalid or verification failed? Learn the difference between decode and verify, why it fails, and when you should just read the payload vs. actually verify.

How to Convert JSON to Java Entity Class (with annotations and List nesting)

Got JSON API data and want the matching Java POJO? Learn JSON-to-Java type mapping and common annotations, and step-by-step how to generate serializable classes locally.

How to Convert JSON to Go struct (with json tags and nested types)

Have a JSON API response and want the matching Go struct? Learn the JSON-to-Go type mapping rules and step-by-step how to generate code with json tags locally.

JSON Schema Reports "required" Property Missing — How to Locate and Fix

JSON Schema validation says a required property is missing, or type mismatch? Explains required / additionalProperties / type pitfalls and how to locate the exact level with our validator.

JSON Shows Chinese as \uXXXX Escapes After Formatting — How to Get Readable Text Back

Why does formatted JSON turn Chinese into \uXXXX Unicode escapes, and how do you convert it back to readable text? Explains the cause and shows a one-click fix, all processed locally in your browser.

HTML Table to JSON: How to Preserve Rows, Columns and Structure

Converting an HTML table from a web page to JSON — how to keep headers, handle merged cells and nested structure? Step-by-step with our HTML table to JSON tool.

How to Verify File or Text Hashes Match (SHA-256 Comparison for Integrity)

Downloaded a file—how do you know it wasn't tampered with? Learn how hash verification works and step-by-step how to compare SHA-256/MD5 locally to confirm integrity.

Excel to JSON: Dates Become Numbers / Chinese Garbled — Fix

When converting Excel to JSON, dates turn into numbers like 44927, Chinese is garbled, empty cells vanish? Explains Excel serial dates and encoding pitfalls, with our Excel to JSON tool.

Color Contrast Fails WCAG — How to Fix It

Design flagged as low contrast, what are WCAG AA/AAA, how to compute contrast and tune it to pass? With our color contrast checker and converter.

Chinese Turns Into %E4%B8%AD (Percent Encoding) in a URL — Is That Normal?

URL Chinese becomes a string of %XX percent-encoding — is that normal? Why encoding is needed, how it works, how to decode, and how to handle it in front-end, with our URL tool.

Base64 Decode Shows Garbled Text or Black Question Marks for Chinese — How to Fix

Base64 decode turns Chinese into mojibake or black question marks? Explains the root cause — Base64 encodes bytes, not characters — and gives command-line, code, and online-tool fixes, all processed locally.

How to Batch Encode Multiple Files or Texts to Base64 (No Script Needed)

Need to convert dozens of images or strings to Base64 at once? Learn batch Base64 encoding and step-by-step how to do it locally without uploading files or writing scripts.

API Testing: How to Send a Token and Fix CORS Errors

How to add an Authorization token when testing APIs online, and what to do about CORS / 405 / timeout errors? A step-by-step troubleshooting guide with our API tester.

The Complete Guide to Table Format Conversion: Excel, CSV, JSON, Markdown, and HTML

Convert between Excel, CSV, JSON, Markdown, and HTML tables — delimiters, headers, empty cells, merged-cell boundaries, and matching browser tools.

HTML to JSX Guide: Attributes, Styles, Events, and Comments

Walk through HTML vs JSX differences—className, style objects, camelCase props, events, and comments—and migrate design/legacy snippets into React with an online converter.

Complete Guide to Character Frequency Analysis: From Cryptography to Text Analysis

Deep dive into character frequency statistics and applications—from code breaking to SEO—plus case folding, whitespace/punctuation filters, Top-N, and export workflows.

Online JWT Decoder Tools Compared (2026)

Comparing 4 popular online JWT decoders across signature verification, privacy, and expiration checks: jwt.io's ecosystem, Base64Decode's convenience, ToolVault's local processing — each owns different scenarios. Includes a 401 triage path and reproducible verification methods.

Online Base64 Encoder and Decoder Tools Compared (2026)

Comparing 4 popular online Base64 tools across Unicode safety, privacy, batch capability, and cost: RapidTables goes broad, Browserling does batch, ToolVault runs locally — each has its place. Includes the btoa trap, base64url variants, and reproducible verification methods.

Online JSON Formatter Tools Comparison (2026)

Comparing 5 popular online JSON formatter tools across features, privacy, and fit: ToolVault runs locally, JSON Formatter leads with its tree view, jq play with filtering — each has its place. Includes an error-troubleshooting table and reproducible verification methods.

TOTP Two-Factor Authentication Guide: otpauth URI, Algorithms, and Local Debugging

How RFC 6238 TOTP works: algorithms, digits, period, otpauth URIs, countdown windows, and debugging 2FA with a browser-local generator.

Mock Data Generator Complete Guide: Generate Test Data Fast

Generate reproducible test rows with field types, locale samples, and seeds. Export JSON, CSV, TSV, YAML, or SQL for frontend mocks and local DB seeding.

Online XML/JSON Converter: Convert Between Data Formats

Learn how to convert between XML and JSON: @-prefixed attributes, CDATA, array folding, and line-level parse errors for API and legacy integrations.

Online Markdown Preview: Real-time Render and Edit Markdown

Aligned with ToolVault's real Markdown preview stack: react-markdown + remark-gfm, CommonMark vs GFM, safe rendering and XSS boundaries, table/task-list pitfalls, plus YAML/JSON/Diff/HTML workflow links.

Online JWT Generator/Decoder: JSON Web Token Tool

Learn JWT (JSON Web Token) structure, how it works, and use cases. Mint and decode JWTs with a local browser tool, plus practical signing hygiene.

Online HMAC Generator: Message Authentication Code Explained

Learn how HMAC (Hash-based Message Authentication Code) works. Understand HMAC-SHA256 workflows, real-world use cases, and how to generate and verify HMAC signatures online.

Cron Expressions Explained: From '* * * * *' to Complex Schedules

Learn cron expression syntax with practical examples: five fields, steps, ranges, name aliases, and the day-of-month vs day-of-week gotcha.

Online Regex Explainer: Visualize and Understand Regular Expressions

Learn how to parse and understand regular expressions — lazy quantifiers, lookarounds, named groups, Unicode properties, and how to pair an explainer with a tester.

Online Certificate Decoder: Parse SSL/TLS Certificate Information

Decode PEM certificates locally: Subject, Issuer, SAN, validity, and chain context. Pair with OpenSSL for hostname mismatch, missing intermediates, and clock skew — nothing is uploaded.

JWT Explained: Structure, Signature Verification, and Security Practices

Deep dive into JWT three-part structure, HS256 signature verification, and common pitfalls: alg=none, expiry units, and cookie vs storage.

Online Color Converter: HEX, RGB, HSL Color Format Conversion

Learn how to use an online color converter to switch between HEX, RGB, HSL, RGBA, and HSLA. Cover alpha channels, modern CSS syntax, and contrast checks for frontend work.

Complete Guide to JSON Formatting: From Beginner to Expert

JSON format, minify, and validate: indentation choices, JSONC/JSON5 boundaries, Unicode, and a lossless path for integers beyond 2^53-1. Pair with the troubleshooting handbook and Diff.

Online Cron Expression Parser: Visualize Scheduled Task Scheduling

Parse standard five-field Cron: field expansion, readable summary, name aliases, day/weekday OR, next 5 runs in browser-local time, and dialect boundaries.

Online CSS Gradient Generator: Create Beautiful Background Gradients

Build linear, radial, and conic CSS gradients visually—custom angle, stop positions, opacity, and one-click copy of the background rule—plus syntax, palettes, and accessibility notes.

Online Word Counter: Count Words, Characters, Lines Instantly

Learn how to use an online word counter for words, characters, lines, and paragraphs. Understand CJK vs Latin counting, reading-time estimates, and writing/dev use cases.

Online Bcrypt Hash Tool: Cost Factors, Salt, and Password Verify

How bcrypt password hashing works: cost factors, built-in salt, the 72-byte limit, and how to generate or verify hashes in the browser. Cross-links password generator and hash verifier.

Local vs Cloud Developer Tools: Why Privacy Matters for Sensitive Data

Compare local developer tools vs cloud-based alternatives. Learn why privacy-first dev tools and browser-based processing matter for sensitive data like API keys and JWTs.

JWT vs Session Cookies: Authentication Comparison and Selection Guide

Sessions are server-side state, JWT is a stateless token. Compare them on microservices fit, SPA compatibility, revocation, and security. Includes common JWT pitfalls and a decision framework.

Online QR Code Decoder: Scan and Read QR Code Images

Learn how to decode QR images. Aligned with this site's jsQR pipeline: structure, error-correction limits, screen-capture pitfalls, and local-privacy boundaries.

AES Encryption in the Browser: A Practical Guide to Web Crypto API

Learn AES encryption in JavaScript using the Web Crypto API. Complete AES-256-GCM encrypt/decrypt example with PBKDF2 key derivation, all running client-side.

JSON vs XML: Data Format Comparison, Which Is Right for Your Project?

JSON is lightweight and JS-native, XML is strict with mature schema support. Compare the two formats on size, tooling, and typical use cases, and learn why XML refuses to die in specific domains.

Online User-Agent Parser: Identify Browser and Device Information

Parse User-Agent strings into browser, engine, OS, device type, and CPU architecture. Covers Client Hints boundaries, reduced UAs, and the example library.

Base64 vs Hex Encoding: When to Use Which? Density vs Readability

Hex is 2 chars per byte (100% overhead); Base64 is ~1.33 chars per byte (33% overhead). Compare density, readability, and typical use cases. Includes a worked 'Hello' encoding example.

Why Your Regex Isn't Matching: 6 Common Mistakes and How to Fix Them

Fix regex not matching issues fast. Covers greedy vs lazy, missing flags, unescaped chars, and 3 more common regular expression errors with code examples.

Online Password Generator: How to Create Strong, Secure Passwords

Create strong random passwords with a CSPRNG. Length vs complexity, entropy math, manager lifecycle, and how generation pairs with bcrypt storage — not SHA-256 file checks.

Online Image Compressor: Shrink JPEG, PNG, and WebP

Compress images in the browser: quality and width presets, format conversion, before/after size stats, EXIF stripping boundaries, and practical web performance workflows.

Online RSA Encryption/Decryption: Asymmetric Crypto and Digital Signatures

Learn RSA asymmetric encryption algorithm principles and applications. Understand public/private key encryption, digital signatures, key pair generation, and use in HTTPS and API authentication.

URL Encoding Explained: How to Handle Spaces, Chinese Characters & Special Symbols

Learn how percent encoding works for spaces, Chinese characters, and special symbols. Understand %20 vs +, UTF-8 multi-byte encoding, and avoid double encoding bugs.

SHA-256 vs MD5: When to Use Which Hash Algorithm (2026)

SHA-256 vs MD5 compared: security, speed, and use cases. Learn when MD5 is still acceptable and where you must use SHA-256. Practical decision guide.

JSON to TypeScript: Complete Guide to Auto-Generating Type Definitions

Step-by-step tutorial on how to quickly convert JSON data to TypeScript interfaces and type definitions, boosting development efficiency and code quality

Online QR Code Generator: Create Custom QR Codes Quickly

Learn how to create QR codes with this site's generator. Covers error correction, version capacity, URL vs text payloads, and dense-module pitfalls—aligned with the real implementation.

Hashing vs Encryption: What's the Difference and When to Use Each

Hashing and encryption are not the same. Hashes are one-way and irreversible; encryption is reversible with a key. Clear guide to choosing the right one for passwords, integrity, and confidentiality.

Online Cron Expression Generator: Visually Create Scheduled Task Rules

Build standard five-field Cron with visual controls. Covers day/weekday OR semantics, timezones, PATH, weekday 0–7 (7=Sunday), next-run preview in browser-local time, and pairing with the parser and crontab ops.

Online HTML Entity Encoder/Decoder: Safely Handle Special Characters

Learn HTML entity encoding fundamentals. Understand how to convert special characters to HTML entities, prevent XSS attacks, and use encoding in frontend development.

Online Case Converter: Switch Between camelCase, snake_case, PascalCase

Learn how to use an online case converter to switch between camelCase, PascalCase, snake_case, kebab-case and more. Covers acronym splitting, locale-safe mapping, and naming habits by language.

What Is a CORS Preflight Request (OPTIONS)? A Cross-Origin Mechanism Every Frontend Developer Must Know

What is a CORS preflight? How simple requests differ from preflight, what Access-Control-Allow-* headers mean, credentials rules, common pitfalls, and how to use this site's API Tester in direct vs proxy mode.

Online AES Encryption Tool: Symmetric Encryption Guide

Learn AES symmetric encryption fundamentals. Understand AES-GCM mode, PBKDF2 key derivation, iteration count selection, and how to encrypt and decrypt data using online tools.

UUID v4 vs v7: Which Should You Choose? Randomness vs Sortability

UUID v4 is fully random; v7 is time-ordered (RFC 9562). Compare their impact on database indexes, collision probability, and distributed systems. Practical decision framework included.

Complete Guide to Regular Expressions: From Beginner to Advanced

Deep dive into regex core syntax, common patterns, and practical usage. Master character classes, quantifiers, groups, lookaround, and advanced features to boost your text processing efficiency.

Online JSON/YAML Converter: Convert Between Configuration Formats

Learn how to convert between JSON and YAML formats for configuration data. Understand the differences between JSON and YAML, and use cases in DevOps and configuration management.

Timestamp Conversions Always Off by 8 Hours? A Complete Guide to Timezone Pitfalls

Unix timestamp conversions always off by 8 hours? This article starts from timezone principles, explains the relationship between timestamps and UTC, analyzes common timezone handling errors in JavaScript and on the server, and provides correct conversion methods with code examples to thoroughly solve timestamp timezone issues.

Complete Guide to JSON Schema: From Beginner to Practical

Deep dive into JSON Schema core concepts, use cases, and best practices. Learn how to write and auto-generate JSON Schema, and master JSON data validation techniques.

Text Extractor Tool: Quickly Extract Useful Information from Messy Text

Extract emails, phones, URLs, IPs and numbers from logs, HTML source and messages. Strip HTML, collapse whitespace and dedupe — all in your browser.

Online CIDR Calculator: Subnet Division and IP Address Planning

Learn CIDR (Classless Inter-Domain Routing) fundamentals. Understand subnet masks, network/broadcast addresses, and how to use an online calculator for IP address planning.

15 Categories of Free Online Developer Tools: A Privacy-First Toolbox (2026)

A guided tour of ToolVault's own 99+ free developer tools across 15 categories — JSON, encoding, crypto, formatting, and more, all running in your browser with zero uploads. Each category also names at least one established alternative from outside this site (jq, regex101, crontab.guru, OpenSSL).

Complete Guide to YAML JSON Conversion: Principles, Tools, and Pitfalls

Deep dive into the differences and connections between YAML and JSON. Master bidirectional YAML JSON conversion methods — online tools, CLI, code implementations, YAML 1.1 vs 1.2 traps, anchors and merge keys, multi-document streams.

Regex Cheat Sheet: 30 Most Common Patterns with Examples

Regex cheat sheet with 30 most common patterns. Covers character classes, anchors, quantifiers, lookaround, plus email, URL, phone, IP, date, and password validation with match and non-match examples.

Online Text Diff Tool: Compare Two Texts Side by Side

How ToolVault's text diff actually works: Monaco DiffEditor, whitespace/case ignore boundaries, unified vs side-by-side views, reading patches, and when to use JSON Diff instead.

Online Color Palette Generator: Scales, Harmonies, and CSS Export

Generate tint/shade scales or wheel harmonies (complementary, analogous, triadic, split-complementary, tetradic) from one base color. Copy CSS variables or a Tailwind snippet, then check contrast before shipping.

Online JSON Diff Tool: Compare and Analyze JSON Data Differences

Learn how to use an online tool to compare two JSON data structures. Understand JSON Diff principles, common comparison scenarios, and applications in API testing and configuration management.

Online URL Encoder/Decoder: Percent-Encoding Explained

Learn URL encoding (percent-encoding): when to encode, space as %20 vs +, double-encoding triage, and Component vs Full URI mode.

Online Base32/Base58 Encoder: Alphabets, Checksums, and Base64 Size Compare

See how Base32, Base58, and Base64 differ: RFC 4648 vs Crockford alphabets, Base58Check double SHA-256 validation, size overhead, and when to switch to Base64.

.gitignore Generator Guide: Stack Combos, Deduping, and Custom Rules

Learn .gitignore syntax, already-tracked file pitfalls, and how to combine language, framework, IDE, tool, and OS templates—with automatic dedupe and custom lines—in the online generator.

Online JavaScript Minifier: Reduce JS File Size for Faster Page Loads

Learn how to minify JavaScript to cut file size. Cover minification basics, this site's options (comments, console, size compare), and how they differ from Terser/esbuild in a build pipeline.

UUID Generator: Complete Guide to Unique Identifiers (UUID, NanoID, ULID)

Understand UUID v4, NanoID, and ULID fundamentals. Learn how to use an online UUID generator, and discover best practices for databases, distributed systems, and API tracking.

Online Unicode Encoder/Decoder: Handle Unicode Character Conversion

Learn Unicode encoding and decoding principles. Understand UTF-8, UTF-16, and escape sequences, and how to convert code points, surrogate pairs, and UTF-8 bytes online.

Online Lorem Ipsum Generator: Generate Placeholder Text Quickly

Learn the history and purpose of Lorem Ipsum placeholder text. Use an online generator for Latin or Chinese filler by paragraphs, sentences, or words — with classic openings and HTML <p> wrap.

Online Image to Base64 Converter: Encode Images to Text Strings

Learn how to convert image files to Base64 encoded strings. Understand Base64 encoding principles, use cases, and how to inline images in frontend development.

Online JSON Schema Generator: Auto-Generate Schema from JSON Data

Learn how to use an online tool to auto-generate JSON Schema from JSON data. Understand JSON Schema structure, field type definitions, and applications in API documentation and data validation.

Online HTML Minifier: Reduce HTML File Size for Faster Loading

Learn how to compress HTML to cut file size. Cover minification strategies, optional comment stripping and IE conditional comments, script/style/textarea boundaries, and char vs UTF-8 byte savings in an online tool.

Online HTML/Markdown Converter: Convert Between Document Formats

Aligned with ToolVault's HTML↔Markdown implementation: Turndown (HTML→MD) and marked (MD→HTML), GFM table loss, round-trip fidelity and safety boundaries, plus preview/YAML/JSON/Diff workflows.

Base64 Encoding Chinese Characters Produces Garbage? Root Cause and the Correct Way to Handle It

Base64-encoded Chinese coming back as garbage? This article explains the base64 Chinese garbled-text problem caused by UTF-8 vs GBK encoding mismatch, and provides the correct JavaScript encode/decode methods with code examples to thoroughly solve base64 decoding garbage.

Password Strength Checker: Evaluate and Improve Passwords

Length, charset, weak-pattern penalties, and effective entropy: check passwords locally in the browser, then link to the generator and bcrypt storage.

Online JSONPath Query Tool: Extract Data from JSON Structures

Learn how to use JSONPath expressions to precisely extract information from JSON data. Understand JSONPath syntax, common expressions, dialect differences and silent-empty pitfalls, with use cases in API development and data processing.

Online SQL Formatter: Beautify and Minify SQL Queries

Format and minify SQL by dialect (MySQL, PostgreSQL, SQLite, BigQuery). Diff-conscious layout, ORM log cleanup, and what a formatter will not fix. Pairs with CSV→SQL.

Markdown Table Generator: Create Clean Tables Quickly

Aligned with ToolVault's Markdown table generator: GFM pipe syntax, global alignment, CSV/editor modes, pitfalls, and workflows with preview, HTML conversion, JSON, and Diff.

Timestamp Converter: Unix Epoch Time to Date Conversion Guide

Online timestamp converter tutorial. Learn Unix timestamp fundamentals, how to convert between timestamps and readable dates, auto-detect seconds/milliseconds/microseconds, and practical programming tips.

Online Text Deduplication Tool: Remove Duplicate Lines and Content

Learn how to remove duplicate content from text—line dedupe, case/whitespace normalization, keep-first vs keep-last, duplicate counts, and export for data cleaning.

Online Number Base Converter: Bases 2–36 and Large Integers

Use an online number base converter for binary, octal, decimal, hex, and any radix 2–36. Covers BigInt-safe large integers, batch conversion, letter case, and common pitfalls.

Online Dockerfile Generator: From Stack Choice to a Buildable Template

Generate a Dockerfile and matching .dockerignore for Node, Python, Go, and more—single-stage cache order, multi-stage splits, non-root users, health checks, and how to hand off to Compose.

Online CSV/JSON Converter: Convert Between Table Data Formats

CSV ↔ JSON with RFC 4180 quoting, Excel dialects, BOM handling, and this site's real boundaries. Links to SQL, YAML, and TSV workflows.

Online JSON/CSV Converter: Convert Between JSON and Table Formats

JSON arrays to CSV: nested flatten, delimiter and header options, array-field boundaries, and how this page differs from the bidirectional CSV/JSON tool.

Online Code Formatter: Beautify JavaScript, HTML, CSS, and SQL

Use a browser-local code formatter for JavaScript, HTML, CSS, and SQL — indent options, parse error line numbers, Format vs Minify size deltas, and how it splits work with IDE Prettier.

Online URL Params Parser: Extract and Analyze URL Query Parameters

Learn how to parse and analyze URL query parameters — duplicate keys, +/space rules, URLSearchParams edges, and how to extract or rewrite params with an online tool.

Is It Safe to Paste Your JWT into an Online Decoder? On Token Leakage Risk

Is it safe to paste a JWT token into an online decoder? This article analyzes the security risks of online JWT decoding, token leakage risk, and how to safely decode a JWT without exposing private data.