Blog
Long-form posts on offline-first developer tools, browser APIs, JSON and JWT internals, and the small everyday tradeoffs of building privacy-first software.
All posts
- Privacy8 min read·
Why offline-first developer tools matter in 2026
Paste-and-upload developer tools have a long history of accidental leaks. Browser-only utilities sidestep the entire category of risk by computing locally — here's the case for offline-first, the actual incidents that motivate it, and how to verify a tool is what it claims to be.
Read post
- Engineering8 min read·
Nanosecond timestamps don't survive JSON.parse — 99.6% come back changed
JavaScript reads every JSON number as an IEEE 754 double, and a nanosecond timestamp is too big for one: today, neighbouring doubles are 256 ns apart. We parsed a million random 2026 timestamps and 996,049 came back changed — by up to 128 ns, with no error. Here is why, which parsers are affected, and four ways to keep every digit.
Read post
- Engineering11 min read·
Most punycode converters disagree with your browser. We measured it.
Punycode is only the last step of turning a Unicode domain into an xn-- label, and tools that stop there return a different domain than your address bar does. We tested a bare RFC 3492 implementation against the browser's own IDNA on seventeen realistic names: six came back wrong. Then we measured our own against ICU across 1,112,042 code points.
Read post
- Security10 min read·
IDN homograph attacks: how a domain can look exactly like another
A homograph attack registers a domain that renders identically to a real one by swapping in letters from another script — Cyrillic а for Latin a. In 2017 an all-Cyrillic xn--80ak6aa92e.com displayed as apple.com in Chrome, Firefox and Opera. Here is how the attack works, why browsers sometimes show you xn-- instead, and the defences that actually hold.
Read post
- Comparisons9 min read·
Base64 vs Base32 vs Base58 vs Base85: which encoding, and why
Every binary-to-text encoding is a trade between size and the places the output has to survive. We ran the same 3,000 bytes through each: Base85 came out 25% larger, Base64 33%, Base58 37% and Base32 60%. Here is what each one buys you for that cost, the gotcha in each, and a decision guide for picking one.
Read post
- Privacy12 min read·
Which AI coding tools train on your code? A 2026 privacy guide
Whether an AI coding assistant trains on your code or keeps it private usually comes down to one thing: your subscription tier, not the tool. Here's a current, tier-by-tier breakdown of what GitHub Copilot, Cursor, Claude Code, ChatGPT and Gemini actually do with the code you send them — how to lock each one down, and when the only real guarantee is a local model.
Read post
- Security10 min read·
Vibe coding safely: shipping an AI-built app without leaking secrets or bugs
Vibe coding — describing what you want and letting an AI write most of the code — is a genuinely fast way to build. It is also a fast way to leak API keys, install a hallucinated package, and ship an app you do not understand well enough to secure. Here is a practical threat model and a safe workflow that keeps the speed without the accidents.
Read post
- Concepts9 min read·
AI vs automation: when an LLM wins and when a script wins
The useful question is not whether AI or traditional automation is better — it is which one fits the shape of the task. This is a decision framework built on the five properties that actually decide it: how deterministic the job is, how structured the input is, the volume, the auditability, and the privacy exposure.
Read post
- Engineering9 min read·
Should you build your own developer tools? Build vs. use vs. generate
The urge to build your own version of a tool is strong — and sometimes right, often a trap. There are three options, not two: use an existing tool, build one, or have AI generate one. Here is a decision framework, the real total cost of building, and the short list of things you should almost never build yourself.
Read post
- Privacy7 min read·
Is offlineutils.com safe? An honest, verifiable answer
Yes — offlineutils.com is safe to use. Every tool runs entirely inside your browser, so the files and text you work with are never uploaded to a server, and there are no accounts, no cookies, and no tracking scripts. Here's exactly why it's safe, what data is and isn't collected, and how to verify every claim yourself in under a minute.
Read post
- Comparisons8 min read·
Smallpdf and iLovePDF alternatives that never upload your files
Smallpdf and iLovePDF are reputable, but both work by uploading your document to their servers, processing it there, and deleting it afterwards. If you'd rather your file never leave your device at all, the strongest alternative is a set of in-browser PDF tools that do the work locally. Here's an honest comparison of when each approach wins.
Read post
- Comparisons7 min read·
TinyPNG alternatives: shrink images in your browser without uploading
TinyPNG's compression is genuinely excellent — but it uploads your image to its servers to do the work. If your image is sensitive, or you just don't want the upload, client-side tools like Squoosh and the image tools on offlineutils.com resize, convert, and strip metadata entirely in your browser. Here's an honest comparison.
Read post
- Comparisons6 min read·
CyberChef alternatives: focused in-browser tools for everyday encoding
CyberChef is a powerful, fully client-side Swiss Army knife — but for a single common task like decoding Base64 or inspecting a JWT, its 300-operation recipe interface is overkill. Here's an honest look at focused, single-purpose alternatives that are just as private and faster for the everyday jobs, plus when CyberChef is still the right tool.
Read post
- Privacy5 min read·
We added analytics — here's exactly what we can and can't see
I turned on Vercel Web Analytics to learn whether anyone actually uses these tools. It's cookie-less, stores no IP address, and can't identify you — and the data you paste into a tool still never leaves your browser. Here's exactly what it can and can't see, and how to verify all of it yourself.
Read post
- How-to6 min read·
JSON formatter vs jq vs your editor: when to reach for which
Three tools cover almost every JSON task developers face — a browser-tab formatter, jq in the terminal, and the editor's built-in formatter. They overlap, but each one is meaningfully better for a specific kind of job. Here's how to pick.
Read post