FFreeToolsBox
Open tools
Developer guides

Practical guides for safer tool use.

FreeToolsBox guides explain the concepts behind the focused tools: when a conversion is safe, what common mistakes look like, and where security boundaries matter.

7 min read01

Base64 Is Not Encryption: What Developers Should Know

A practical guide explaining what Base64 encoding does, why it is reversible, where it is useful, and why it should not be used to protect secrets.

Takeaway: Base64 changes how data is represented; it does not make the data secret. Use it for transport and formatting, not protection.
Read guide →
8 min read02

JWT Decode vs Verify: The Difference That Matters

A developer guide to decoding JWT header and payload fields, verifying signatures, reading exp and iat claims, and avoiding common token mistakes.

Takeaway: Decoding a JWT makes its header and payload readable. Verifying a JWT proves whether the token was signed by a trusted issuer and has not been changed.
Read guide →
8 min read03

URL Encoding for Query Parameters: Practical Rules and Examples

Learn when to encode a query parameter, how percent encoding works, why double encoding breaks links, and how to debug malformed escape sequences.

Takeaway: Encode parameter values, not usually the entire URL. Pay attention to reserved characters, Unicode, spaces, and accidental double encoding.
Read guide →
9 min read04

Hashing vs Encryption: How to Choose the Right Tool

A practical comparison of hashing, encryption, checksums, password hashing, and when SHA-256, MD5, bcrypt, scrypt, or Argon2 fit the job.

Takeaway: Hashes are one-way digests. Encryption is reversible with a key. Password storage needs dedicated slow password-hashing algorithms, not plain SHA-256.
Read guide →
7 min read05

Base64URL vs Base64: The Characters That Break Tokens and Links

A practical guide to the URL-safe Base64 alphabet, padding, JWT segments, and why ordinary Base64 can break inside URLs and filenames.

Takeaway: Base64URL is a URL-safe variant of Base64. It changes a few characters and often drops padding so encoded values survive links, cookies, and token segments more reliably.
Read guide →
8 min read06

UTF-8, Unicode, and Percent Encoding in URLs

Understand how Unicode text becomes UTF-8 bytes, how percent encoding represents those bytes in URLs, and why copied links sometimes look unreadable.

Takeaway: URL encoding usually represents UTF-8 bytes, not abstract characters directly. That is why one visible character can become several percent-encoded byte values.
Read guide →
8 min read07

encodeURI vs encodeURIComponent: Which One Should You Use?

A practical guide for choosing between JavaScript encodeURI and encodeURIComponent when building links, query strings, callbacks, and nested URLs.

Takeaway: Use encodeURIComponent for individual parameter values. Use encodeURI only when you already have a mostly complete URL and want to preserve its structural characters.
Read guide →
8 min read08

Why MD5 and SHA-1 Are Legacy Choices

Understand why MD5 and SHA-1 still appear in old checksums, why they are unsuitable for new trust decisions, and when SHA-256 or stronger options are better defaults.

Takeaway: MD5 and SHA-1 are useful for recognizing legacy data, but they should not be chosen for new security-sensitive integrity or trust workflows.
Read guide →
8 min read09

How to Choose Password Length: Entropy, Usability, and Managers

A practical guide to choosing password length, understanding entropy estimates, using passphrases, and avoiding common password generator mistakes.

Takeaway: Length usually matters more than visual complexity. Use long unique passwords with a manager, and use memorable passphrases only when a human truly needs to type them.
Read guide →
8 min read010

How to Read JSON Parse Errors Without Guessing

Learn how to interpret common JSON parse errors, spot trailing commas, quote problems, control characters, and malformed nested data from APIs or logs.

Takeaway: A JSON parse error usually points near the first place the parser became confused, not always the original mistake. Work from the location, then inspect the surrounding structure.
Read guide →
7 min read011

Unix Timestamp Seconds vs Milliseconds: The 10-Digit and 13-Digit Trap

A guide to recognizing Unix timestamp units, converting UTC and local time correctly, and avoiding common API, log, and JWT time mistakes.

Takeaway: A 10-digit Unix timestamp is usually seconds; a 13-digit value is usually milliseconds. Mixing them can shift dates by decades or create instantly expired tokens.
Read guide →
8 min read012

Regex Greedy vs Lazy Matching: Why Your Pattern Captures Too Much

A practical JavaScript regex guide to greedy and lazy quantifiers, capture groups, replacement previews, and safer matching against real sample text.

Takeaway: Greedy quantifiers take as much as they can while still allowing the pattern to match. Lazy quantifiers take as little as they can, but they still depend on the rest of the pattern.
Read guide →
8 min read013

Text Diff Review Workflows: Compare Changes Without Losing Context

A practical guide to comparing documentation, configuration, release notes, and copied snippets without turning every small change into a noisy review.

Takeaway: Text diff review works best when the snippets are small, sanitized, and tied to a clear decision: what changed, what matters, and what should be copied forward.
Read guide →
8 min read014

Safe Markdown Preview Workflow for Docs, READMEs, and Issue Templates

A practical guide to previewing Markdown structure, links, tables, code blocks, and task lists before publishing documentation or support content.

Takeaway: Markdown preview is a publishing rehearsal: it helps catch structure and formatting problems, but the final platform may still render details differently.
Read guide →
8 min read015

CSS Formatting Review Workflow for Stylesheets and Snippets

A practical workflow for formatting CSS, reviewing selector inventory, checking cascade risks, and deciding when project-level linters are still required.

Takeaway: CSS formatting improves readability, but cascade, specificity, browser support, and team lint rules still need deliberate review.
Read guide →
8 min read016

UUID v4 for Test Identifiers: Practical Boundaries and Examples

Learn when UUID v4 identifiers are useful for test data, fixtures, API examples, and mock records—and why IDs are not permissions or secrets.

Takeaway: UUID v4 values are useful random identifiers for development data, but authorization, uniqueness constraints, and secret-token design remain separate responsibilities.
Read guide →