Developer journal
Guides, release radar, and practical frontend articles. Each post links to the free tools on codefunc — read the approach, then try it in your browser.
Understand browser CORS, OPTIONS preflight, Access-Control-Allow-Origin, and credentials mode — plus the SPA misconfigurations that waste hours in production debugging.
How time-based one-time passwords work — shared Base32 secrets, 30-second windows, HMAC algorithms, clock skew, and why browser TOTP tools are for test secrets only.
Configure CSP for single-page apps — script-src with nonces and hashes, common React and Vite failures, CORS interplay, reporting, and a practical rollout checklist.
Step-by-step guides for tasks you hit every week — formatting API payloads, tuning meta tags, and avoiding pitfalls that waste debugging time.
42 articles
What actually changed in the frontend ecosystem — framework updates, tooling shifts, and breaking changes worth planning for.
1 article
Layout, motion, typography, and accessibility from a working developer's angle — patterns you can paste into production, not abstract theory.
6 articles
Protocols and tokens you touch daily — JWT structure, HTTP semantics, cron schedules, and the security boundary between client and server.
23 articles
How developers choose tools, protect privacy, and ship without trading quality for speed — the decisions behind the stack.
8 articles
Get Content-Type right for APIs, file uploads, and static assets — charset parameters, multipart boundaries, sniffing risks, and a practical MIME lookup workflow.
Named and numeric HTML entities, when to encode, XSS pitfalls, and how entity lookup pairs with MIME awareness when pasting content into HTML and email.
How to count words and characters the way products and platforms do — limits, diffs, Markdown pitfalls, and a practical editing workflow for developers who ship copy.
A practical guide to naming conventions across JavaScript, APIs, CSS, and URLs — plus how to convert cases safely without breaking acronyms or slugs.
Decode UUID and ULID strings to read version bits, variants, and timestamps — a practical debugging guide for APIs, logs, and database keys.
How to use Lorem Ipsum, fake user data, and Markdown fixtures effectively — when placeholder text helps layouts, when it hides product problems, and how to generate it locally.
Learn when Base58 beats Base64 — alphabet rules, leading-zero handling, checksum variants, and how to encode or decode safely in the browser.
Choose transitions vs @keyframes, pick units that scale, and build reusable motion snippets — with performance and accessibility rules that keep UI snappy.
When to use XPath vs CSS selectors, how to write stable queries, and a browser-side workflow for testing against real HTML without shipping brittle scrapers.
How to format and inspect XML without breaking namespaces, attributes, or mixed content — plus when to beautify vs minify and how XPath fits the workflow.
How to convert between CSV and JSON safely — quoting, nested objects, type coercion, headers, and a workflow that catches breakage before it hits production.
How HMAC signatures protect webhooks — canonical message construction, hex vs Base64 encodings, timing-safe comparison concepts, and building reliable test fixtures.
CIDR notation explained for frontend and full-stack developers — private ranges, VPC subnets, localhost quirks, and how to read /24 vs /16 without memorizing the whole CCNA.
How to format SQL for code review clarity, where dialects disagree, and when you should not reformat production migrations or generated queries.
How to use QR codes in product flows — URL and Wi‑Fi payloads, otpauth enrollment, error correction levels, and when SVG beats raster for crisp rendering.
A practical GFM workflow for developers — preview Markdown safely, convert HTML when needed, and understand the caveats of Markdown ↔ HTML round-trips.
Why compact GraphQL queries hurt reviews, how to format selection sets consistently, and a browser workflow before you paste into Apollo or GraphiQL.
Use JSONPath to extract fields, filter arrays, and inspect nested API payloads — with practical expressions and a browser tester workflow.
How password entropy works, why character sets matter, when browser CSPRNG is enough, and why generated passwords are not a substitute for proper password storage hashing.
Shrink SVG icons for the web — strip comments and whitespace, choose inline vs data URLs, and know when you still need a full SVGO pipeline.
How unified diffs work, when to use a patch viewer vs text/JSON diff, and a safe browser workflow for creating and applying single-file patches.
Break down URL parts, encode query values correctly, and know when to use encodeURIComponent vs encodeURI — plus reserved characters that break APIs.
Ship the right favicon and apple-touch-icon sizes, wire Web App Manifest icons, set theme-color, and avoid the common gaps that leave tabs and home screens looking broken.
Build practical gradient and shadow design tokens, pick easing curves that feel right, and avoid paint-heavy effects that tank scroll performance.
When to use JSON, YAML, or TOML for app config — conversion pitfalls, trailing commas, multiline strings, and a safe workflow for editing and validating files.
Use AES-GCM with Web Crypto for demos and learning, understand IV and auth tags, and know why inventing browser-only crypto protocols fails in production.
Turn OpenAPI operations into accurate curl commands, attach auth headers correctly, and use snippets to reproduce frontend API failures for backend teammates.
Master JavaScript RegExp flags, avoid catastrophic backtracking, know when regex is the wrong parser, and build a live testing workflow that catches bugs before production.
Build a correct sitemap.xml, keep lastmod honest, submit it in Google Search Console, and pair it with robots.txt so crawlers discover the pages you actually want indexed.
Learn SHA-1/256/384/512 in the browser, the difference between checksums and password hashing, how Web Crypto digests work, and when HMAC belongs in your frontend workflow.
Understand browser CORS, OPTIONS preflight, Access-Control-Allow-Origin, and credentials mode — plus the SPA misconfigurations that waste hours in production debugging.
How to compare JSON structurally — key order, arrays, nested objects — and when to use JSON diff versus line-based text diff in config and API review workflows.
Learn JSON Schema basics — types, required properties, common API contract errors — and how to validate payloads in the browser before you commit or deploy.
How time-based one-time passwords work — shared Base32 secrets, 30-second windows, HMAC algorithms, clock skew, and why browser TOTP tools are for test secrets only.
Configure CSP for single-page apps — script-src with nonces and hashes, common React and Vite failures, CORS interplay, reporting, and a practical rollout checklist.
A practical guide to robots.txt — syntax, common mistakes, how to check and validate your file, and when Disallow blocks indexing vs crawling.
How to convert Unix epoch seconds and milliseconds, read JWT exp claims, format ISO-8601 correctly, and avoid DST and timezone bugs in APIs and frontends.
A practical guide to Base64 and Base64url on the web — encoding binaries for data URLs and Authorization headers, padding rules, size costs, and when client-side tools keep secrets offline.
Master SemVer for libraries and apps — pre-releases, caret vs tilde ranges, breaking-change discipline, and a release workflow that keeps dependents sane.
A complete guide to cron syntax — the five fields, special characters, real-world examples, and the timezone, day-of-week, and non-standard pitfalls that silently break schedules.
Parse request and response headers, understand Set-Cookie attributes, and avoid User-Agent sniffing traps — with practical debugging workflows for APIs and browsers.
A practical comparison of UUID, ULID, and Nano ID — sortability, index performance, collision odds, and URL safety — so you can pick the right ID format for your database, API, and URLs.
Understand Unix file permissions end to end — the user/group/other model, octal math, symbolic notation, common permission sets, and the security mistakes that cause 403s and leaked keys.
A practical guide to Vanilla Extract — type-safe styles at build time, theming with CSS variables, recipes and sprinkles, and when to pick it over Tailwind or CSS Modules.
Decoding a JWT is not verifying it. Learn how signature verification works, the alg:none and algorithm-confusion attacks to avoid, which claims to check, and how to inspect tokens safely in development.
A practical guide to agile frameworks — Scrum sprints, Kanban flow, XP, and Lean — with comparison tables, ceremonies, and honest advice on what actually works for software teams.
A practical guide to using AI in frontend development — code assistants, component generation, debugging, testing, and the workflows that make AI useful without losing code quality.
A practical guide to Chrome DevTools for frontend developers — inspecting elements, debugging JavaScript, analyzing network requests, profiling performance, and workflows that save hours of debugging time.
A practical guide to CSS architecture patterns — when to use Tailwind for rapid development, CSS Modules for component scoping, or CSS-in-JS for dynamic styling.
A practical guide to modern CSS layout — flexbox for one-dimensional alignment, grid for two-dimensional structure, and patterns for combining them in production components.
Why E2E tests need an owner, not a orphan folder — and what 'eyes on production' really means: synthetic checks, alerts, post-deploy smoke, and closing the loop between CI green and users happy.
A practical guide to animations in React — CSS transitions and keyframes, Framer Motion for complex interactions, performance optimization, and accessibility considerations.
A practical guide to authentication for frontend developers — understanding OAuth flows, JWT structure, session cookies, and implementing secure auth in React applications.
A practical guide to frontend security — preventing cross-site scripting (XSS), cross-site request forgery (CSRF), securing authentication, and building defense in depth.
A practical guide to Git for frontend developers — branching strategies, commit conventions, pull request workflows, and the commands you'll use daily on product teams.
A practical guide to using GraphQL in frontend applications — writing queries and mutations, client-side caching with Apollo and urql, and patterns for React integration.
A practical guide to semantic HTML — landmarks, headings, lists, and sectioning elements that improve accessibility, SEO, and maintainability without extra frameworks.
A practical guide to monorepo architecture — when to use monorepos, setting up Turborepo or Nx, shared packages, caching, and CI/CD optimization.
A practical guide to caching in Next.js 15+ — Request Memoization, Data Cache, Full Route Cache, and Router Cache demystified with patterns for static generation, ISR, and on-demand revalidation.
Learn end-to-end testing with Playwright — writing reliable tests, handling authentication, testing across browsers, and integrating with CI/CD pipelines.
A practical guide to building Progressive Web Apps — service workers for offline support, web app manifest for installation, caching strategies, and turning your website into an installable app.
A practical guide to the testing pyramid — what unit, integration, and end-to-end tests actually do, when to write each, and how to automate them in CI without slowing your team down.
Teams say they must choose speed or quality — but the tradeoff is usually poorly designed process, not physics. How to measure both, when to slow down, and when shipping faster actually improves quality.
A practical guide to building forms with React Hook Form and Zod — type-safe validation, error handling, complex form patterns, and integration with UI libraries.
A practical guide to internationalizing React applications — setting up translations, handling plurals, formatting dates and numbers, and implementing language switching.
A practical guide to modern React state management — TanStack Query for server state, Zustand for client state, and patterns that replaced Redux for most applications.
A practical guide to consuming REST APIs in frontend applications — HTTP methods, status codes, fetch patterns, authentication, error handling, and debugging techniques.
A practical introduction to TypeScript in frontend projects — type annotations, interfaces, generics, and the compiler settings that make React and API code safer without slowing you down.
Vite vs webpack vs esbuild — a practical comparison of modern JavaScript build tools, when to use each, and what to pick for new projects in 2026.
Semantic HTML, keyboard navigation, focus management, ARIA, forms, and testing — a practical WCAG 2.2 checklist for frontend developers who want accessible products, not checkbox compliance.
A practical guide to frontend performance — LCP, INP, CLS explained, with optimization techniques for images, JavaScript, fonts, and rendering that improve both user experience and search rankings.
Learn to implement real-time features with WebSockets and Server-Sent Events — chat apps, live notifications, collaborative editing, and handling connection state in React.
A practical guide to search indexing in the AI era — what crawlers still need, how LLMs surface content, and where AI tooling actually speeds up discoverability without spam penalties.
How small batches, automated quality gates, and boring CI pipelines let teams release to production daily — without trading speed for stability.
The complete guide to prettifying, validating, repairing, and debugging JSON in production workflows — without leaking sensitive API data to remote servers.
A deep dive into JSON Web Token structure, signing algorithms, common vulnerabilities, and a safe workflow for decoding tokens in development without exposing production secrets.
A curated, opinionated roundup of the frontend framework, build tool, CSS, and testing releases shaping how teams ship production apps this month — with migration checklists for each.
Master the clamp() function for responsive font sizes, gutters, and component dimensions — with formulas, real examples, and common mistakes that break layouts.
A practical a11y guide to color contrast ratios, WCAG 2.2 success criteria, and a step-by-step workflow for auditing text, icons, and interactive states.
The definitive checklist for title tags, meta descriptions, Open Graph, Twitter cards, canonical URLs, and robots directives — with copy-paste examples for Next.js and static sites.
Find a developer tool