Layerbit Engineering Guides
In-depth technical writing on the formats, protocols and security details our tools deal with every day — the specification corners, the failure modes, and the bugs that only show up in production.
In-depth technical writing on the formats, protocols and security details our tools deal with every day — the specification corners, the failure modes, and the bugs that only show up in production.
How password cracking really works, entropy in bits, why a long random string beats a short complex one, Diceware passphrases, and the six rules that actually protect an account.
Read guideHow the contrast ratio is calculated, the 4.5:1 and 3:1 rules for text and UI, why brand colors fail on white, how to fix them in OKLCH, and where APCA disagrees in dark mode.
Read guideThe encoding every processor uses for signed integers, built from first principles, plus the real bugs it causes: Java's signed bytes, JavaScript's 32-bit operators, overflow and 2038.
Read guideWhat the style guides for Python, JavaScript, Java, C#, Go and Rust require, conventions for SQL, URLs, CSS and headers, the acronym question, and converting at API boundaries.
Read guideThe syntax that renders the same everywhere, GitHub-Flavored tables, task lists and code fences, and the rules behind line breaks, nested lists, anchors and escaping.
Read guideWho can forge, how big the token gets, how fast it verifies, which key formats each one uses, the raw-versus-DER signature trap in ES256, and a plain rule for choosing.
Read guideA schema is a set of constraints, not a drawing: why properties requires nothing, the unanchored pattern that fails open, the format nobody enforces, oneOf overlap, and what $ref really does.
Two versions cannot tell you who changed what; the common ancestor can. The four cases per line, why adjacent edits conflict, reading diff3 markers, and the four honest resolutions.
Read guideThe syntax that behaves the same in every tool, what $..key really searches, Python-style slices, filter predicates on @, why results are always a list, and where implementations disagree.
Why the prefix length is the whole story, how to read the third octet without a table, the ACL wildcard that matched everything, and a method for laying out a VPC that can still grow.
Read guideA Base64 "encrypted" password is not protected and a CRC32 "hash" is not tamper-evident. One question separates the three — what is the operation for? — plus why passwords need none of them directly.
Read guideRandom keys split B-tree pages all over the index; time-ordered v7 appends at the end. What changes, when v4 is still right, and how to store UUIDs so the index stays small.
Read guideInstants are not wall-clock times, a zone is not an offset, and JavaScript parses date-only strings as UTC but date-times as local. Every timestamp bug traces back to one of these.
Read guideThe syntax behind 95% of real queries, why //item[2] and (//item)[2] differ, the XPath 1.0 function set browsers actually implement, and the default-namespace problem explained once.
A catalogue of the characters that render as nothing, where each arrives from, what it breaks, the bidi-override Trojan Source attack, lookalike letters, and how to strip them at the boundary.
Read guideDouble quotes mean strings in MySQL and identifiers everywhere else; LIMIT is TOP in T-SQL; every date function differs. The divergences that stop queries, and why formatting is a review tool.
The seven mistakes behind nearly every invalid document — trailing commas, single quotes, comments, NaN, bad escapes, BOMs — how to read the error, and how to find position 217.
Anyone holding a token can read every claim inside it without a key. The gap between reading a token and trusting one is where alg: none, RS256→HS256 confusion, and most authentication bugs live.
Why day-of-month and day-of-week combine as OR rather than AND, why */7 is not "every seven minutes", and how daylight saving quietly skips or doubles a job twice a year.
Why the country code NO becomes the boolean false, 1.10 becomes 1.1, 0755 becomes 493, and 22:22 becomes 1342 — all of it specified behaviour.
RFC 4180 quoting rules, the locale that makes Excel open your file as one column, the type inference that corrupts leading zeros and gene names, and the formula injection hiding in your export.
Read guideA validation pattern that runs in microseconds can take longer than the age of the universe on forty characters of carefully chosen input. Catastrophic backtracking, and the three pattern shapes that cause it.
Read guideTwo different encodings both called "URL encoding", and they disagree about the space character. Reserved characters, encodeURI vs encodeURIComponent, and what %2520 tells you.
HTML escaping protects element text and nothing else. Why an unquoted attribute breaks with a plain space, and why </script> ends a block from inside a JavaScript string.
How three bytes become four characters, why the overhead is exactly 33%, what the = padding is for, and why btoa() throws on an emoji.
PINT-AE for engineering teams: the UBL 2.1 structure, the five-corner model with the tax authority, the validation failures that recur, and the master-data cleanup worth starting now.
Read guideEvery utility in the suite, grouped by what it does. All of them run in your browser; the ones marked as local never send your input anywhere.
Convert text or file contents to and from Base64 for safe transport through text-only channels such as JSON, email and data URIs. See the Base64 guide for the padding and URL-safety rules.
Standards-correct CSV parsing — quoted commas, doubled quotes and embedded newlines all handled — with type inference, plus JSON back to CSV building the header from the union of all keys.
Convert in both directions and inspect the real parsed types, which is the fastest way to catch YAML's implicit conversions before they reach a pipeline.
Smart mode preserves URL structure while encoding query values; raw mode does strict component encoding. Includes an editable parameter grid and a batch mode for lists of URLs.
Convert between raw characters and HTML entities in both directions — handy for checking what a template escaped, and for spotting double-escaped output.
Every code point with its UTF-8 and UTF-16 bytes, invisible and bidi characters made visible, normalization forms compared and mixed-script lookalikes flagged. Pairs with the escaping guide and the diff tool's invisible-character notes.
Stack seventy-four operations — Base64, gzip, JWT, JSON and JSONPath, CSV, YAML, hashes, regex extraction, URL parsing, timestamps, AES — into one recipe with per-step previews, magic detection of what you pasted, presets and shareable links.
Validate, beautify and minify JSON, with a collapsible tree view alongside the raw text for navigating deeply nested API responses.
Reformat queries into a consistent, readable shape across several database dialects, so diffs stay meaningful and reviews focus on logic.
Turn arrays of objects into a readable table, including records with differing key sets, for scanning large API payloads quickly.
Compare two blocks of text or code side by side with the differences highlighted, for config drift and copy review.
Live matching with capture-group breakdown and a replacement preview. Pair it with the backtracking guide before shipping a pattern.
Highlight errors, warnings and patterns across pasted log output to find the relevant lines faster.
Whitespace-aware pretty-printing, well-formedness errors with line and column, XPath 1.0 with automatic namespace binding, and an XML-to-JSON view.
Split a token into header, payload and signature, and verify HMAC or RSA signatures locally with the Web Crypto API. Start with decoding vs verifying.
Generate downloadable QR codes and barcodes for links and text, with structural risk hints on the encoded URL.
SHA-1/256/384/512 and MD5 of text or files with the Web Crypto API, HMACs for webhook signatures, and a constant-time checksum verifier.
v4, time-ordered v7, namespace v5/v3 and ULIDs in bulk, with a decoder that reads version, variant and the embedded timestamp of any id.
Build a schedule visually, read it back in plain English, and preview the next five run times in UTC. See the cron guide for the OR rule.
Epoch seconds, milliseconds, micro- and nanoseconds to ISO 8601, RFC 2822 and any IANA zone, with relative time, ISO weeks and date arithmetic. Companion to the cron guide.
IPv4 and IPv6 with exact 128-bit arithmetic: network, hosts, masks and wildcards, subnet splitting with CSV export, membership and supernet checks.
Peer-to-peer browser screen sharing over WebRTC with no installation. Share a link from a desktop browser and view it from anywhere. The person you send the link to lands on the viewer, which explains what a session ID is and what to try when a connection will not establish.
Check invoice data against the PINT-AE field structure and export PINT-AE style XML. Background in the UAE e-invoicing guide.