DEV Community: Ameen Usman

0 9 1 * 5 is the 1st or Friday

Ameen Usman — Tue, 03 Nov 2026 06:32:27 +0000

The report was supposed to run only when the 1st landed on a Friday. The crontab said 0 9 1 * 5, and it also ran on a Friday that was not the 1st. On Vixie cron and cronie, both day fields being set means the job runs when either field matches. It does not wait for the 1st to be a Friday. That line is 09:00 on the 1st, and 09:00 on every Friday. A star in one of those fields turns the choice off. The cron generator can fill the five fields, and it cannot tell you which daemon will read them.

What the five fields actually select

0 9 1 * * is 09:00 on the 1st, and on no other day. The weekday is a star, so Friday never enters the decision.

0 9 * * 5 is 09:00 every Friday. The day of the month is a star, so the 1st matters only when that date is itself a Friday.

The either-day rule starts when both day fields are restricted. A number, a list, a range, or a step such as 1-31/2 counts as restricted. A day field that starts with * does not, and */2 is in that group. The step still picks days. Cron then joins that field to the other day field with AND.

30 4 1,15 * 5

Read that as 04:30 on the 1st, 04:30 on the 15th, and 04:30 every Friday. When the 1st is a Friday, it is still one line, so the command runs once that morning.

Friday the 1st, on Vixie cron

One standard five-field line cannot say “Friday the 1st only.” Schedule the date, and test the weekday in the command. On GNU date, and in POSIX, %u is 1 for Monday through 7 for Sunday, so Friday is 5. Cron runs the command with sh. The [ test is a POSIX builtin, and the job needs an absolute path.

0 9 1 * * [ "$(date +\%u)" -eq 5 ] && /usr/local/bin/job

In the crontab, write \%. A bare % is a newline. A terminal keeps %.

Where this rule stops

The rule above is Vixie cron and cronie. This guide does not claim it for every Kubernetes CronJob, for GitHub Actions, or for BusyBox crond.

Quartz, Spring, and EventBridge use a different field shape, with ? in a day field, so a five-field line matches none of them. systemd OnCalendar joins a weekday and a day of the month with AND.

The generator’s sentence for 0 9 1 * 5 is “at minute 0, at hour 9, on day-of-month 1, on Friday.” That list is not the either-day rule. Test the line on the host that will run it.

The full guide, with the one-minute test and the FAQ: https://kepttools.com/guides/cron-both-day-fields

What a JSON converter drafts from the first object

Ameen Usman — Mon, 02 Nov 2026 11:53:20 +0000

I copied an API response into a blank file and started a TypeScript interface by hand. The payload was a list of two people. Each object had an id, a name, a role, and a meta object with an active flag. I typed the fields from the first person and assumed the second person used the same keys. The JSON converter at https://kepttools.com/json-converter makes that rule visible. Paste the text. It runs in the browser and drafts the interface from the first object only. The same paste can also become a PHP DTO, a Laravel array, or CSV. The sample below is the array the page fills, and the TypeScript is the converter's output for that text.

[
  {"id": 1, "name": "Ada", "role": "engineer", "meta": {"active": true}},
  {"id": 2, "name": "Linus", "role": "founder", "meta": {"active": false}}
]

TypeScript stops at Ada. Linus does not add a field. meta becomes its own interface because the value is an object. The root name is Root.

export interface Root {
  id: number;
  name: string;
  role: string;
  meta: Meta;
}

export interface Meta {
  active: boolean;
}

The PHP DTO is drafted from that same first object. The class is always named DataTransferObject. There is no child class. meta is public array $meta, and the constructor copies $data['meta'] through as an array. Laravel still walks the whole array, so both people remain and meta stays nested. CSV keeps the top-level keys and writes meta as one cell, with the inner quotes doubled:

id,name,role,meta
1,Ada,engineer,"{""active"":true}"
2,Linus,founder,"{""active"":false}"

TypeScript and the PHP DTO are drafted from the first object in an array. CSV keeps top-level keys only, and a nested object becomes one cell. Invalid JSON shows the parse error and leaves the output empty. { produces Expected property name or '}' in JSON at position 1 (line 1 column 2). The output box is cleared.

Before you save the draft, read the second object. A key that exists only there will not appear on the interface or the PHP class. Put that key on the object you convert, or add the property yourself. Rename DataTransferObject before you ship the class. A missing key is assigned with ?? null, including on a property declared public int $id.

The full guide, with the FAQ and the converter: https://kepttools.com/guides/json-to-typescript-php-dto-laravel

What a JSON converter drafts from the first object

Ameen Usman — Sun, 01 Nov 2026 05:55:29 +0000

I had an API payload in one window and a blank TypeScript file in the other. The payload was a list of people. Each object carried an id, a name, a role, and a meta object with an active flag. I was ready to type the interface by hand and assume the second person would have the same keys as the first. That assumption is the useful part to check. The JSON converter at https://kepttools.com/json-converter reads the paste in the browser and drafts the interface from the first object only. The same text can also become a Laravel array, a PHP DTO, or CSV. The blocks below are that sample, run through the converter, not a tidied rewrite of it.

The Sample button uses this array:

[
  {"id": 1, "name": "Ada", "role": "engineer", "meta": {"active": true}},
  {"id": 2, "name": "Linus", "role": "founder", "meta": {"active": false}}
]

Laravel keeps both people, and it keeps meta nested as a PHP array:

[
    [
        'id' => 1,
        'name' => 'Ada',
        'role' => 'engineer',
        'meta' => [
            'active' => true,
        ],
    ],
    [
        'id' => 2,
        'name' => 'Linus',
        'role' => 'founder',
        'meta' => [
            'active' => false,
        ],
    ],
]

TypeScript stops at Ada. Linus never adds a field. Meta becomes its own interface because the value is an object:

export interface Root {
  id: number;
  name: string;
  role: string;
  meta: Meta;
}

export interface Meta {
  active: boolean;
}

The PHP DTO is one class, always named DataTransferObject, and it is also Ada only. Meta is array, not a nested class:

<?php

declare(strict_types=1);

class DataTransferObject
{
    public int $id;
    public string $name;
    public string $role;
    public array $meta;

    public function __construct(array $data = [])
    {
        $this->id = $data['id'] ?? null;
        $this->name = $data['name'] ?? null;
        $this->role = $data['role'] ?? null;
        $this->meta = $data['meta'] ?? null;
    }
}

CSV keeps the top-level keys and puts meta in a single cell. The nested object is JSON text, with quotes doubled:

id,name,role,meta
1,Ada,engineer,"{""active"":true}"
2,Linus,founder,"{""active"":false}"

A shorter array makes the same cut obvious. [{"id":1,"name":"Ada"},{"id":2,"email":"linus@example.com"}] still becomes two Laravel rows, so email survives there. The interface and the PHP class keep id and name only. CSV's header is id,name,email: Ada's row ends on an empty cell, and the next row leaves name empty.

Two limits sit on top of that sample. If the root is an array, TypeScript and the PHP DTO never look past the first object, so a key that exists only later is missing from the draft. CSV does look at later rows when it builds the header, but a nested object still occupies one cell, not a new column per inner key. Invalid JSON clears the output and shows the parse error. { leaves the box empty with Expected property name or '}' in JSON at position 1 (line 1 column 2). An empty array is valid JSON and still not CSV: the output is cleared and the message is CSV conversion expects an array of objects.

One tip before you paste the draft into a project: open the second object and look for a key the first object does not have. Root will not list it. Add that field yourself, or convert a single object that already contains every key you mean to keep. The PHP constructor also assigns null when a key is absent, including into public int $id, so treat the class as a draft and rename DataTransferObject.

If the paste is hard to read, indent it first at https://kepttools.com/json-formatter and then convert. A trailing comma is enough to wipe the output.

Full guide with the FAQ and the converter: https://kepttools.com/guides/json-to-typescript-php-dto-laravel

What cron expression runs every 5 minutes?

Ameen Usman — Sat, 31 Oct 2026 05:18:12 +0000

A cleanup job was supposed to run every five minutes. The crontab was saved at 10:03. The log showed 10:05, then 10:10. That is not a late start. The expression is tied to the clock, at minutes 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, and 55. Saving the file does not start a countdown. Classic cron also does not hold the next start while the previous process is still running, so a six-minute command overlaps itself. What follows is the five-field form used by Vixie cron and cronie, not a systemd timer and not Quartz.

Five fields, then the command

A standard line is five time fields and then the command. None of them is a seconds field.

Field	Range	A star means
Minute	0–59	Every minute
Hour	0–23	Every hour
Day of month	1–31	Every day of the month
Month	1–12	Every month
Day of week	0–7	Every day of the week

On Vixie cron and on cronie, Sunday is both 0 and 7. Monday is 1 and Friday is 5, so 1-5 is Monday through Friday. Some other schedulers accept only 0 for Sunday. Read crontab(5) on the host before using 7. Prefer numbers to names such as MON or JAN.

The fields use the daemon’s timezone, so 0 0 * * * is midnight there, not necessarily UTC. Honor CRON_TZ only if that host’s crontab(5) says so.

Every 5, 10, 15, and 30 minutes

Each line below is aligned to the clock, and each one includes minute 0.

*/5 * * * *     # 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55
*/10 * * * *    # 0, 10, 20, 30, 40, 50
*/15 * * * *    # 0, 15, 30, 45
*/30 * * * *    # 0 and 30

The edit time is not stored. A line installed at 10:03 still waits for 10:05, then 10:10.

5-59/5 * * * * starts the range at 5, so minute 0 is left out. Use it only when you mean to skip the top of the hour. For a plain every-five-minutes job, keep */5 * * * *.

Drop the step when you want an hour or a day instead.

0 * * * *       # every hour, at minute 0
0 0 * * *       # every day at 00:00
0 9 * * *       # every day at 09:00
0 9 * * 1-5     # Monday through Friday at 09:00

0 * * * * fires 24 times a day, 0 0 * * * once at midnight, and 0 9 * * 1-5 on weekdays at 09:00 because day-of-month stays a star. The either-day rule starts only when both day fields are restricted. A day field that starts with *, including */2, is not restricted. See why cron runs on the wrong day.

How a step is counted

A step is a range plus /n. In the minute field, * means 0-59, so */5 is 0, then every fifth minute through 55. Twelve runs an hour.

In the hour field, 0 */2 * * * is minute 0 of every second hour: 00:00, 02:00, 04:00, and so on through 22:00.

Day of month starts at 1, not 0. On Vixie cron and cronie, * in that field is 1-31, so 0 0 */5 * * is midnight on the 1st, 6th, 11th, 16th, 21st, 26th, and 31st. It is not the dates divisible by 5 (the 5th, 10th, 15th, 20th, 25th, and 30th). If the daemon is not cronie, test that list. A cron expression generator shows the five fields. It does not simulate one daemon’s calendar, and it does not install the job.

Mistakes that move the run

Copy the five fields, not the sentence beside them. Crontab does not read “every five minutes.”

Do not add a seconds field in front. The other fields shift right. Quartz uses six fields, or seven with a year, and seconds come first. Spring uses that six-field form. EventBridge’s six fields are minutes, hours, day-of-month, month, day-of-week, and year, with no seconds field. Quartz and EventBridge both use ? in a day field. A five-field line matches neither shape.

Traditional Vixie cron does not skip a run because the previous process is still going. If the work must not overlap, take a lock in the command, for example with flock, and leave the schedule alone. systemd timers and queue workers can differ. This warning is about classic cron.

Cron’s PATH is often shorter than a login shell. Call the program by its absolute path. A stored “next run” in an API is often a Unix timestamp, not an expression. Read that number on the Unix timestamp converter. Do not paste it into the minute field.

*/5 cannot mean “five minutes from now.” Sleep in a process, or use a queue delay. The daemon still starts the command once, when the minute begins, not again at second 10 or 20.

Try it for one cycle

Point a throwaway line at a file you can delete.

*/5 * * * * date >> /tmp/cron-every-5.log

Wait until two lines are written. The minutes should be five apart, and each minute should be divisible by 5. Then delete the line. Some hosts log the start with journalctl -u cron. Others still use syslog. Use the log that machine keeps.

Full guide with the FAQ and a cron generator: https://kepttools.com/guides/cron-every-5-minutes

How to encode a URL and escape HTML in the browser

Ameen Usman — Thu, 29 Oct 2026 05:13:54 +0000

A query string and an HTML page do not escape text the same way.

This string is fine in a sentence:

<Hello World> & "KeptTools"?q=1

Put it in a URL without encoding, and & starts a new parameter. Put it in HTML without escaping, and < starts a tag. Those are two different jobs.

I use a small encoder for both. It runs in the browser, so the string is not uploaded.

https://kepttools.com/url-html-encoder

URL encoding

URL encoding turns characters that have a special meaning in a URL into % sequences.

The tool uses encodeURIComponent, which is the right function for a query value or a path segment. The sample becomes:

%3CHello%20World%3E%20%26%20%22KeptTools%22%3Fq%3D1

< is %3C, a space is %20, & is %26, " is %22, and ? is %3F.

encodeURI is the other common function, and it is not the same. It leaves &, ?, and = alone, because those characters structure a full URL. Use that when you already have a complete address. Use encodeURIComponent when the text is one value you are about to drop into a query string.

Do not run encodeURIComponent on a whole URL. It will also encode https:// and the ?, and the link will break.

HTML escaping

HTML escaping is for text that should be shown, not parsed.

The same sample, on HTML Encode, becomes:

&lt;Hello World&gt; &amp; &quot;KeptTools&quot;?q=1

< becomes <, > becomes >, & becomes &, and " becomes ". A browser then displays the characters instead of treating them as markup. An apostrophe is escaped as '.

This is the step you want before you insert user text into HTML. URL encoding does not do it. %3C is not the same thing as <.

Decoding

Each mode has a reverse.

URL Decode turns the % sequences back into characters. A broken sequence, such as a % that is not followed by two hex digits, does not decode. The page reports that the encoding is invalid.

HTML Decode turns the entities back into <, >, &, and quotes.

What stays on the machine

Paste the text, or load the sample, pick URL Encode, URL Decode, HTML Encode, or HTML Decode, and copy the result. Nothing is sent to a server.

If you are building a link, encode the value. If you are showing the value on a page, escape it for HTML. Do one, then the other, when you need both.

How to decode a JWT in the browser

Ameen Usman — Wed, 28 Oct 2026 04:33:04 +0000

A JWT looks secret. It is not. The header and the payload are only Base64url text. Anyone who has the token can read the claims. The signature is the part that proves the token was issued by someone who holds the key, and that check does not happen by decoding it.

This is the distinction I keep having to make while debugging login. A readable exp or sub is useful. It is not proof the token is valid.

What the three parts are

A JWT is three pieces separated by dots:

header.payload.signature

The header names the algorithm, usually HS256 or RS256. The payload holds the claims: sub, name, role, iat, exp, and whatever else the issuer put there. The signature is the third part. A decoder shows it. It does not check it.

Base64url is not encryption. Changing - and _ back to + and /, padding with =, and running a Base64 decode gives you JSON. No secret is required for that step.

A token you can read by eye

The sample on the KeptTools JWT decoder is shaped like a real token, with a placeholder in the signature slot so you can see the three parts:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IktlcHRUb29scyBVc2VyIiwiaWF0IjoxNzA5ODAwMDAwLCJleHAiOjE3Mzk4MDAwMDAsInJvbGUiOiJkZXZlbG9wZXIifQ.signature-placeholder

The header decodes to:

{
"alg": "HS256",
"typ": "JWT"
}

The payload decodes to:

{
"sub": "1234567890",
"name": "KeptTools User",
"iat": 1709800000,
"exp": 1739800000,
"role": "developer"
}

iat and exp are Unix timestamps in seconds. 1709800000 is the issued-at time. 1739800000 is the expiry. Compare exp with the current time before you treat the session as active. An expired token still decodes.

What decoding does not tell you

A decoded payload does not mean:

the signature matches the header and payload
the token came from your server
the token has not been edited
the session is still valid

Signature checks belong on the server that holds the HMAC secret or the public key. For HS256, that secret must never be in frontend code. For RS256, the browser can hold a public key, but verification is still a separate step from reading the JSON.

If you only need to see why a request is failing, decoding is enough. If you are deciding whether to trust the token, it is not.

Do it without uploading the token

Paste the token into a page that decodes it locally, or do the same two Base64url decodes in your own console. Either way, a production access token or a refresh token should not be sent to a server you do not control.

I use the decoder at https://kepttools.com/jwt-decoder for this. The token stays in the tab. The page shows the header, the payload, and the signature string. It does not verify the signature, and it does not load analytics on that page.

Paste a token, or load the sample. Read alg in the header and exp in the payload. Then verify the signature in the app that issued the token.

Turn PDF pages into JPG images in your browser

Ameen Usman — Mon, 26 Oct 2026 10:26:08 +0000

A PDF page is often the wrong format for a slide, a chat message, or a blog image. Uploading the whole document just to export one page is a poor trade.

PDF to JPG does that conversion in the browser. The file stays on your device. Nothing is uploaded.

How to export the pages

Open the PDF.
Choose all pages, or enter a range such as 1-3, 5.
Pick High, Medium, or Low quality.
Convert, preview the pages, then download one JPG or a ZIP of all of them.

A 5-page deck on High comes back as five images. Preview them before you download the ZIP.

The limit shown on the page is 40 pages and 25 MB. A password-protected PDF has to be unlocked first.

What the JPG is

Each page becomes a flat image. Text that you could select in the PDF cannot be selected in the JPG. Use this when you need a picture. Keep the original PDF when you still need selectable text.

Where it runs

The page is drawn in the browser and saved as a JPG from there. I do not receive the file.

Tool: https://kepttools.com/pdf-to-jpg

Merge, split, and compress PDFs in your browser

Ameen Usman — Sun, 25 Oct 2026 07:55:38 +0000

I kept avoiding random PDF websites for contracts, invoices, and reports. Those files should not leave the laptop just to merge two exports or pull out one page.
So I added PDF tools to KeptTools. They run in the browser. Nothing is uploaded.

Merge a few PDFs into one

Open Merge PDF.

Add two or more PDFs.
Put them in the order you want. Remove any you do not need.
Merge and download one PDF. Example: add report-a.pdf and report-b.pdf, put A first, then download kepttools-merged.pdf with every page in that order. You can merge up to 20 files, 25 MB each. Password-protected PDFs have to be unlocked first. ## Pull pages out of a long PDF Open Split PDF.
Choose one PDF.
Enter ranges, or split every page.
Download one PDF, or a ZIP when there is more than one result. Ranges look like 1-3, 5 or 1-3, 7-10. Page numbers start at 1. Example: a 10-page PDF with 1-3, 7-10 comes back as two files in a ZIP. Pages 1–3 in one, pages 7–10 in the other. ## Shrink the file, keep the text Compress PDF recompresses images inside the PDF. Light, Medium, and Strong change image quality. The text stays real text, so you can still select it. A text-only PDF may barely get smaller. That is an honest result, not a broken tool. Use it when the PDF has photos or scans and you need a smaller file for email. ## Turn pages into images, or images into a PDF PDF to JPG exports pages as JPG. Pick all pages or a range, choose quality, preview, then download one image or a ZIP. After this step the page is a picture, so the text is no longer selectable. JPG to PDF does the other direction. Add JPG, PNG, or WebP images, reorder them, then set page size (A4, Letter, or fit), orientation, and margins. Fit inside keeps the photo proportions. Stretch can distort them. ## What stays on your machine The file is read in the browser and the result is downloaded from there. I do not receive the PDF. If you try one, tell me whether you needed merge, split, or compress first.

Unix Timestamp Converter That Runs in Your Browser

Ameen Usman — Sat, 24 Oct 2026 07:48:52 +0000

I still paste Unix timestamps into random converters more often than I want to admit.

created_at: 1729000000

exp: 1735689600

The number is fine. The worry is the same every time: does this page upload what I paste?

What I needed

A tiny converter that:

accepts epoch seconds or milliseconds
shows UTC (ISO) and local time
lets me copy the ISO string
has a Use now button for the current timestamp
does the work in the browser

So I added one to KeptTools.

Try it

👉 Unix Timestamp Converter

Example:


text
1729000000
→ 2024-10-15T13:46:40.000Z

Cron Generator Online: Build Expressions in Your Browser

Ameen Usman — Tue, 20 Oct 2026 15:45:13 +0000

Cron Generator Online: Build Expressions in Your Browser

Cron schedules are simple… until you’re staring at five fields and guessing.

I built a Cron Expression Generator inside KeptTools so you can:

pick a preset (hourly, daily, weekdays 9am, etc.)
edit minute / hour / day / month / weekday
read a plain-English summary
copy the expression into crontab

Example:

Preset: Weekdays 9am
Expression: 0 9 * * 1-5

Browser-only

Processing stays in your browser. Nothing is uploaded.

Try it: https://kepttools.com/cron-generator

Full toolkit (JSON, JWT, regex, and more): https://kepttools.com

If you use cron a lot, what preset do you want added next?

I built KeptTools so your JWT, SQL, and Base64 never leave the browser

Ameen Usman — Mon, 19 Oct 2026 15:50:32 +0000

I built KeptTools so your JWT, SQL, and Base64 never leave the browser

Most “free online tools” are convenient until you paste something you shouldn’t.

A JWT from staging.

A SQL dump with real emails.

A Base64 string that still holds a secret.

If that page uploads your paste, you’ve already shared more than you meant to.

The problem

I kept needing small utilities:

format / validate JSON
format SQL
decode a JWT
encode / decode Base64
generate hashes
tweak images

…but I didn’t want to trust random sites with the paste.

So I built KeptTools — a set of browser-only developer tools.

How it works

Processing runs in your browser.

Nothing you paste is uploaded for processing.

On the more sensitive pages (JWT, Base64, hash, password generator):

no analytics
no ads
no third-party scripts

Tip: open DevTools → Network while you use those pages. You should not see a request carrying your paste.

What’s included

KeptTools currently covers everyday work like:

JSON formatter / converter
SQL formatter
JWT decoder
Base64 encode / decode
Hash generator (MD5, SHA-1, SHA-256, SHA-512)
URL & HTML encode / decode
Regex tester
Image convert / compress / crop / background tools
and more

All free to use: https://kepttools.com

Why I’m sharing this

I’m not claiming this replaces your local CLI or IDE.

I’m claiming something simpler:

If a tool can run in the browser, it shouldn’t need your paste on a server.

If you try it, I’d love blunt feedback:

Is the privacy angle clear on first visit?
Which tool would you use weekly?
What’s missing?

Thanks for reading — and if you try it, open Network and verify it yourself.

How to prove an online JWT tool isn’t stealing your token

Ameen Usman — Sun, 18 Oct 2026 15:28:56 +0000

Most free JWT decoders ask you to paste a token.

That’s a trust problem. Tokens can include emails, roles, and session data. If the page uploads it, you just gave secrets to someone else’s server.

Here’s the fastest way to check any tool:

Use the Network tab

Open DevTools (F12)
Open Network
Paste a sample token
Watch for requests

If decoding fires a request with your token, leave.

A privacy claim is marketing. An empty Network tab is evidence.

Try a local decoder

I built a browser-only JWT decoder here:

https://kepttools.com/jwt-decoder

No account. Nothing uploaded. Open Network while you decode and confirm it yourself.

If you try it, tell me bluntly: is the privacy story clear in 5 seconds?