DEV Community: chubiao huang (MR HUANG)

I built a camo tracker that never asks you to log in

chubiao huang (MR HUANG) — Wed, 21 Oct 2026 05:19:07 +0000

I built a camo tracker that never asks you to log in

32 weapons, 576 camo challenges, progress saved in localStorage. No account, no sync, no backend.

Live: MW4Field camo tracker · Weapon stats: MW4 weapons database · Map: Hajin interactive map

Every camo tracker I tried wanted an account first. Sign up, connect your platform, grant permissions, then maybe get a checklist. For a grind that resets every game, that is a lot of commitment for a table of checkboxes.

So I took the boring approach: the state lives in the browser, and the site never learns who you are.

What it actually does

The camo system in MW4 is large enough that a spreadsheet gets unwieldy fast. The tracker covers:

32 weapons across 9 classes (Assault Rifle, SMG, Shotgun, LMG, Marksman, Sniper, Pistol, Launcher, Melee)
18 camos per weapon, 576 challenges in total
Three separate mode profiles, so multiplayer, zombies and campaign progress do not overwrite each other
Backup / Restore as JSON, which is the escape hatch for the browser-only trade-off
A search box, and each weapon card shows 0 / 18 plus a prestige count without opening anything

The counting detail matters more than it sounds. When a roster is hand-entered it drifts: one duplicated weapon in the source list and every percentage in the UI is quietly wrong. On this site the totals are derived from the roster data at build time, so adding or removing a weapon updates the counters instead of leaving a stale number behind.

Why `localStorage` and not a database

Three reasons, in order of how much they mattered:

No account means no friction. The tool is useful at the moment you unlock a camo, which is usually ninety seconds after you stopped playing.
Nothing to leak. The site only ever stores a set of completed challenge ids. There is nothing to breach that is worth breaching.
Cheap to run. A static site with no auth, no sessions, and no database is a static site that stays up.

The trade-off is real and worth stating plainly: clear your browser data and the progress is gone, and there is no automatic phone-to-PC sync. That is why the export exists — a JSON file you can drop back in on another device.

The general lesson for small tools

If you are building a tracker, a checklist, or a calculator for a fan site, ask whether the feature needs an account at all. Most progress tools need exactly one thing from the backend: a place to put a set of ids. localStorage is that place, shipped for free, on every device you care about.

The constraints you accept:

single device unless you move the export yourself
progress lost on hard reset
no server-side analytics on what people are grinding

For a free fan tool, all three are acceptable. For anything you would charge for, none of them are.

What comes next

The tracker is one of the four tools on MW4Field, an independent Modern Warfare 4 field guide. The map has zone-level threat data and POIs with source dates, and the DMZ code ledger labels every row as confirmed or community-reported.

If you use it and something is missing — a weapon, a camo, a challenge that is not counted — the source is on GitHub and the fix is usually a data row.

MW4 DMZ Codes: What's Actually Confirmed (and What's Still a Rumor)

chubiao huang (MR HUANG) — Tue, 20 Oct 2026 13:58:56 +0000

MW4 DMZ Codes: What's Actually Confirmed (and What's Still a Rumor)

13 campaign keypad codes are confirmed across four missions. The Hajin bunker codes are not public yet. Here is a status-labeled breakdown, with a source and last-checked date on every row.

Reference page: mw4field.com/dmz-codes · Map: Hajin interactive map

Search "MW4 safe codes" today and you get a wall of pages that all look the same: a bold table, a list of four-digit numbers, and no indication of where any of it came from.

Most of them are guessing. Some of them are copy-pasting each other's guesses. A few are mixing up three completely different things.

That last part is the actual problem, so let's start there.

Three things people call "codes"

The word "code" covers three unrelated systems in MW4, and conflating them is why so many lists are wrong:

What it is	Where it's used	Is it public?
Campaign keypad / container code	Fixed 4-digit combinations inside campaign missions	Yes — confirmed and reproducible
DMZ safe / Hajin bunker lock	In-game locked containers and bunker doors in DMZ	Not yet — no fixed public list
Redeem / access code	Account-level codes entered outside the game	Separate system entirely

If a page hands you a "DMZ safe code" with no mission name attached, you're almost certainly looking at the first category being mislabeled as the second. Those codes will not open a DMZ container.

TL;DR — what's confirmed right now

13 campaign combinations are confirmed, spread across 4 mission groups.
0 fixed Hajin bunker codes have been publicly confirmed.
1 DMZ code type is community-reported only, and should be treated as unverified until you enter it in-game.
6 FOB stations gate the deeper rooms, and upgrades are bought with DMZ Cash, not real money.

That's the honest state of things. Everything below is detail.

The 13 confirmed campaign codes

These are fixed, mission-specific, and reproducible. They are the reliable baseline — practice on these before a DMZ run, because the input mechanics are identical.

Mission	Exact location	Code	What it opens
Following Orders	Red toolbox in the first house	`214`	Toolbox supplies
Assassins	Library service door	`5523`	Route into the library
Assassins	Kitchen and pantry exit	`7632`	Route toward the bunker
Assassins	Bunker entrance behind the statue	`9103`	Bunker access
Stranded	Base Camp container	`0024`	Container supplies and route hints
Stranded	South of the Jamming Station	`8609`	Locked shipping container
Stranded	Southeast village	`0078`	Locked shipping container
Stranded	Cliffs near Base Camp	`0600`	Locked container
Stranded	Large sign	`1234`	Green shipping container
Stranded	Small island	`6789`	Container by the water
Stranded	Farm field hidden bunker	`0330`	Supplies + Yellow Supply Crate
Stranded	Northwest island hidden bunker	`0008`	Yellow Supply Crate
Escape	Wall safe in the office after the barracks	`8410`	Gaz's dog tags (Never Forgotten achievement)

Two things worth flagging:

Leading zeros matter. 0024 is not 24. 0078 is not 78. If a code isn't working, retype it with the exact digit count before you assume the code is wrong.

The game keeps running while you enter a code. In the Assassins mission especially, you're not in a safe menu — the world is live. Clear the room first.

The full list with per-mission context lives on the campaign codes page.

Why Hajin bunkers don't have a code list

This is the part that most code lists get wrong by omission.

Hajin bunkers use multi-step door puzzles and intel notes, not a fixed combination you can look up. The lock logic is the puzzle — you're meant to find the sequence in the world, not paste it from a website.

So when you see "Hajin bunker code: 4821" posted somewhere, one of three things is true:

It's a campaign code with a DMZ label slapped on it.
It's a rotation someone hit once and generalized.
It's fabricated for traffic.

DMZ rotations are tracked as community reports, not facts. That distinction is the whole point of the page: each entry carries its own status, its source, and the date it was last checked. A community report is a lead, not a guarantee.

If you want to find the simplest approaches to each bunker, the interactive Hajin map tracks which zones have the cleanest routes in.

The FOB stations that actually gate your progress

Codes get the clicks, but the FOB unlock order is what determines whether you can even reach the locked rooms. Six stations, each with a requirement:

Station	Requirement	What it does
3D Printer	DMZ Player Level 2	Craft gear; upgrade FOB stations with printer ingredients
Boss Board	Complete your second DMZ Order	Buy intel on Lieutenants before hunting them
Vendor	DMZ Player Level 5	Buy rotating weapons and items with DMZ Cash
Gunsmith	DMZ Player Level 10	Build and re-attach guns; Weapon Manuals widen the pool
Dog Tag Case	DMZ Player Level 20	Display collected Dog Tags and protect favourites
DMZ Progression Track	Available from the start	Unlocks recipes, stations and content through level 70

Note the pattern: everything except the progression track is a level gate or a mission gate. There's no shortcut to buy past them.

Early crafting recipes

Once the 3D Printer is up, these are the recipes you'll actually use in the first few hours:

Item	Cost
Bandage	15 Synthetics + 15 Chemicals
Medkit	30 Chemicals + 1 Rare Binding Catalyst + 5 Uncommon Biomaterials
1-Plate Armor Vest	25 Synthetics + 25 Metals
2-Plate Armor Vest	50 Synthetics + 5 Uncommon Reactive Metals
Small Backpack	25 Synthetics + 25 Metals
Medium Backpack	50 Synthetics + 5 Uncommon Rigid Synthetics

The jump from 1-plate to 2-plate is the first real material wall — 50 Synthetics instead of 25, plus a tier of Reactive Metals you won't have early. You can price out a specific craft before committing materials with the 3D Printer calculator.

Six zones where the locks actually matter

Locked loot concentrates in high-threat zones. These are the six currently at High threat or above:

14th Political Prison
Chang-san Air Base
Cheongun Village
Haneul Nuclear Reactor
NuriGO Mall
The Grid

28 official POIs are mapped in total, each with a source and a last-checked date. If you're planning a route rather than hunting a specific code, start from the Hajin map and work outward from the zone with the approach you can actually survive.

How to tell a real code list from a fake one

This is the transferable part, and it applies well beyond MW4.

A trustworthy code page shows four things per entry:

Status — confirmed vs. community-reported vs. unverified.
Exact location — not just the mission name, but the door.
Source — who verified it.
Last checked — a date, so you know how stale it is.

A page that shows only a number and a heading is telling you nothing about reliability. The number is the cheapest part to fabricate; the provenance is the expensive part.

That's the standard the DMZ codes page is built to, and it's why it currently says "no fixed public Hajin bunker codes exist yet" instead of inventing thirteen rows.

One more distinction worth making

If you're looking for an early-access or redeem code — the kind you type into an account page, not a keypad — that's a different system entirely. Those open access, not doors, and they're covered separately on the MW4 redeem code page.

Mixing those up is the single most common reason someone enters a valid code at the wrong place and concludes the code is broken.

Quick reference

MW4 safe codes and keypad codes — the status-labeled ledger
All campaign codes — the 13 confirmed combinations
Hajin interactive map — zone-by-zone approaches
3D Printer calculator — price a craft before you spend materials
FOB and progression guide — the unlock order in full

MW4Field is an independent MW4 database with a DMZ focus. Campaign codes are sourced from GamersBeacon and checked 2026-10-19; FOB requirements and recipes come from the official DMZ preview and community testing, and values can change at launch. DMZ keypad rotations remain community-reported until verified in-game.

Building a Multi-Model AI Video Studio: Notes from Kivide

chubiao huang (MR HUANG) — Tue, 20 Oct 2026 07:21:57 +0000

Building a Multi-Model AI Video Studio: Notes from Kivide

What it actually takes to put 19 image/video models behind one interface — routing, credit accounting, and the prompt layer nobody talks about.

Try it: kivide.com · Prompt library: kivide.com/prompts

Every few weeks a new video model drops. Seedance 2.5, Kling 2.5 Turbo, Wan 2.7, MiniMax H3, Veo, Sora. Each one is better at something different — one nails motion, another nails faces, a third is cheap enough to use for iteration.

If you're building a product on top of them, you hit the same wall fast: users don't want to choose a model. They want a result.

This post is about how Kivide is structured around that problem. It's not a launch announcement — it's the engineering notes: what the model layer looks like, how credits are accounted for across 19 models, and why the prompt layer turned out to be the hardest part.

The core problem: models are not interchangeable

The naive design is "one generate endpoint, a model parameter, done." That breaks immediately, because models disagree on almost everything:

Dimension	Why it breaks a generic interface
Input modality	Some are text-to-video only, some accept image-to-video, some do both
Duration	5s / 10s / variable — and pricing often scales per second
Resolution	480p / 1080p / 2K / 4K, each with a different cost
Aspect ratio	16:9, 9:16, 1:1 — and composition prompts don't transfer between them
Latency	20 seconds to several minutes
Failure modes	Moderation rejection, queue timeout, provider rate limit, silent partial output

So the model layer can't be a thin proxy. It has to be a capability descriptor that the rest of the system reads from.

What that looks like

Each model is described by data, not by branching code:

type ModelSpec = {
  id: string
  kind: 'video' | 'image'
  inputs: ('text' | 'image')[]
  durations?: number[]        // video only
  resolutions?: string[]      // video only
  ratios: string[]
  // Credit cost per generation, per plan tier
  cost: {
    regular: number
    starterYearly: number
    proYearly: number
    unlimited: number | 'Unlimited'
  }
}

The UI, the pricing table, and the generation endpoint all read from this. Adding a model means adding a row — not touching the routing logic.

Here's what that actually looks like in production. These are live numbers from kivide.com/api/pricing:

Model	Type	Credits (regular)	Credits (Pro yearly)
Seedream 5.0 Lite	image	30	18
GPT Image 2	image	30	18
Nano Banana Pro 1K	image	30	18
Nano Banana 2	image	40	24
Seedream 5 Pro	image	50	30
Nano Banana 2 4K	image	70	42
MiniMax H3 480p	video	80	48
MiniMax H3 Max 480p	video	100	60
Omni Flash 10s	video	140	84
MiniMax H3 1080p	video	150	90
Wan 2.7	video	200	120
MiniMax H3 Max 1080p	video	220	132
Seedance 2.5	video	250	150

The spread is 8x between the cheapest image model and the most expensive video model. That spread is the whole reason the credit system has to be exact.

Credits: why not just charge per generation

The obvious model is "one generation = one credit." It falls apart because a 4K image and a 10-second 1080p video cost the provider wildly different amounts.

So credits are a normalized unit of provider cost, not a unit of user action. A few consequences:

1. Cost has to be decided before the request is sent.
You can't tell the user "this cost 150 credits" after the fact. The model spec is resolved first, the cost is computed, and only then is the request made.

2. Balance has to be reserved, then reconciled.
Two concurrent requests against the same balance can both pass the check and both spend. The pattern that works:

1. Read balance
2. Check balance >= cost          (fail fast, no charge)
3. Deduct cost immediately        (reserve)
4. Call the provider
5. On success  → keep the deduction
   On failure  → refund the exact amount

Step 3 before step 4 is deliberate. Deducting first means a crash mid-request can't leave the user with free generations — it leaves them with a refund owed, which is the safer failure direction and is recoverable from logs.

3. Refunds have to be idempotent.
Provider webhooks retry. If a refund is keyed only on "this generation failed," a retried webhook refunds twice. Every refund needs a deterministic key derived from the generation id.

4. Plan tier changes the price, not the model.
Pro-yearly users pay 60% of the regular rate for the same model. That's a pricing decision, not a routing one — so the cost table is keyed by (model, tier), and the tier is resolved from the subscription at request time.

The prompt layer is the actual product

Here's the part that surprised me.

Once the model layer is abstracted, switching models is cheap. What's not cheap is that a prompt tuned for one model produces garbage on another. The same sentence that gives you a beautiful cinematic shot on Seedance gives you a flat, static image on a cheaper model.

Three things that consistently matter more than style adjectives:

Camera direction is the highest-leverage token

❌  "a beautiful cinematic shot of a motorcycle at night"
✅  "low-angle shot of a rider on a white sport motorcycle
     speeding down a highway at night. Red taillight streak."

The second one specifies a camera position (low-angle) and a physical artifact (red taillight streak, which only appears in a long exposure). The model has seen thousands of real photos matching that description, so it has something concrete to reproduce.

"Beautiful" and "cinematic" are not instructions. They're adjectives the model has learned to ignore because they appear in every prompt.

Motion verbs decide whether video looks like video

A text-to-video prompt with no motion verb produces a still image with a slow digital zoom. Always include one:

slow dolly forward
tracking shot following
handheld, slight shake
orbit around

Physical detail forces rendering

dust trails, steam rising, water droplets frozen mid-air, film grain, soft bokeh. These are rendering instructions, not mood words. They tell the model which optical phenomenon to simulate.

What this looks like end to end

A generation request goes through five stages:

1. Resolve model spec        →  inputs, ratios, cost
2. Check + reserve credits   →  fail fast if insufficient
3. Validate input            →  image dimensions, duration, ratio
4. Dispatch to provider      →  with a per-provider timeout
5. Reconcile                 →  keep charge on success, refund on failure

The interesting failures are all in stage 4 and 5:

Provider timeout — the job may still complete on their side. You need a sweeper that reconciles orphaned generations, or users get charged for nothing.
Moderation rejection — comes back as a provider error, but it's not your error. It shouldn't be refunded differently than a technical failure, but it should be logged differently.
Partial success — a 10-second video that comes back as 5 seconds. Treat output validation as a separate check from HTTP status.

A concrete example, start to finish

Let me walk through one prompt from the library to show what "specific" means in practice.

Goal: a cyberpunk night motorcycle shot.

First attempt (what most people write):

A cool cyberpunk motorcycle rider at night, neon lights, cinematic, 8K, highly detailed

What comes back: a static portrait of a motorcycle. Nice lighting. No sense of motion. Looks like a stock photo.

Rewritten using the five slots:

Low-angle shot of a rider on a white sport motorcycle speeding down a highway at night. Red taillight streak, cyberpunk night vibe, 8K.

Slot	Content
Subject	`a rider on a white sport motorcycle`
Action	`speeding down a highway`
Camera	`low-angle shot`
Lighting/mood	`cyberpunk night vibe`
Quality	`8K`

The two words doing the most work are low-angle and taillight streak. The first sets the camera below the subject, which makes speed read. The second is a long-exposure artifact — it implies the camera is tracking the bike, which is what makes the image feel like a still from a video rather than a render.

Run it: kivide.com/prompts/cyberpunk-night-motorcycle-prompt

More output examples

Both of these came from prompts in the public prompt library — each one is a copy-paste-ready prompt with a one-click "use this" action that opens the studio pre-filled.

Things I'd do differently

Start with the cost table, not the UI. The model/cost matrix is the actual product constraint. Building the UI first means rebuilding it when you discover a 4K model costs 8x a lite one.

Make refunds a first-class flow from day one. Retrofitting idempotent refunds onto a system that already has users is painful.

Treat prompts as data, not strings. Once prompts live in a structured library (subject / motion / camera / mood / quality), you can A/B them, version them, and generate landing pages from them. Strings in a textarea can't do any of that.

Don't hide the model choice entirely. Users who care will find out anyway, and the ones who don't care are served fine by a good default. Hiding it completely creates support tickets.

Try it

Kivide — AI video + image studio, multiple premium models, no credit card to start
Prompt library — copy-paste prompts, one click to run
AI Video Studio — text-to-video and image-to-video
AI Image Studio — FLUX, Qwen, Seedream, Nano Banana

If you're building something similar and want to compare notes on the credit accounting or the provider abstraction, the comments are open.

Disclosure: I build Kivide. The numbers in this post are read live from the production pricing API, not from memory.

How to Generate a Secure JWT Secret Key in 2026 (Node.js, Python, Java)

chubiao huang (MR HUANG) — Thu, 15 Oct 2026 18:13:13 +0000

A JSON Web Token (JWT) is only as strong as the secret key that signs it. Yet the single most common JWT vulnerability in production is still a weak, hardcoded, or leaked secret. This guide shows you how to generate a cryptographically secure JWT secret key, how long it should be, and how to use it correctly in Node.js, Python, and Java.

What is a JWT secret key?

A JWT secret key is a private, random string used to sign a JSON Web Token. The signature is what proves two things:

The token was issued by your server (not forged by an attacker).
The token's payload has not been modified since it was signed.

When you use a symmetric algorithm such as HS256, the same secret is used both to sign and to verify tokens. If an attacker learns your secret, they can mint valid tokens for any user — a full authentication bypass. That is why the secret must be long, random, and private.

How long should a JWT secret be?

Match the key length to the signing algorithm:

Algorithm	Minimum secret length	Recommended
HS256	256 bits (32 bytes)	32–64 bytes
HS384	384 bits (48 bytes)	48–64 bytes
HS512	512 bits (64 bytes)	64 bytes

A secret that is too short (or a human-memorable passphrase) can be brute-forced offline. Because the attacker has the signed token, they can guess secrets locally as fast as their hardware allows — there is no rate limit. Use a cryptographically secure random generator, never Math.random(), never a password you made up.

How to generate a secure JWT secret key

The safest and fastest way is a generator that runs entirely in your browser and never sends the key anywhere:

👉 JWT Secret Key Generator — jwtsecrets.com — generates a cryptographically strong key with one click, supports 32–512 bits, and never transmits or stores your key.

If you prefer the command line or your own code, here are the correct ways to do it in each language.

Node.js

node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

Or in code:

const crypto = require('crypto');
const secret = crypto.randomBytes(64).toString('hex'); // 128 hex chars = 512 bits

Python

import secrets
secret = secrets.token_hex(64)  # 128 hex chars = 512 bits
print(secret)

secrets is the CSPRNG-backed module — never use random for this.

OpenSSL (any OS, one-liner)

openssl rand -base64 64

Java

import java.security.SecureRandom;
import java.util.Base64;

byte[] bytes = new byte[64];
new SecureRandom().nextBytes(bytes);
String secret = Base64.getEncoder().encodeToString(bytes);

Using the secret in your application

Node.js with `jsonwebtoken`

require('dotenv').config();
const jwt = require('jsonwebtoken');

const secret = process.env.JWT_SECRET; // from your .env, never hardcoded

// Sign
const token = jwt.sign({ sub: user.id }, secret, { expiresIn: '15m' });

// Verify
try {
  const payload = jwt.verify(token, secret);
} catch (err) {
  // invalid or expired token
}

Python with PyJWT

import os, jwt

secret = os.environ["JWT_SECRET"]

token = jwt.encode({"sub": user_id}, secret, algorithm="HS256")
payload = jwt.decode(token, secret, algorithms=["HS256"])

Three mistakes that leak your JWT secret

Hardcoding the secret in source control. Once a secret is committed, assume it is public — even if you delete it later, it lives on in git history and forks. Store secrets in environment variables or a secrets manager (AWS Secrets Manager, Google Secret Manager, HashiCorp Vault).
Reusing one secret everywhere. Use a different secret per environment (dev / staging / prod) and per service. A leak in one place should not compromise everything.
Never rotating. Rotate your signing secret on a schedule and immediately after any suspected exposure. Plan for rotation so old tokens can expire gracefully.

Symmetric secret vs. asymmetric key: which do you need?

Symmetric secret (HS256): one shared key signs and verifies. Simplest. Best when a single service issues and verifies its own tokens.
Asymmetric key (RS256 / ES256): a private key signs, a public key verifies. Use this when multiple services or third parties must verify tokens without being able to create them — for example, an auth service issuing tokens that many microservices consume.

If you need RSA or EC keys instead of a symmetric secret, generate a key pair rather than a shared secret.

FAQ

Is it safe to generate a JWT secret in a browser?
Yes, if the tool generates the key locally with the Web Crypto API and never sends it over the network. The JWT Secret Key Generator does exactly that — you can even disconnect from the internet before generating.

Can I just use a long password as my JWT secret?
You can, but you should not. Passwords have far less entropy per character than random bytes and are vulnerable to dictionary attacks. Always use a CSPRNG.

What happens if my JWT secret leaks?
Anyone with the secret can forge tokens for any user. Mitigate immediately: rotate the secret (which invalidates existing tokens), and consider a token revocation/denylist while the new secret propagates.

A strong JWT secret is a two-minute task that prevents a whole class of authentication vulnerabilities. Generate one with a CSPRNG, keep it out of source control, and rotate it on schedule.

Generate your JWT secret key now → jwtsecrets.com

Also useful: JWT Decoder to inspect any token's header and payload.

Why Everyone's Suddenly Measuring Their Face Instead of Filtering It

chubiao huang (MR HUANG) — Tue, 11 Aug 2026 07:40:10 +0000

There's a moment a lot of people know. You catch your reflection in a dark phone screen, or you see yourself in a video call thumbnail at some angle you never chose, and you think: wait, is that actually what I look like?

For years the only answer was a filter. Smooth the skin, widen the eyes, narrow the jaw, post it, move on. It felt good for a second and told you nothing real.

That's changed this year. The tools people reach for now aren't filters. They're measurement tools. And I think the shift says less about vanity than about a plain question a lot of us have: I don't just want to look better in a photo, I want to know what I'm actually working with.

From Filters to Real Data

The filter era was built on distortion — stretch this, blur that, guess at "attractive." It never told you anything you could actually use.

What's replacing it looks more like biometrics than Instagram. AI face analysis tools now use the same landmark-detection tech that shows up in medical imaging and computer vision research, just pointed at a more personal question: how symmetrical is this face, really? Where do the proportions sit against known ratios? What's the actual geometry, not the flattering version of it?

This is basically the engine behind looksmaxxing tools — a term that started in fringe forums and has since become normal shorthand for using data instead of guesswork to understand your own face. Search interest in things like "facial symmetry test" and "golden ratio face calculator" has been climbing for a while, and I don't think it's because people got shallower. It's because now there's something to search for that gives you a real answer.

How These Tools Actually Work

I'll use FaceRated here, mostly because it's the clearest example of where this whole category is heading — a face rating tool that's become a kind of reference point for how mature the tech has gotten.

You upload a photo — except you don't really "upload" it. The image never leaves your device. FaceRated maps 478 individual points across your face directly in your browser, the same kind of dense landmark mesh used in facial-recognition research, and runs the whole analysis locally. No server round trip, no account, no email address.

In about three seconds you get a beauty score from 0 to 100, plus a breakdown of the geometry behind it. That speed matters — this isn't a multi-step signup flow, it's closer to a mirror that happens to do math.

If you want more, a one-time report unlocks 40+ additional measurements, a 3D reconstruction of your face mesh, and a plain-language rundown of what's structural versus what's actually adjustable. But the free version isn't a stripped-down teaser to bait you into paying — it's a complete first look on its own, which is rarer in this space than it should be.

What the Six Dimensions Actually Tell You

This is the part that stops feeling like a party trick.

Instead of one vague number, the analysis breaks into six dimensions: symmetry, adherence to golden ratio proportions, jawline definition, canthal tilt (the angle of your eyes relative to horizontal), facial thirds (the vertical balance between forehead, midface, and lower face), and eyebrow position relative to the eye socket.

Here's what mine looked like when I ran it on a lunch break, out of curiosity more than anything: strong facial thirds, a slightly negative canthal tilt, and a jawline score lower than I expected — not because anything was "wrong," but because my jaw angle sits a bit wider than the reference range it compares against. It also flagged mild asymmetry between my left and right brow height, which I genuinely hadn't noticed until it was pointed out, and now can't unsee in old photos.

None of that felt like an insult, honestly. It felt like the kind of thing an orthodontist or a portrait photographer has always been able to see, just handed to a regular person for once. A facial symmetry test used to mean calipers and someone else's professional opinion. Now it's a free scan on your phone.

Why "It Never Leaves Your Device" Matters

Faces are about as sensitive as personal data gets. A face photo sitting on someone's server tied to your account is a very different risk from a face photo that gets analyzed in your browser tab and disappears the moment you close it.

This is probably the most important design decision in the whole category, and it's the one a lot of competitors have been slower to take seriously. Plenty of earlier tools here — things like thefacereport, facewow, moggedup — do one job fine, whether that's a quick score or a symmetry overlay, but most still send your photo through a server, and few make privacy the headline instead of a line buried in the terms of service.

FaceRated's approach — no upload, no account, nothing stored, everything processed on-device — treats privacy as the baseline instead of a paid add-on. When you're using an AI face analysis free tool on your own face, "where does this photo actually go" shouldn't be something you have to dig for.

What's Next: Beyond the Face

The more interesting part isn't the face score itself, it's what's getting bolted onto it. FaceRated has started adding body analysis using the same on-device model, plus a set of cosmetic procedure calculators that let someone explore what a change to their jawline or brow might look like before they ever sit in a consultation room.

It's also rolling out in Brazilian Portuguese and Simplified Chinese alongside English, which matters more than it sounds. A lot of this kind of tech got built and tested mostly on English-speaking, Western datasets and audiences. Bringing the same private, on-device tools to more languages is a sign the category is growing past its novelty-app phase into something more like a real utility.

Where it's heading is pretty clear: one platform covering face, body, and cosmetic planning, instead of five separate single-purpose apps, none of it requiring you to hand a photo to someone else's server.

Try It Yourself

You don't need to decide in advance whether you care about your canthal tilt. Point a camera at yourself, wait three seconds, see what the geometry actually says — free, private, nothing saved anywhere.

That's basically the whole trend in one sentence: less filtering, more measuring. Less "how do I look," more "here's what's actually there."

Try FaceRated for free → facerated.com

Why Use Our Free Online UUID Generator?

chubiao huang (MR HUANG) — Sat, 13 Sep 2025 16:11:12 +0000

✅ Instant uuid generation (uuid4, uuid v1, uuid v5)
✅ Works across JavaScript, Python, Node.js, Java, C#, Golang
✅ Supports random uuid, guid, and universal unique identifier generation
✅ No installation required – generate uuid online easily
✅ Uses secure Web Crypto API for randomness (uuid4)
FAQ about UUIDs and GUIDs
What is a uuid? A universally unique identifier (UUID) is a 128-bit string that helps identify information uniquely without coordination.
What is a guid? GUID (Globally Unique Identifier) is Microsoft's term for UUID; functionally, they are the same.
How do I generate uuid online? Use this tool to instantly get uuid4, uuid v1 or uuid v5 online, copy and use anywhere.
Is uuid secure? UUID v4 is based on random numbers, using secure crypto sources; uuid v1 uses timestamp + MAC, so avoid exposing sensitive info.
Can I use uuid in databases? Yes! PostgreSQL uuid, Java uuid, Node js uuid, and more are widely used as primary keys.

DEV Community: chubiao huang (MR HUANG)

I built a camo tracker that never asks you to log in

I built a camo tracker that never asks you to log in

What it actually does

Why localStorage and not a database

The general lesson for small tools

What comes next

MW4 DMZ Codes: What's Actually Confirmed (and What's Still a Rumor)

MW4 DMZ Codes: What's Actually Confirmed (and What's Still a Rumor)

Three things people call "codes"

TL;DR — what's confirmed right now

The 13 confirmed campaign codes

Why Hajin bunkers don't have a code list

The FOB stations that actually gate your progress

Early crafting recipes

Six zones where the locks actually matter

How to tell a real code list from a fake one

One more distinction worth making

Quick reference

Building a Multi-Model AI Video Studio: Notes from Kivide

Building a Multi-Model AI Video Studio: Notes from Kivide

The core problem: models are not interchangeable

What that looks like

Credits: why not just charge per generation

The prompt layer is the actual product

Camera direction is the highest-leverage token

Motion verbs decide whether video looks like video

Physical detail forces rendering

What this looks like end to end

A concrete example, start to finish

More output examples

Things I'd do differently

Try it

How to Generate a Secure JWT Secret Key in 2026 (Node.js, Python, Java)

What is a JWT secret key?

How long should a JWT secret be?

How to generate a secure JWT secret key

Node.js

Python

OpenSSL (any OS, one-liner)

Java

Using the secret in your application

Node.js with jsonwebtoken

Python with PyJWT

Three mistakes that leak your JWT secret

Symmetric secret vs. asymmetric key: which do you need?

FAQ

Why Everyone's Suddenly Measuring Their Face Instead of Filtering It

Why Use Our Free Online UUID Generator?

Why `localStorage` and not a database

Node.js with `jsonwebtoken`