DEV Community: kingfujing

SQL Query Cheat Sheet: Essential Queries and Patterns

kingfujing — Thu, 12 Nov 2026 02:05:00 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

SQL is the language of data. Whether you're pulling records from a Postgres
database, debugging a slow query in MySQL, or writing analytics queries in
Snowflake, the fundamentals are the same. This cheat sheet covers everything from
basic SELECT statements to advanced window functions — with syntax that works
across most major SQL databases.

      Each section includes the syntax, a practical example, and notes on database-specific
      differences where they matter. Bookmark this page and use it as your daily reference
      for writing SQL queries.

⚡ Quick Tip Use our

JSON Formatter

to prettify your JSON query results, and our

Regex Tester

for crafting SQL pattern-matching expressions.

1. SELECT & FROM

      The foundation of every SQL query. `SELECT` specifies
      which columns to return, `FROM` specifies the table.

-- Select all columns
SELECT * FROM users;

-- Select specific columns
SELECT id, name, email FROM users;

-- Select with alias
SELECT u.id, u.name AS username FROM users AS u;

-- Select distinct values
SELECT DISTINCT status FROM orders;

-- Select with LIMIT (MySQL/Postgres)
SELECT * FROM products LIMIT 10;

-- Select with TOP (SQL Server)
SELECT TOP 10 * FROM products;

-- Select with FETCH (standard SQL / Oracle)
SELECT * FROM products OFFSET 0 ROWS FETCH NEXT 10 ROWS ONLY;

2. WHERE Clause

      Filter rows based on conditions. The WHERE clause is evaluated row-by-row before
      GROUP BY and aggregate functions.

-- Comparison operators
SELECT * FROM users WHERE age >= 18;
SELECT * FROM orders WHERE total != 0;

-- String matching
SELECT * FROM users WHERE name LIKE 'A%';    -- starts with A
SELECT * FROM users WHERE name LIKE '%son%';  -- contains 'son'
SELECT * FROM users WHERE name LIKE '_oe';    -- exactly 3 chars, ends with 'oe'

-- IN operator
SELECT * FROM orders WHERE status IN ('shipped', 'delivered', 'pending');

-- BETWEEN
SELECT * FROM products WHERE price BETWEEN 10 AND 50;

-- NULL checks
SELECT * FROM users WHERE email IS NULL;
SELECT * FROM users WHERE email IS NOT NULL;

-- Multiple conditions
SELECT * FROM orders
WHERE status = 'active'
  AND created_at >= '2024-01-01'
  AND (total > 100 OR priority = 'high');

-- Boolean expressions
SELECT * FROM products
WHERE NOT discontinued
  AND (category_id = 5 OR category_id = 8);

⚠️ NULL Comparison NULL is not equal to anything — not even
NULL . Use IS NULL
or IS NOT NULL . Expressions like
column = NULL will always evaluate to false
(or unknown in SQL three-valued logic).

3. JOINs

      Combine rows from two or more tables based on related columns. Understanding JOINs
      is critical for working with normalized databases.

INNER JOIN

    Returns rows where there is a match in **both** tables.

SELECT u.name, o.id AS order_id, o.total
FROM users u
INNER JOIN orders o ON u.id = o.user_id;
-- Only returns users with at least one order

LEFT JOIN

    Returns all rows from the **left** table, with matching rows from the right table. Non-matching right-side columns are `NULL`.

SELECT u.name, o.id AS order_id
FROM users u
LEFT JOIN orders o ON u.id = o.user_id;
-- Returns ALL users, even if they have no orders

RIGHT JOIN

    Returns all rows from the **right** table, with matching rows from the left table. Less common — usually you can rewrite as a LEFT JOIN by swapping table order.

SELECT u.name, o.id AS order_id
FROM users u
RIGHT JOIN orders o ON u.id = o.user_id;
-- All orders, even if user is missing

FULL OUTER JOIN

    Returns all rows from **both** tables. Missing matches are `NULL` on the opposite side.

SELECT u.name, o.id AS order_id
FROM users u
FULL OUTER JOIN orders o ON u.id = o.user_id;
-- All users and all orders, matched where possible

CROSS JOIN

    Cartesian product — every row from table A combined with every row from table B. Use sparingly.

SELECT sizes.name, colors.name
FROM sizes
CROSS JOIN colors;
-- Returns size × color combinations

Self JOIN

    Joining a table to itself — useful for hierarchies (e.g., employees and managers).

SELECT e.name AS employee, m.name AS manager
FROM employees e
LEFT JOIN employees m ON e.manager_id = m.id;

💡 JOIN vs WHERE Filtering Conditions on the right table in a LEFT JOIN should go in the
JOIN clause, not the WHERE clause. A condition like
WHERE o.status = 'active' effectively
converts a LEFT JOIN to an INNER JOIN because it filters out NULL rows.

4. GROUP BY & HAVING

      `GROUP BY` groups rows with the same values, then
      aggregate functions are applied per group. `HAVING`
      filters groups (like WHERE filters rows).

-- Count users per status
SELECT status, COUNT(*) AS user_count
FROM users
GROUP BY status;

-- Multiple grouping columns
SELECT category_id, YEAR(created_at) AS year, COUNT(*) AS count
FROM products
GROUP BY category_id, YEAR(created_at);

-- Using HAVING (filter groups)
SELECT category_id, AVG(price) AS avg_price
FROM products
GROUP BY category_id
HAVING AVG(price) > 50;

-- HAVING with multiple conditions
SELECT user_id, COUNT(*) AS order_count, SUM(total) AS total_spent
FROM orders
GROUP BY user_id
HAVING COUNT(*) >= 5 AND SUM(total) > 1000
ORDER BY total_spent DESC;

⚠️ WHERE vs HAVING WHERE filters rows before grouping.
HAVING filters groups after aggregation.
You can use both in the same query:
WHERE created_at > '2024-01-01'
(filter rows), then
HAVING COUNT(*) > 5 (filter groups).

5. ORDER BY

    Sort results by one or more columns. Sorting is applied last, after GROUP BY and HAVING.

-- Ascending (default)
SELECT name, price FROM products ORDER BY price;

-- Descending
SELECT name, price FROM products ORDER BY price DESC;

-- Multiple sort keys
SELECT name, category_id, price
FROM products
ORDER BY category_id ASC, price DESC;

-- Sort by aggregate alias
SELECT category_id, COUNT(*) AS cnt
FROM products
GROUP BY category_id
ORDER BY cnt DESC;

-- Sort by column position (not recommended)
SELECT name, price FROM products ORDER BY 2 DESC;

6. Subqueries

      Subqueries (nested queries) can appear in SELECT, FROM, WHERE, or HAVING clauses.
      They let you break complex problems into logical steps.

-- Subquery in WHERE
SELECT name, price
FROM products
WHERE price > (SELECT AVG(price) FROM products);

-- Subquery with IN
SELECT name, email
FROM users
WHERE id IN (SELECT user_id FROM orders WHERE total > 500);

-- Subquery in SELECT (scalar subquery)
SELECT
  u.name,
  (SELECT COUNT(*) FROM orders o WHERE o.user_id = u.id) AS order_count
FROM users u;

-- Subquery in FROM (derived table / subquery as table)
SELECT category, AVG(price) AS avg_price
FROM (
  SELECT p.*, c.name AS category
  FROM products p
  JOIN categories c ON p.category_id = c.id
) AS product_categories
GROUP BY category;

-- Correlated subquery (references outer query)
SELECT p1.name, p1.price, p1.category_id
FROM products p1
WHERE p1.price = (
  SELECT MAX(p2.price)
  FROM products p2
  WHERE p2.category_id = p1.category_id
);
-- Gets the most expensive product in each category

7. Common Functions

Aggregate Functions

Function	Description	Example
COUNT(*)	Count all rows in group	COUNT(*) AS total
COUNT(column)	Count non-NULL values	COUNT(email)
COUNT(DISTINCT col)	Count unique values	COUNT(DISTINCT city)
SUM(column)	Sum of values	SUM(total) AS revenue
AVG(column)	Average of values	AVG(price) AS avg_price
MIN(column)	Minimum value	MIN(created_at)
MAX(column)	Maximum value	MAX(score) AS high_score

NULL Handling

Function	Description	Example
COALESCE(val1, val2, ...)	Returns first non-NULL value	COALESCE(phone, email, 'N/A')
NULLIF(expr1, expr2)	Returns NULL if equal, else expr1	NULLIF(price, 0)
IFNULL(expr, default)	MySQL/ SQLite — replaces NULL	IFNULL(discount, 0)
NVL(expr, default)	Oracle — replaces NULL	NVL(commission, 0)

String Functions

Function	Description	Example
CONCAT(a, b, ...)	Concatenate strings	CONCAT(first, ' ', last)
UPPER(str)	Convert to uppercase	UPPER(email)
LOWER(str)	Convert to lowercase	LOWER(name)
TRIM(str)	Remove leading/trailing spaces	TRIM(' hello ')
SUBSTRING(str, start, len)	Extract substring	SUBSTRING(phone, 1, 3)
REPLACE(str, from, to)	Replace substring	REPLACE(name, ' ', '_')
LENGTH(str)	String length	LENGTH(description)

Date/Time Functions

Function	Description	Example
NOW() / CURRENT_TIMESTAMP	Current date and time	WHERE created_at < NOW()
CURRENT_DATE	Current date only	WHERE date = CURRENT_DATE
DATE_TRUNC(part, date)	Truncate date to precision	DATE_TRUNC('month', ts)
EXTRACT(part FROM date)	Extract a date part	EXTRACT(YEAR FROM ts)
DATEDIFF(end, start)	Difference in days	DATEDIFF('day', start, end)

8. Window Functions

      Window functions perform calculations across a set of rows related to the current row
      — **without collapsing** the result set like GROUP BY
      does. They are among the most powerful SQL features for analytics.

ROW_NUMBER, RANK, DENSE_RANK

-- ROW_NUMBER: unique sequential number per partition
SELECT
  name,
  salary,
  department_id,
  ROW_NUMBER() OVER (PARTITION BY department_id ORDER BY salary DESC) AS rank
FROM employees;
-- Within each department, rank employees by salary descending

-- RANK: same values get same rank, next skips numbers
SELECT
  name, salary,
  RANK() OVER (ORDER BY salary DESC) AS rank
FROM employees;
-- 3rd place if 2 tied: 100, 95, 95, 90 → ranks 1, 2, 2, 4

-- DENSE_RANK: no gaps in ranking
SELECT
  name, salary,
  DENSE_RANK() OVER (ORDER BY salary DESC) AS dense_rank
FROM employees;
-- 100, 95, 95, 90 → ranks 1, 2, 2, 3

LAG and LEAD

    Access data from previous or next rows without self-joins.

-- LAG: previous row value
SELECT
  date,
  revenue,
  LAG(revenue, 1) OVER (ORDER BY date) AS prev_day_revenue,
  LAG(revenue, 7) OVER (ORDER BY date) AS prev_week_revenue
FROM daily_revenue;

-- LEAD: next row value
SELECT
  date,
  revenue,
  LEAD(revenue, 1) OVER (ORDER BY date) AS next_day_revenue
FROM daily_revenue;

-- Difference from previous value
SELECT
  employee_id,
  salary,
  salary - LAG(salary, 1, 0) OVER (ORDER BY employee_id) AS salary_change
FROM salaries;

Aggregate Window Functions

-- Running total
SELECT
  date,
  amount,
  SUM(amount) OVER (ORDER BY date) AS running_total
FROM transactions;

-- Moving average (3-day)
SELECT
  date,
  revenue,
  AVG(revenue) OVER (ORDER BY date ROWS BETWEEN 2 PRECEDING AND CURRENT ROW) AS moving_avg_3day
FROM daily_revenue;

-- Partitioned aggregates
SELECT
  department_id,
  employee_name,
  salary,
  AVG(salary) OVER (PARTITION BY department_id) AS dept_avg_salary,
  salary - AVG(salary) OVER (PARTITION BY department_id) AS diff_from_dept_avg
FROM employees;

💡 Window Function Frame Clause The frame clause ( ROWS BETWEEN ... or
RANGE BETWEEN ... ) defines which rows are included
in the window. Common frames:
UNBOUNDED PRECEDING (all previous),
CURRENT ROW , and
N FOLLOWING .

9. DML: INSERT, UPDATE, DELETE

INSERT

-- Single row
INSERT INTO users (name, email, status)
VALUES ('Alice', 'alice@example.com', 'active');

-- Multiple rows
INSERT INTO products (name, price, category_id)
VALUES
  ('Widget', 9.99, 1),
  ('Gadget', 24.99, 1),
  ('Doohickey', 14.99, 2);

-- Insert from query
INSERT INTO archived_orders (id, user_id, total, created_at)
SELECT id, user_id, total, created_at
FROM orders
WHERE created_at < '2023-01-01';

UPDATE

-- Simple update
UPDATE users
SET status = 'inactive'
WHERE last_login < '2024-01-01';

-- Update multiple columns
UPDATE products
SET
  price = price * 1.10,
  updated_at = NOW()
WHERE category_id = 5;

-- Update with subquery
UPDATE products
SET category_id = (
  SELECT id FROM categories WHERE name = 'Clearance'
)
WHERE category_id IS NULL;

DELETE

-- Delete specific rows
DELETE FROM logs WHERE created_at < '2020-01-01';

-- Delete all rows (truncate is faster)
DELETE FROM temp_data;

-- Delete with subquery
DELETE FROM users
WHERE id NOT IN (SELECT DISTINCT user_id FROM orders);

⚠️ Always Use WHERE in DELETE/UPDATE Forgetting the WHERE clause in a DELETE or UPDATE affects all rows .
When writing destructive queries, first write the matching SELECT to verify which
rows will be affected.

10. DDL: CREATE TABLE & Indexes

CREATE TABLE

-- Basic table
CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  name VARCHAR(100) NOT NULL,
  email VARCHAR(255) UNIQUE NOT NULL,
  status VARCHAR(20) DEFAULT 'active',
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Table with foreign key
CREATE TABLE orders (
  id SERIAL PRIMARY KEY,
  user_id INTEGER NOT NULL REFERENCES users(id),
  total DECIMAL(10, 2) NOT NULL CHECK (total >= 0),
  status VARCHAR(20) DEFAULT 'pending',
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Table with composite primary key
CREATE TABLE order_items (
  order_id INTEGER REFERENCES orders(id),
  product_id INTEGER REFERENCES products(id),
  quantity INTEGER NOT NULL,
  unit_price DECIMAL(10, 2) NOT NULL,
  PRIMARY KEY (order_id, product_id)
);

Indexes

      Indexes speed up queries at the cost of slower writes. Use them on columns used
      in WHERE, JOIN, and ORDER BY.

-- Single column index
CREATE INDEX idx_users_email ON users(email);

-- Composite index (column order matters!)
CREATE INDEX idx_orders_user_status ON orders(user_id, status);

-- Unique index
CREATE UNIQUE INDEX idx_products_sku ON products(sku);

-- Partial index (Postgres)
CREATE INDEX idx_active_users ON users(email) WHERE status = 'active';

-- Full-text index (MySQL/Postgres)
CREATE INDEX idx_products_name ON products USING GIN(to_tsvector('english', name));

-- Drop index
DROP INDEX idx_users_email;

11. Query Optimization Tips

Tip	Explanation
Avoid SELECT *	Only fetch columns you need. Reduces I/O and network overhead.
Use EXISTS vs IN	`EXISTS` stops scanning as soon as a match is found. `IN` materializes the entire subquery result.
Index JOIN columns	Columns used in `ON` and `WHERE` clauses should be indexed.
Avoid functions in WHERE	`WHERE YEAR(created_at) = 2024` prevents index use. Use `WHERE created_at >= '2024-01-01' AND created_at < '2025-01-01'` instead.
Use UNION ALL instead of UNION	`UNION` deduplicates (extra sort). `UNION ALL` just appends — use it when you know there are no duplicates.
Use EXPLAIN	`EXPLAIN ANALYZE SELECT ...` shows the query plan and actual execution time. Always check it for slow queries.
Limit pagination depth	`OFFSET 10000 LIMIT 10` still scans 10010 rows. Use keyset pagination (`WHERE id > last_id LIMIT 10`) for deep pages.
Use materialized views	For expensive aggregations that don't change often, precompute with `CREATE MATERIALIZED VIEW` and refresh periodically.

12. Common Table Expressions (CTEs)

      CTEs let you name a subquery and reference it like a table. They improve readability
      and enable recursive queries.

-- Basic CTE
WITH high_value_orders AS (
  SELECT user_id, SUM(total) AS total_spent
  FROM orders
  WHERE status = 'delivered'
  GROUP BY user_id
  HAVING SUM(total) > 1000
)
SELECT u.name, h.total_spent
FROM users u
JOIN high_value_orders h ON u.id = h.user_id;

-- Recursive CTE (hierarchy)
WITH RECURSIVE org_chart AS (
  -- Base: top-level managers
  SELECT id, name, manager_id, 1 AS level
  FROM employees
  WHERE manager_id IS NULL

  UNION ALL

  -- Recursive: direct reports
  SELECT e.id, e.name, e.manager_id, oc.level + 1
  FROM employees e
  JOIN org_chart oc ON e.manager_id = oc.id
)
SELECT * FROM org_chart ORDER BY level, name;

13. Database-Specific Syntax

Feature	PostgreSQL	MySQL	SQL Server
Auto-increment	SERIAL / IDENTITY	AUTO_INCREMENT	IDENTITY(1,1)
ILIKE	ILIKE (case-insensitive)	LIKE (case-insensitive by default)	LIKE (case-insensitive based on collation)
LIMIT	LIMIT 10 OFFSET 20	LIMIT 10 OFFSET 20	OFFSET 20 ROWS FETCH NEXT 10 ROWS ONLY
String concat	\	\
Upsert	ON CONFLICT DO UPDATE	ON DUPLICATE KEY UPDATE	MERGE

Common Mistakes & How to Avoid Them

      These five mistakes cause most of the slow queries and wrong results

      I've debugged in production. Each one has a simple fix once you

      know what to look for.

  -
    **Comparing to NULL with `=`.**
    `WHERE email = NULL` returns zero rows
    because NULL comparisons evaluate to UNKNOWN, not TRUE. Always use
    `IS NULL` / `IS NOT NULL`
    — and remember that `NULL &lt;&gt; 'x'`
    also excludes NULL rows.


  -
    **Using `SELECT *` in production code.**
    It pulls every column, wasting I/O and bandwidth, and silently breaks when
    someone adds a column. List columns explicitly — it also makes your
    application's data contract visible in the query itself.


  -
    **The N+1 query trap.**
    Fetching a list of users, then running one query per user inside a loop,
    is the classic ORM performance killer. Replace it with a single JOIN or an
    `IN` subquery:
    `SELECT * FROM orders WHERE user_id IN (SELECT id FROM users WHERE plan = 'pro')`.


  -
    **Wrapping indexed columns in functions.**
    `WHERE YEAR(created_at) = 2024` forces a full
    scan because the index stores raw values, not function results. Use a range
    predicate instead:
    `created_at &gt;= '2024-01-01' AND created_at &lt; '2025-01-01'`.


  -
    **Deep OFFSET pagination.**
    `OFFSET 100000 LIMIT 50` still reads and
    discards 100,000 rows. Use keyset pagination —
    `WHERE id &gt; last_seen_id ORDER BY id LIMIT 50`
    — which stays fast no matter how deep you go.

Frequently Asked Questions

What's the difference between INNER JOIN and LEFT JOIN?

INNER JOIN returns only rows that have
matches in both tables. LEFT JOIN returns
every row from the left table, filling unmatched right-side columns with
NULL. If your result is missing rows, you
probably need a LEFT JOIN; if you're seeing duplicate rows, the
"one" side has multiple matches.

Why is my query slow, and how do I fix it?

Start with EXPLAIN ANALYZE SELECT ... and
look for sequential scans on large tables — add an index on the columns
used in WHERE and
JOIN. Avoid SELECT *,
avoid functions around indexed columns, and prefer
EXISTS over
IN for large subqueries.

What's the difference between WHERE and HAVING?

WHERE filters individual rows
before grouping; HAVING filters
groups after aggregation. That's why
WHERE can't reference
SUM() or COUNT(),
but HAVING can. Use
WHERE status = 'paid' to drop rows,
and HAVING SUM(total) > 100 to drop groups.

Why do COUNT(*) and COUNT(column) give different results?

COUNT(*) counts every row, including rows
with NULLs. COUNT(column) counts only
non-NULL values in that column. If the two numbers differ, your column
contains NULLs — which is often the real signal you're looking for.

How do I avoid the N+1 query problem?

Replace loop-based per-row queries with a single JOIN or an
IN subquery. Instead of querying orders
once per user, fetch them all at once:
SELECT * FROM orders WHERE user_id IN (SELECT id FROM users WHERE plan = 'pro').
In ORMs, use eager loading (selectinload in
SQLAlchemy, includes in Rails/EF) rather
than lazy loading.

🔍 Related Resources Check out our

Unix Timestamp Cheat Sheet

for working with dates across SQL databases, and our

JSON Formatter

for visualizing query results.

JavaScript Array Methods Cheat Sheet: Every Method with Examples

kingfujing — Thu, 12 Nov 2026 02:03:54 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

JavaScript arrays are everywhere. Whether you're transforming API responses,
filtering user input, or building complex data pipelines, array methods are the
tools you reach for daily. But with over 30 methods on
Array.prototype, it's easy to lose track of
which method does what, what it returns, and whether it mutates the original array.

      This cheat sheet covers every major array method — from the classics like
      `push()` and `map()`
      to the newest ES2023 additions like
      `toSorted()`,
      `toReversed()`, and
      `with()`. Methods are grouped by category so you
      can quickly find what you need.

⚡ Quick Tip Use our

JSON Formatter

to inspect API responses that contain arrays, and our

Base64 Encoder/Decoder

for decoding token payloads that use array-like structures.

Quick Legend

      Throughout this guide, each method table includes the following columns:




      - **Method** — The method name and its parameters

      - **Description** — What the method does

      - **Returns** — The return value type

      - **Mutates?** — Whether it modifies the original array

      - **Example** — A concise code snippet

1. Mutator Methods

      Mutator methods **change the original array**.
      Use them when you want to modify data in place. Be careful — these can lead to
      unintended side effects if referenced elsewhere in your code.

Adding & Removing Elements

Method	Returns	Example
push(el1, ..., elN)	New `length` of array	arr.push(4) // arr → [1,2,3,4]
pop()	Removed element (or `undefined`)	arr.pop() // returns 3
unshift(el1, ..., elN)	New `length` of array	arr.unshift(0) // arr → [0,1,2,3]
shift()	Removed element (or `undefined`)	arr.shift() // returns 1
splice(start, deleteCount, ...items)	Array of removed elements	arr.splice(1, 0, 'a')
fill(value, start?, end?)	Modified array (`this`)	arr.fill(0, 1, 3)
copyWithin(target, start, end?)	Modified array (`this`)	arr.copyWithin(0, 2)

Sorting & Reversing

Method	Returns	Example
sort(compareFn?)	Modified array (`this`)	arr.sort((a,b) => a - b)
reverse()	Modified array (`this`)	arr.reverse()

⚠️ sort() Gotcha Without a compare function, sort() converts
elements to strings and sorts lexicographically.
[10, 2, 1].sort() gives
[1, 10, 2] . Always provide a compare function
for numeric sorting.

2. Accessor Methods

      Accessor methods **do not mutate** the original
      array. They return a new array or value. These are generally safer and more
      predictable — prefer them over mutators when you don't need in-place modification.

Creating New Arrays

Method	Returns	Example
concat(arr2, ..., arrN)	New concatenated array	[1].concat([2, 3]) // [1,2,3]
slice(start?, end?)	New shallow-copied array	arr.slice(1, 3)
flat(depth?)	New flattened array	[[1],[2,[3]]].flat(2)
flatMap(fn)	New flattened array (depth 1)	arr.flatMap(x => [x, x*2])
join(separator?)	String	arr.join(', ')
toString()	Comma-separated string	arr.toString()
toLocaleString()	Localized string	arr.toLocaleString()

Searching & Checking

Method	Returns	Example
indexOf(el, fromIndex?)	First index, or `-1`	[1,2,3].indexOf(2) // 1
lastIndexOf(el, fromIndex?)	Last index, or `-1`	[1,2,1].lastIndexOf(1) // 2
includes(el, fromIndex?)	Boolean	[1,2,3].includes(2) // true
find(fn)	First matching element, or `undefined`	arr.find(x => x > 2)
findIndex(fn)	Index of first match, or `-1`	arr.findIndex(x => x > 2)
findLast(fn)	Last matching element, or `undefined`	arr.findLast(x => x > 2)
findLastIndex(fn)	Index of last match, or `-1`	arr.findLastIndex(x => x > 2)
some(fn)	Boolean	arr.some(x => x > 2)
every(fn)	Boolean	arr.every(x => x > 0)

3. Iterator Methods

      Iterator methods loop over the array and execute a callback. They are the workhorses
      of functional JavaScript. All iterator methods return a new value — they never mutate
      the original array.

Method	Returns	Example
forEach(fn)	`undefined`	arr.forEach(x => console.log(x))
map(fn)	New array (same length)	arr.map(x => x * 2)
filter(fn)	New array (filtered)	arr.filter(x => x > 2)
reduce(fn, initial?)	Accumulated value (any type)	arr.reduce((a,b) => a+b, 0)
reduceRight(fn, initial?)	Accumulated value (right-to-left)	arr.reduceRight((a,b)=>a+b)

💡 Chaining Pattern Because most iterator and accessor methods return new arrays, you can chain them:

arr
 .filter(x => x > 0)
 .map(x => x * 2)
 .reduce((sum, x) => sum + x, 0)

4. ES2023: The New Wave

      The 2023 update to ECMAScript introduced three new array methods that return
      ** new arrays** instead of mutating in place.
      These are the non-mutating alternatives to `sort()`,
      `reverse()`, and bracket assignment.

Method	Returns	Example
toSorted(compareFn?)	New sorted array	arr.toSorted() // arr unchanged
toReversed()	New reversed array	arr.toReversed() // arr unchanged
with(index, value)	New array with element replaced	arr.with(1, 99)
toSpliced(start, deleteCount?, ...items)	New array with splice applied	arr.toSpliced(1, 1, 42)

💡 Immutable Arrays The ES2023 methods make it easy to work immutably. Instead of arr.sort() which mutates, use arr.toSorted() which returns a copy. This is especially useful in React and Redux where immutability is required.

5. Static Methods

      These are methods on the `Array` constructor itself,
      not on instances.

Method	Returns	Example
Array.from(arrayLike, mapFn?)	New array from iterable/array-like	Array.from('abc') // ['a','b','c']
Array.of(...items)	New array from arguments	Array.of(1, 2, 3)
Array.isArray(value)	Boolean	Array.isArray([]) // true

6. Practical Examples

Removing Duplicates

const arr = [1, 2, 2, 3, 3, 4];
const unique = [...new Set(arr)];
// [1, 2, 3, 4]

Grouping Objects by Property

const users = [
  ,
  ,
  ,
];

const grouped = users.reduce((acc, user) => {
  (acc[user.role] = acc[user.role] || []).push(user);
  return acc;
}, );
//

Deep Flattening

const nested = [1, [2, [3, [4]]]];
nested.flat(Infinity);
// [1, 2, 3, 4]

Safe Sorting (Immutably)

const arr = [3, 1, 4, 1, 5];
const sorted = arr.toSorted((a, b) => a - b);
// sorted = [1, 1, 3, 4, 5]
// arr = [3, 1, 4, 1, 5] (unchanged!)

7. Performance Notes

      -
        **push/pop** are O(1) — fastest way to add/remove from end.


      -
        **shift/unshift** are O(n) — they re-index all elements.


      -
        **splice** is O(n) in worst case due to re-indexing.


      -
        **filter/map** create new arrays — chaining many of them uses more memory. For performance-critical paths, consider a single `reduce()` or a loop.


      -
        **flat(Infinity)** is convenient but slow for deeply nested arrays. Use iterative flattening for large datasets.


      -
        **sort()** uses Timsort (O(n log n)) and is stable as of ES2019.

8. Quick Reference Table

      All methods at a glance. **M** = Mutator,
      **A** = Accessor,
      **I** = Iterator.

Cat	Method	Returns
M	push()	New length
M	pop()	Removed element
M	unshift()	New length
M	shift()	Removed element
M	splice()	Removed elements array
M	sort()	Modified array
M	reverse()	Modified array
M	fill()	Modified array
M	copyWithin()	Modified array
A	concat()	New array
A	slice()	New array
A	flat()	New array
A	flatMap()	New array
A	join()	String
A	indexOf()	Index or -1
A	includes()	Boolean
A	find()	Element or undefined
A	findIndex()	Index or -1
A	some()	Boolean
A	every()	Boolean
I	forEach()	undefined
I	map()	New array
I	filter()	New array
I	reduce()	Accumulated value
N	toSorted()	New array
N	toReversed()	New array
N	with()	New array
N	toSpliced()	New array

Browser Support

      All methods covered here are well-supported in modern browsers:




      -
        **ES2023 methods** (toSorted, toReversed, with, toSpliced): Chrome 110+, Firefox 115+, Safari 16.4+, Node 20+


      -
        **ES2019+ methods** (flat, flatMap): Chrome 69+, Firefox 62+, Safari 12+, Node 11+


      -
        **All others**: Supported everywhere including IE9+ (with polyfills for `find`, `findIndex`)

Common Mistakes & How to Avoid Them

      Even experienced developers trip over these array method gotchas. Here are the five
      most common pitfalls and how to dodge them.

1. Forgetting That sort() Sorts Strings by Default

      `sort()` converts every element to a string before
      comparing, so `[10, 2, 1].sort()` returns
      `[1, 10, 2]` — not the numeric order you expected.
      Always pass a comparator for numbers:

[10, 2, 1].sort((a, b) => a - b); // [1, 2, 10]

2. Mutating an Array While Iterating Over It

      Calling splice() inside a

      forEach() loop shifts the indexes of every remaining

      element, which causes items to be silently skipped. Instead of removing elements in

      place, build a new array with filter() — it is safer

      and easier to reason about.

Using map() for Side Effects

      map() exists to transform data and always returns a
  new array. If you only need to run side effects like logging or DOM updates, use
  forEach() instead. Calling
  map() and discarding its return value allocates an
  unused array and signals the wrong intent to readers.

filter(Boolean) Silently Drops Falsy Values

      filter(Boolean) is a popular one-liner, but it also
  removes 0, "", and
  NaN. When those values are meaningful data, use an
  explicit predicate such as
  x =&gt; x !== null &amp;&amp; x !== undefined.

map() Skips Holes in Sparse Arrays

      Array(3).map(x =&gt; 1) returns an array of empty
  holes, not [1, 1, 1]. Create a dense array first with
  Array.from() or
  [...Array(3)] before mapping over it.

Frequently Asked Questions

What is the difference between map() and forEach()?

map() builds and returns a new array with the
same length, transformed by the callback. forEach()
runs the callback for side effects and returns undefined.
Use map() when you need the transformed result,
and forEach() when you only need to perform an
action. Neither can be stopped early with break —
use a for...of loop if you need early exit.

How do I remove duplicates from an array?

The simplest approach is to spread a Set:
[...new Set(arr)]. This preserves insertion
order and works for primitives. For arrays of objects, dedupe by a key with a
Map or a Set of
ids instead of relying on reference equality.

What is the difference between slice() and splice()?

slice(start, end) returns a new array containing
a copy of a portion of the original, without modifying it.
splice(start, deleteCount, ...items) removes or
replaces elements in the original array and returns the removed elements.
Remember: slice copies, splice mutates.
If you need the non-mutating version of splice, use
toSpliced().

Why does sort() return an unexpected order for numbers?

The default sort() converts elements to strings
and compares them lexicographically, so 10 comes
before 2. Pass a numeric comparator like
(a, b) => a - b to sort numbers correctly, or
use toSorted() when you want to keep the original
array unchanged.

How do I check if an array contains a value?

Use includes(value) for a simple boolean check,
or indexOf(value) when you also need the position.
Both use strict equality, so neither can find NaN —
use some(x => Number.isNaN(x)) for that case,
and find() with a predicate when searching for
objects by property.

🔍 Related Resources Check out our

JSON Formatter

and

Base64 Encoder/Decoder

for more dev tools. Also read our

JSON Formatting Guide

for data debugging tips.

HTTP Status Codes Cheat Sheet: Every Code Explained

kingfujing — Thu, 12 Nov 2026 02:02:48 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

Every web developer encounters HTTP status codes daily. From successful
200 OK responses to mysterious
418 I'm a Teapot — understanding what each code
means is essential for debugging APIs, configuring servers, and building robust
applications.

      This cheat sheet covers every standard HTTP status code from **100** to
      **511**, grouped by category. Use it as a quick reference whenever you
      encounter an unfamiliar response code.

🔍 Quick Tip Use our

JSON Formatter

to prettify API error responses, and our

Base64 Encoder/Decoder

to decode token-based auth errors.

1xx Informational Responses

      These codes indicate that the server has received the request headers and the client
      should continue sending the request body. They are provisional responses — the client
      should wait for a final response.

Code	Name	Description
100	Continue	Server received headers, client should send body
101	Switching Protocols	Server is switching to the protocol requested in Upgrade header (e.g., WebSocket)
102	Processing	Server has received and is processing request, but no response yet (WebDAV)
103	Early Hints	Server can send some response headers before final response (for preloading)

2xx Success Responses

      The request was successfully received, understood, and accepted. These are the codes
      every developer loves to see.

Code	Name	Description
200	OK	Standard success response for GET, PUT, PATCH, and POST requests
201	Created	Resource was successfully created (typically after POST/PUT). Include Location header
202	Accepted	Request accepted but not yet processed (async processing)
203	Non-Authoritative Info	Returned metadata is from a third-party copy, not the origin server
204	No Content	Request succeeded but no content to return (DELETE, or PUT saving unchanged data)
205	Reset Content	Server fulfilled request, user agent should reset the document view
206	Partial Content	Server is delivering only part of the resource (range requests, video streaming)
207	Multi-Status	Multiple status codes for multiple operations (WebDAV)
208	Already Reported	Members of a DAV binding have already been enumerated (WebDAV)
226	IM Used	Server fulfilled GET request using instance manipulations

3xx Redirection Responses

      The client must take additional action to complete the request. Usually means the
      resource has moved or the request needs different treatment.

Code	Name	Description
300	Multiple Choices	Multiple possible representations; user or agent should choose one
301	Moved Permanently	Resource permanently moved to new URL. Browsers cache this redirect. Update bookmarks
302	Found	Resource temporarily found at different URI. Use for temporary redirects
303	See Other	Response to POST can be found at another URI (use GET to retrieve)
304	Not Modified	Cached version is still valid (conditional GET using If-Modified-Since / ETag)
305	Use Proxy	Requested resource must be accessed through a proxy (deprecated)
306	Switch Proxy	No longer used. Originally meant "subsequent requests should use specified proxy"
307	Temporary Redirect	Like 302 but guarantees method and body won't change when following redirect
308	Permanent Redirect	Like 301 but guarantees method and body won't change when following redirect

4xx Client Error Responses

      The request contains bad syntax or cannot be fulfilled. These are the most common
      errors you'll encounter while debugging APIs.

Code	Name	Description
400	Bad Request	Malformed request syntax, invalid message framing, or deceptive request routing
401	Unauthorized	Authentication is required or has failed. Include WWW-Authenticate header
402	Payment Required	Reserved for future use (digital payment systems). Rarely used in practice
403	Forbidden	Server understood the request but refuses to authorize it. Different from 401
404	Not Found	Server cannot find the requested resource. The most famous HTTP error
405	Method Not Allowed	HTTP method not supported for this resource. Include Allow header
406	Not Acceptable	Resource cannot produce content matching Accept headers
407	Proxy Auth Required	Client must first authenticate with the proxy (like 401 for proxies)
408	Request Timeout	Server timed out waiting for the request. Client can re-send
409	Conflict	Request conflicts with current state of the resource (e.g., version conflicts)
410	Gone	Resource is gone and will not be available again. Unlike 404, this is permanent
411	Length Required	Content-Length header is required but was not provided
412	Precondition Failed	Conditional request headers (If-Match, If-None-Match) evaluated to false
413	Payload Too Large	Request entity is larger than server is willing or able to process
414	URI Too Long	URI requested is longer than server can interpret
415	Unsupported Media Type	Media format in Content-Type is not supported by the server
416	Range Not Satisfiable	Range specified in Range header cannot be fulfilled
417	Expectation Failed	Server cannot meet the requirements of the Expect request header
418	I'm a Teapot	April Fools' joke (HTCPCP). Some servers use it for blocking bot traffic
421	Misdirected Request	Request was directed at a server that cannot produce a response
422	Unprocessable Entity	Request body is syntactically correct but semantically invalid (validation errors)
423	Locked	Resource is locked (WebDAV)
424	Failed Dependency	Request failed because another request it depended on failed (WebDAV)
425	Too Early	Server is unwilling to process a request that might be replayed
426	Upgrade Required	Client should switch to a different protocol (e.g., HTTP/1.1 → HTTP/2)
428	Precondition Required	Server requires the request to be conditional (prevent lost updates)
429	Too Many Requests	Rate limit exceeded. Include Retry-After header. Very common in APIs
431	Header Fields Too Large	Request header fields are too large (individual header or total size)
451	Unavailable For Legal Reasons	Resource blocked due to legal demands (censorship, copyright takedowns)

5xx Server Error Responses

      The server failed to fulfill a valid request. These indicate problems on the server
      side — but sometimes the real issue is upstream.

Code	Name	Description
500	Internal Server Error	Generic server error when no specific message fits. Check server logs
501	Not Implemented	Server does not support the HTTP method. Unlike 405, this means server can't handle it at all
502	Bad Gateway	Server acting as gateway got an invalid response from upstream server
503	Service Unavailable	Server temporarily overloaded or under maintenance. Include Retry-After header
504	Gateway Timeout	Server acting as gateway did not receive response from upstream in time
505	HTTP Version Not Supported	Server does not support the HTTP protocol version used in the request
506	Variant Also Negotiates	Server configuration error: circular reference in transparent content negotiation
507	Insufficient Storage	Server cannot store the representation needed to complete the request (WebDAV)
508	Loop Detected	Server detected an infinite loop processing the request (WebDAV)
510	Not Extended	Further extensions to the request are required for the server to fulfill it
511	Network Auth Required	Client needs to authenticate to gain network access (captive portals)

Quick Reference by Category

      Some status codes appear in unexpected places. Here's a breakdown of which codes
      are commonly seen in specific scenarios:

Scenario	Common Codes
REST API - GET	200 (OK), 404 (Not Found), 401 (Unauthorized)
REST API - POST	201 (Created), 400 (Bad Request), 422 (Unprocessable Entity), 409 (Conflict)
REST API - PUT/PATCH	200 (OK), 204 (No Content), 409 (Conflict), 412 (Precondition Failed)
REST API - DELETE	204 (No Content), 404 (Not Found), 410 (Gone)
CDN / Proxy	502 (Bad Gateway), 504 (Gateway Timeout), 301 (Moved Permanently)
Rate Limiting	429 (Too Many Requests), 503 (Service Unavailable)
Auth / Tokens	401 (Unauthorized), 403 (Forbidden), 407 (Proxy Auth Required)
File Upload	413 (Payload Too Large), 415 (Unsupported Media Type)
Redirects	301 (Permanent), 302 (Temporary), 307 (Temporary, method-preserving), 308 (Permanent, method-preserving)

Common Mistakes & Best Practices

1. Don't Use 200 for Everything

      Many poorly designed APIs return `200 OK` for everything,
      including errors, and handle them in the response body. This breaks HTTP semantics
      and makes debugging harder. Use the correct status code for each scenario.

2. 401 vs 403 — Know the Difference

      `401 Unauthorized` means the client is not authenticated
      (no valid credentials). `403 Forbidden` means the client is
      authenticated but lacks permission. Use them correctly — a logged-in user hitting an
      admin endpoint should get 403, not 401.

3. Always Return Proper Error Bodies

      When returning 4xx or 5xx, include a structured error response body:

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Email is required",
    "details": [
      { "field": "email", "issue": "must not be empty" }
    ]
  }
}

4. Use Retry-After With 429 and 503

      When rate-limiting (`429`) or serving maintenance pages
      (`503`), include the `Retry-After` header
      so clients know when to retry. This prevents thundering herd problems.

5. 301 Redirects Are Cached by Browsers

      A `301 Moved Permanently` redirect is aggressively cached
      by browsers. If you accidentally serve a 301 to the wrong URL, clients will cache it
      and you'll have trouble fixing it. Use `302` or
      `307` for temporary redirects.

**** 🎯 Quick Summary

1xx — Informational: continue, switching protocols
2xx — Success: everything worked as expected
3xx — Redirection: resource moved, use different URL
4xx — Client Error: bad request, auth failure, not found (debug here first)
5xx — Server Error: server crashed, gateway timeout, overloaded
Use our JSON Formatter to read API error responses

Frequently Asked Questions

What is the difference between 401 Unauthorized and 403 Forbidden?

401 Unauthorized means the client is
not authenticated — no valid credentials
were provided, or the token is missing or expired.
403 Forbidden means the client
is authenticated but does not have
permission to access the resource. A logged-in user hitting an admin endpoint
should get 403; an anonymous request should get 401. Also note that the spec
recommends 401 include a
WWW-Authenticate header describing the auth scheme.

What is the difference between 301, 302, 307, and 308 redirects?

301 and 308 are
permanent redirects; 302 and
307 are temporary. The key difference is method
handling: 301 and 302
may rewrite POST into GET
(most browsers do), while 307 and
308 always preserve the method and request body.
Use 308 for permanent redirects of form
submissions or API endpoints, and 307 for
temporary ones where the method must survive.

When should I return 429 Too Many Requests?

Return 429 when a client exceeds your rate limit
— for example, more than 100 requests per minute. Always include a
Retry-After header (in seconds or an HTTP date)
so clients know when to try again, and consider adding
RateLimit-Limit,
RateLimit-Remaining, and
RateLimit-Reset headers for transparency. Use
503 instead when the whole service is overloaded
or down for maintenance, since that signals a server-side condition rather than a
client quota.

Should I return 404 or 403 for resources that exist but are not authorized?

For security-sensitive resources, returning 404
is usually the better choice. A 403 tells an
attacker that the resource exists, letting them enumerate your API. Returning
404 for both "not found" and "forbidden" hides
the resource's existence. Reserve 403 for cases
where revealing existence is fine, such as a public site telling a logged-in user
they lack admin rights.

What is the difference between 500, 502, 503, and 504?

500 Internal Server Error is a generic failure
inside your application — an unhandled exception or misconfiguration.
502 Bad Gateway means an upstream server (like a
reverse proxy's backend) returned an invalid response.
503 Service Unavailable means the server is
overloaded or in maintenance — pair it with
Retry-After.
504 Gateway Timeout means an upstream server
didn't respond in time. All four are server-side: check your application logs,
upstream health, and load balancer configuration in that order.

        **Related Tools:**
        [JSON Formatter](https://devtoolshub.cloud/tools/json-formatter)

        [Base64 Encoder/Decoder](https://devtoolshub.cloud/tools/base64)

        [JWT Decoder](https://devtoolshub.cloud/tools/jwt-decoder)

HTML Entities Reference: Every Escape Code You Need

kingfujing — Thu, 12 Nov 2026 02:01:42 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

HTML entities (also called character entities or escape codes) let you display
reserved characters, special symbols, and invisible characters in HTML documents.
Whether you need to show a literal < without
triggering a tag, display a copyright symbol, or include an arrow in your UI,
this reference has the code.

      Each table below lists the entity name, numeric code (decimal and hex), and the
      rendered character. Bookmark this page for quick lookup during frontend development.

💡 How to Use Use entity names like & or numeric
codes like & or
& directly in your HTML. Most modern
editors suggest entity names as you type.

Common Symbols

      These are the most frequently used HTML entities. Every developer should know
      `&amp;`, `<`,
      `>`, and ` `
      by heart.

Character	Entity Name	Decimal Code	Hex Code	Description
&	&	&	&	Ampersand (must escape in HTML)
<	<	<	<	Less than (opens HTML tags)
>	>	>	>	Greater than (closes HTML tags)
"	"	"	"	Double quote (attribute delimiters)
'	'	'	'	Apostrophe / single quote
				Non-breaking space (prevents line break)
©	©	©	©	Copyright symbol
®	®	®	®	Registered trademark
™	™	™	™	Trademark symbol
§	§	§	§	Section symbol
¶	¶	¶	¶	Pilcrow / paragraph mark
°	°	°	°	Degree symbol
†	†	†	†	Dagger (footnotes)
‡	‡	‡	‡	Double dagger
•	•	•	•	Bullet point
…	…	…	…	Horizontal ellipsis
‰	‰	‰	‰	Per mille (per thousand)
℠	&scaps;	℠	℠	Service mark

Currency Symbols

      Display currency signs from around the world. Note that some symbols (like the
      Bitcoin sign) may not render in older browsers without a numeric code.

Character	Entity Name	Decimal Code	Hex Code	Description
$	(none needed)	$	$	Dollar (not reserved, no entity needed)
¢	¢	¢	¢	Cent
£	£	£	£	Pound sterling
¤	¤	¤	¤	Generic currency
¥	¥	¥	¥	Yen / Yuan
€	€	€	€	Euro
₤	&lira;	₤	₤	Lira sign
₱	(none)	₱	₱	Philippine peso
₹	(none)	₹	₹	Indian rupee
₩	(none)	₩	₩	South Korean won
₪	(none)	₪	₪	Israeli shekel
₫	(none)	₫	₫	Vietnamese dong
₮	(none)	₮	₮	Mongolian tugrik
₽	(none)	₽	₽	Russian ruble
₿	(none)	₿	₿	Bitcoin
₣	(none)	₣	₣	French franc

Arrows

      Arrow symbols for navigation, direction indicators, and UI elements. Both simple
      and double-lined variants are available.

Character	Entity Name	Decimal Code	Hex Code	Description
←	←	←	←	Left arrow
↑	↑	↑	↑	Up arrow
→	→	→	→	Right arrow
↓	↓	↓	↓	Down arrow
↔	↔	↔	↔	Left-right arrow
↕	↕	↕	↕	Up-down arrow
↖	↖	↖	↖	North-west arrow
↗	↗	↗	↗	North-east arrow
↘	↘	↘	↘	South-east arrow
↙	↙	↙	↙	South-west arrow
⇐	⇐	⇐	⇐	Left double arrow
⇒	⇒	⇒	⇒	Right double arrow (implies)
⇔	⇔	⇔	⇔	Left-right double arrow (iff)
►	▸	▸	▶	Right-pointing triangle
◄	◂	◀	◀	Left-pointing triangle
▲	▴	▴	▴	Up-pointing triangle
▼	▾	▾	▾	Down-pointing triangle

Mathematical Operators & Symbols

      Common math symbols for equations, comparisons, fractions, and logic. Use numeric
      codes for symbols without named entities.

Character	Entity Name	Decimal Code	Hex Code	Description
×	×	×	×	Multiplication sign
÷	÷	÷	÷	Division sign
±	±	±	±	Plus-minus
−	−	−	−	Minus sign (not hyphen)
∑	∑	∑	∑	N-ary summation
∏	∏	∏	∏	N-ary product
∫	∫	∫	∫	Integral
√	√	√	√	Square root
∞	∞	∞	∞	Infinity
∠	∠	∠	∠	Angle
⊥	⊥	⊥	⊥	Perpendicular / up tack
∴	∴	∴	∴	Therefore
∵	∵	∵	∵	Because
∼	∼	∼	∼	Tilde operator (similar to)
≅	≅	≅	≅	Approximately equal to
≈	≈	≈	≈	Almost equal to
≠	≠	≠	≠	Not equal to
≡	≡	≡	≡	Identical to
≤	≤	≤	≤	Less-than or equal to
≥	≥	≥	≥	Greater-than or equal to
½	½	½	½	Fraction one-half
¼	¼	¼	¼	Fraction one-quarter
¾	¾	¾	¾	Fraction three-quarters
π	π	π	π	Greek pi
μ	μ	μ	μ	Mu (micro symbol)

Punctuation & Special Characters

      Dashes, quotes, spaces, and other typographic characters for polished text.

Character	Entity Name	Decimal Code	Hex Code	Description
–	–	–	–	En dash (number ranges)
—	—	—	—	Em dash (parenthetical)
‘	‘	‘	‘	Left single quotation mark
’	’	’	’	Right single quotation mark
“	“	“	“	Left double quotation mark
”	”	”	”	Right double quotation mark
«	«	«	«	Left-pointing double angle (guillemet)
»	»	»	»	Right-pointing double angle (guillemet)
‹	‹	‹	‹	Single left-pointing angle quote
›	›	›	›	Single right-pointing angle quote
¡	¡	¡	¡	Inverted exclamation mark
¿	¿	¿	¿	Inverted question mark
¦	¦	¦	¦	Broken vertical bar
¬	¬	¬	¬	Not sign
				Soft hyphen
				En space (half an em)
				Em space (width of capital M)
				Thin space

Greek Letters (Common)

      Frequently used Greek letters in math, science, and engineering contexts.

Character	Entity Name	Decimal Code	Hex Code	Description
α	α	α	α	Alpha
β	β	β	β	Beta
γ	γ	γ	γ	Gamma
δ	δ	δ	δ	Delta
ε	ε	ε	ε	Epsilon
θ	θ	θ	θ	Theta
λ	λ	λ	λ	Lambda
σ	σ	σ	σ	Sigma
φ	φ	φ	φ	Phi
ω	ω	ω	ω	Omega

**** 🎯 Quick Reference: Most Common Entities

&
&

          <

          `<`


          >

          `>`


          "

          `&quot;`




          ` `


          ©

          `&copy;`


          ®

          `&reg;`


          €

          `&euro;`

Common Mistakes & How to Avoid Them

      Entities look simple, but a few recurring mistakes cause broken pages, escaped-looking
      text, and subtle layout bugs. Here are the five most common ones.

1. Forgetting to escape the ampersand itself

      The `&amp;` entity is special: because
      `&` starts every entity, a literal ampersand in your
      text (like `AT&T` or
      `R&D`) must be written as
      `&amp;`. Otherwise the browser may try to parse
      `&T` or `&D` as an
      entity and render unexpected characters.

<!-- BUG: ambiguous, may render wrong -->
Acme & Sons

<!-- FIX: escape the ampersand -->
Acme & Sons

2. Dropping the trailing semicolon

      Writing `&copy` without the semicolon works in HTML5 in
      some contexts but is invalid in XHTML and risky inside attribute values. Always include the
      semicolon: `&copy;`. The same applies to numeric
      references — `&#169;` is correct,
      `&#169` is not.

3. Double-escaping entities

      If your page shows `&amp;lt;` as literal text instead of
      a `<` character, the content was escaped twice — once by
      your template engine or framework (React, Vue, Handlebars escape by default), then again by
      you. Pick one layer: let the framework escape user input, and never feed already-escaped
      strings into `dangerouslySetInnerHTML` or
      `innerHTML`.

// BUG: React already escapes, so this renders "<" as text

// FIX: write the raw character — React escapes it safely

// BUG: double-escaping user input for innerHTML
el.innerHTML = escapeHtml(userInput).replace(/&/g, '&');

4. Using for layout spacing

      Stacking ` ` entities to indent or align text works
      visually but breaks on narrow screens and with different font metrics. A non-breaking space
      also stops text from wrapping, which can push layout unexpectedly. Use CSS
      `margin`, `padding`, or
      `gap` for spacing instead — reserve
      ` ` for keeping two words on the same line (for
      example, "10 kg" or "Chapter 5").

5. Confusing decimal and hex numeric references

      `&#38;` (decimal) and
      `&#x26;` (hex) both render
      `&`, but they are not interchangeable digits. Writing
      `&#x38;` renders the character `8`,
      not `&`. Check the prefix:
      `#x` means hexadecimal, plain
      `#` means decimal.

Frequently Asked Questions

Why use HTML entities instead of typing the character directly?

Three reasons: reserved characters like
<, >, and
& would be interpreted as markup;
encoding safety — an entity works even if the file encoding drops
the character (for example, a smart quote in a document declared as ASCII); and
reliability — invisible characters such as the non-breaking space
are hard to type and easy to mistake for a regular space.

What is the difference between and a regular space?

A non-breaking space ( , U+00A0) prevents
the browser from wrapping a line at that point, so "10 kg" stays together. It also
does not collapse: HTML collapses runs of regular spaces into one, but multiple
entities each keep their width, which is
why they are often misused for indentation. Use them for preventing breaks, not for
layout.

What is the difference between &, &, and &?

All three render the same & character.
& is the named entity — readable but only
available for characters that have a defined name. &
is the decimal numeric reference and & the
hex one; numeric references work for any Unicode code point, even ones without a
name. Use named entities for readability and numeric references for obscure symbols.

Do I need to escape quotes inside HTML attributes?

Only the quote that delimits the attribute needs escaping: in
the
inner double quotes must be ". Inside text
content, quotes are harmless and do not need escaping. Escaping them everywhere is
never wrong, but it makes source harder to read — escape only where required, and
prefer single quotes as attribute delimiters when the value contains double quotes.

Why does my page show < as literal text instead of <?

The text was escaped twice. If you write <
in your source, the browser parses & into
& and shows the literal text
<. This usually happens when a template
engine or framework that already escapes output receives pre-escaped input, or when
user input is escaped more than once. Escape at exactly one layer.

        **Related Tools:**
        [Base64 Encoder/Decoder](https://devtoolshub.cloud/tools/base64)

        [JSON Formatter](https://devtoolshub.cloud/tools/json-formatter)

        [Regex Tester](https://devtoolshub.cloud/tools/regex-tester)

Cron Expression Guide: Complete Reference with Examples

kingfujing — Thu, 12 Nov 2026 02:00:36 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

Cron is the time-based job scheduler built into Unix-like operating systems. It
lets you schedule commands or scripts to run at specific times — every minute, every
Tuesday at 3 AM, or the first day of every quarter. Despite its power, the syntax
can be cryptic for beginners and even experienced developers find themselves checking
references regularly.

      This guide covers everything you need to know about cron expressions: the five
      standard fields, special strings, real-world schedule examples, troubleshooting tips,
      and timezone considerations. Whether you're writing a crontab file or configuring
      a cloud scheduler, this reference has you covered.

⚡ Quick Tip Use our

Unix Timestamp Converter

to convert cron timestamps to human-readable dates during debugging, and our

JSON Formatter

to read cron job output logs.

1. Cron Syntax Fundamentals

      A standard cron expression has five fields, separated by spaces:

Position	Field	Range	Allowed Special Chars
1	Minute	0 - 59	* , - /
2	Hour	0 - 23	* , - /
3	Day of Month	1 - 31	* , - / ? L W
4	Month	1 - 12 (or JAN - DEC)	* , - /
5	Day of Week	0 - 7 (or SUN - SAT)	* , - / ? L #

      **Important note on Day of Week:** Both 0 and 7
      represent Sunday. Most systems use 0 for Sunday, 1 for Monday, through 6 for Saturday.
      Some systems (like Quartz) use 1 for Sunday and 2-7 for Monday-Saturday — always check
      your implementation.

Special Characters

Char	Name	Description	Example
*	Wildcard	Every value in the field	* * * * * = every minute
,	List	Multiple values	0,30 * * * * = at :00 and :30
-	Range	All values in a range	0 9-17 * * * = 9 AM to 5 PM
/	Step	Every N units	/15 * * * = every 15 min
?	No specific value	Used in day-of-month/day-of-week (alternative to *)	0 0 ? * MON = every Monday
L	Last	Last day of month or week	0 0 L * * = last day of month
W	Weekday	Nearest weekday to given day	0 0 15W * * = nearest weekday to 15th
#	Nth occurrence	Nth weekday of the month	0 0 ? * 2#1 = first Monday

⚠️ ? vs * in Cron In standard Unix cron, * is used everywhere.
The ? character is specific to Quartz-style cron
expressions (used by Java-based schedulers like Spring). In Quartz, only one of
day-of-month or day-of-week can be specified — the other must be
? .

2. Special Strings

      Many cron implementations support shorthand strings for common schedules. These are
      especially useful in cloud schedulers (AWS EventBridge, Google Cloud Scheduler) and
      systemd timers.

String	Equivalent Expression	Description
@yearly	0 0 1 1 *	Run once a year at midnight on January 1
@annually	0 0 1 1 *	Same as @yearly
@monthly	0 0 1 * *	Run once a month at midnight on the first day
@weekly	0 0 * * 0	Run once a week at midnight on Sunday
@daily	0 0 * * *	Run once a day at midnight
@midnight	0 0 * * *	Same as @daily
@hourly	0 * * * *	Run once an hour at minute 0
@reboot	N/A	Run once at system startup (not a true time expression)

3. Common Schedule Examples

      Here are real-world cron expressions organized by use case. Copy-paste these into
      your crontab and adjust as needed.

Every Minute / High Frequency

Expression	Description
* * * * *	Every minute
/5 * * *	Every 5 minutes
/10 * * *	Every 10 minutes
/15 * * *	Every 15 minutes
/30 * * *	Every 30 minutes

Hourly / Every N Hours

Expression	Description
0 * * * *	Every hour at minute 0
0 /2 * *	Every 2 hours
0 /3 * *	Every 3 hours
0 /6 * *	Every 6 hours
0 /12 * *	Every 12 hours

Daily Schedules

Expression	Description
0 0 * * *	Daily at midnight
30 5 * * *	Daily at 5:30 AM
0 2 * * *	Daily at 2:00 AM (common for maintenance)
0 22 * * *	Daily at 10:00 PM
0 8,12,17 * * *	Daily at 8 AM, 12 PM, and 5 PM
0 9-17 * * *	Every hour from 9 AM to 5 PM (business hours)

Weekly / Weekday Schedules

Expression	Description
0 0 * * 0	Every Sunday at midnight
0 9 * * 1	Every Monday at 9 AM
0 0 * * 1-5	Every weekday at midnight
0 9 * * 1-5	Weekdays at 9 AM
0 18 * * 5	Every Friday at 6 PM
0 0 * * 6,0	Weekends at midnight

Monthly / Advanced Schedules

Expression	Description
0 0 1 * *	First day of every month at midnight
0 0 15 * *	15th of every month at midnight
0 0 L * *	Last day of every month (Quartz), or at midnight on the 31st (Unix)
0 0 1 1 *	January 1st (yearly)
0 0 1 /3	First day of every quarter
0 0 ? * MON#1	First Monday of every month (Quartz)
0 0 ? * FRI#3	Third Friday of every month (Quartz)
0 0 15W * *	Nearest weekday to the 15th (Quartz)

4. Crontab Quick Reference

      The `crontab` command manages your cron jobs. Each
      user has their own crontab file.

Command	Description
crontab -e	Edit your crontab file (opens in default editor)
crontab -l	List your current cron jobs
crontab -r	Remove your crontab file (deletes all jobs!)
crontab -u user -l	List another user's crontab (root only)
crontab /path/to/file	Install a crontab from a file

      A crontab entry has this format:

# ┌───────────── minute (0-59)
# │ ┌───────────── hour (0-23)
# │ │ ┌───────────── day of month (1-31)
# │ │ │ ┌───────────── month (1-12)
# │ │ │ │ ┌───────────── day of week (0-7, 0 or 7 = Sunday)
# │ │ │ │ │
# * * * * *  command_to_run

# Example: backup database every day at 2:30 AM
30 2 * * * /usr/local/bin/backup.sh

# Example: send a report every Monday at 9 AM
0 9 * * 1 /usr/local/bin/send-report.sh

5. Timezone Considerations

      Standard Unix cron uses the **system timezone**.
      This is one of the most common sources of confusion — especially when your server
      is in UTC and you expect a local time.




      -
        **Unix cron** reads the system's timezone
        (set via `/etc/timezone` or the TZ environment variable).
        You can set `TZ=America/New_York` at the top of your
        crontab to run jobs in a specific timezone.


      -
        **Systemd timers** use the system timezone.
        Check with `timedatectl`.


      -
        **AWS EventBridge** supports setting a timezone
        per rule. The default is UTC.


      -
        **Google Cloud Scheduler** requires you to specify
        the timezone explicitly (e.g., `America/New_York`).


      -
        **Kubernetes CronJobs** run in the timezone of the
        kube-controller-manager. As of Kubernetes 1.27+, you can set
        `spec.timeZone` in the CronJob spec.

⚠️ Daylight Saving Time Cron jobs running during DST transitions can behave unexpectedly:
Spring forward — if you schedule a job at
2:30 AM, it won't run because that time doesn't exist.
Fall back — a job at 1:30 AM may run twice.
To avoid this, schedule critical jobs in UTC or choose times outside the DST window
(e.g., 3 AM for daily tasks).

6. Troubleshooting

      Cron jobs can fail silently. Here are the most common issues and how to fix them.

Problem	Solution
Job never runs	Check the system timezone. Run `date` to verify. Test with `/1 * * * echo "test" >> /tmp/cron-test.log`
Job runs but does nothing	Cron runs with a limited PATH (~/usr/bin:/bin). Always use absolute paths to commands and scripts. Or set `PATH=/usr/local/bin:/usr/bin:/bin` at the top of your crontab.
No log output	Redirect output: `* * * * * /script.sh >> /var/log/cron.log 2>&1`. Cron emails output by default (check `MAILTO`).
Job runs at wrong time	Check timezone: `timedatectl \
Permission denied	Make the script executable: {% raw %}`chmod +x /path/to/script.sh`. Check that the cron user has execution rights.
"bad minute" syntax error	Check for invisible characters, trailing spaces, or tab issues. Validate with `crontab -e` which does basic syntax checking.
Environment variables not set	Cron runs in a minimal environment. Source your profile: `* * * * * . $HOME/.profile; /script.sh`. Or set variables directly in crontab.
Job runs multiple times	Check for duplicate crontab entries. Use `crontab -l` to verify. Also check system cron directories like `/etc/cron.d/`.

Debugging Checklist

      - Verify the cron daemon is running: `systemctl status cron` or `ps aux | grep cron`

      - Check system timezone: `timedatectl` or `date +%Z`

      - List your crontab: `crontab -l`

      - Add a simple test job that writes to a file every minute

      - Check cron logs: `grep cron /var/log/syslog` or `/var/log/cron`

      - Ensure the script is executable and uses absolute paths

      - Redirect stdout and stderr to a log file for debugging

7. Cron in the Cloud

      Cloud-native schedulers use cron-like syntax with some differences. Here's how
      each platform handles it:

Platform	Format	Notes
AWS EventBridge	cron(0 12 * * ? *)	Uses 6-field Quartz format (adds year). Must have `?` for either day-of-month or day-of-week
Google Cloud Scheduler	0 12 * * *	Standard 5-field Unix format. Timezone must be specified separately
Azure Scheduler		Uses JSON with `schedule` property. Supports cron expressions with 6 fields including seconds
Kubernetes CronJob	0 12 * * *	Standard 5-field Unix format. `spec.timeZone` available in k8s 1.27+
GitHub Actions	cron: '0 12 * * *'	Standard 5-field format. Uses UTC. Add `timezone: America/New_York` for other zones

8. Alternative Notations

      Some systems extend cron syntax with additional fields or alternative formats:

6-Field (Quartz) Format

      Quartz schedulers (common in Java / Spring Boot) add a seconds field at the beginning
      and an optional year field at the end:

# ┌───────────── second (0-59)
# │ ┌───────────── minute (0-59)
# │ │ ┌───────────── hour (0-23)
# │ │ │ ┌───────────── day of month (1-31)
# │ │ │ │ ┌───────────── month (1-12)
# │ │ │ │ │ ┌───────────── day of week (1-7, 1 = Sunday)
# │ │ │ │ │ │
# * * * * * *  command

# Example: run at 10:15 AM every day
0 15 10 * * ?

Common Mistakes & How to Avoid Them

      Most cron incidents aren't syntax errors — they're environment

      mismatches between your shell and cron's minimal runtime. These are

      the five that bite developers most often in production.

  -
    **Assuming cron uses your local timezone.**
    Cron uses the *system* timezone, not your shell's
    `TZ` or locale. Verify with
    `timedatectl`. To force a zone, put
    `CRON_TZ=America/New_York` at the top of your
    crontab (Vixie cron), or schedule in UTC and convert.


  -
    **Using relative paths.**
    Cron's default `PATH` is minimal
    (`/usr/bin:/bin`), so
    `node`, `python3`,
    and project binaries often aren't found. Use absolute paths to both the
    interpreter and the script, or set
    `PATH=/usr/local/bin:/usr/bin:/bin` at the top
    of the crontab.


  -
    **Forgetting to escape `%`.**
    In a crontab, `%` is translated to a newline.
    A command like `date +%Y-%m-%d` silently
    breaks — write it as `date +\%Y-\%m-\%d`.


  -
    **Combining day-of-month and day-of-week.**
    The two fields are *OR'd*, not AND'd:
    `0 0 1 * 1` runs on the 1st of the month
    * and* every Monday — twice as often as intended. Use
    `?` in Quartz-style schedulers, or split into
    two separate jobs.


  -
    **Scripts that aren't executable.**
    If your script lacks `chmod +x` or a valid
    shebang, cron fails silently — no email, no log entry. Always run
    `chmod +x /path/to/script.sh` and test the
    script manually before wiring it into cron.

Frequently Asked Questions

What's the difference between * and ? in cron expressions?

means "every value" in a field. ? is a Quartz-specific (6-field) character meaning "no specific value" — used in either day-of-month or day-of-week so the two never conflict, e.g. 0 0 12 ? * MON. Standard 5-field Unix cron does not support ?; use * there.

Why didn't my cron job run?

Check, in order: the daemon is running (systemctl status cron),
the timezone matches your expectation (date),
the script is executable and uses absolute paths, and the logs show an
attempt (grep cron /var/log/syslog). Add
a test job — * * * * * echo hi >> /tmp/cron-test.log
— to isolate whether the problem is cron itself or your command.

How do I run a job every 30 minutes?

Use the step operator in the minute field:
*/30 * * * * command. Likewise
*/15 * * * * for every 15 minutes and
0 */2 * * * for every 2 hours on the hour.

Is @daily the same as 0 0 * * *?

Yes — both run at midnight every day. @daily
is a special string alias. The family includes
@hourly, @midnight,
@weekly, @monthly,
@yearly, and
@reboot, which runs once when the cron
daemon starts.

Why did my cron job run twice or at the wrong time?

The usual culprits: duplicate entries in crontab -l,
the same job also defined in /etc/cron.d/ or
/etc/crontab, DST fall-back running the
job twice, or a system timezone different from the one you assumed. Run
crontab -l and
timedatectl to rule them out.

🔍 Related Resources Check out our

Unix Timestamp Converter

for converting cron execution times, and our

Unix Timestamp Cheat Sheet

for working with dates and times across programming languages.

CSS Units Cheat Sheet: px, em, rem, vh, and When to Use Each

kingfujing — Thu, 12 Nov 2026 01:53:41 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

CSS units can be confusing. Should you use px or rem? When does vw make sense? What about ch and ex? Picking the right unit makes the difference between a layout that breaks and one that gracefully adapts to every screen size.

This reference breaks CSS units into two categories — absolute and relative — with clear examples of when to use each. Bookmark this page for your next responsive design project.

💡 Quick Rule of Thumb

Use rem for font sizes, px for borders/shadows, % for widths, vw/vh for full-screen sections, and em for spacing relative to the current font size.

Absolute Units

Absolute units are fixed-length values. They don't scale with the viewport, parent element, or font size. Use them for print stylesheets, borders, and situations where precision matters regardless of screen size.

Unit	Name	Relative to	Best For
`px`	Pixel	1px = 1/96th of 1 inch (screen)	Borders, shadows, small precise spacing, images
`pt`	Point	1pt = 1/72nd of 1 inch	Print stylesheets, traditional typography
`pc`	Pica	1pc = 12pt = 1/6th of 1 inch	Print layouts (rarely used on web)
`cm`	Centimeter	1cm = 37.8px (approx)	Print stylesheets, physical measurements
`mm`	Millimeter	1mm = 1/10th of 1cm	Print stylesheets
`in`	Inch	1in = 96px	Print stylesheets
`Q`	Quarter-millimeter	1Q = 1/40th of 1cm	Print, Japanese/CJK layouts

⚠️ When Not to Use px

Avoid px for font sizes in modern responsive design. Users who change their browser's default font size will see no change in pixel-sized text, which creates accessibility issues. Use rem instead — it respects the user's font size preference.

Relative Units

Relative units scale based on the context — the viewport, parent element, or root font size. They are the foundation of responsive and accessible design.

Font-Relative Units

Unit	Name	Relative to	Best For
`em`	Em	Font size of the parent element	Spacing, padding, margins relative to text size
`rem`	Root Em	Font size of the root (`<html>`) element	Font sizes, spacing (accessibility-friendly)
`ch`	Character	Width of the '0' character in current font	Input widths, line length constraints
`ex`	X-height	Height of the 'x' character in current font	Vertical alignment, inline spacing
`ic`	Ideograph	Width of CJK ideograph character	Chinese/Japanese/Korean text layouts
`lh`	Line height	Computed line-height of the element	Vertical rhythm, consistent spacing
`rlh`	Root line height	Computed line-height of the root element	Global vertical rhythm

Viewport-Relative Units

Unit	Name	Relative to	Best For
`vw`	Viewport Width	1% of viewport width	Full-width elements, hero sections, fluid typography
`vh`	Viewport Height	1% of viewport height	Full-height sections, modal overlays, sticky elements
`vmin`	Viewport Minimum	1% of the smaller viewport dimension (width or height)	Responsive square elements, safe sizing for all orientations
`vmax`	Viewport Maximum	1% of the larger viewport dimension (width or height)	Full-screen backgrounds, decorative elements
`svw` / `svh`	Small Viewport	Viewport size excluding dynamic browser chrome	Mobile-safe full-screen layouts
`lvw` / `lvh`	Large Viewport	Viewport size including potential browser chrome	When you want the full device screen regardless of UI
`dvw` / `dvh`	Dynamic Viewport	Dynamically updates as browser chrome shows/hides	Works like 100vh but handles mobile toolbar changes

⚠️ Viewport Unit Gotcha on Mobile

On iOS Safari, 100vh includes the browser toolbar height, which collapses when scrolling. This causes content to be taller than expected. Use 100dvh (dynamic viewport height) or 100svh (small viewport height) for reliable full-height sections on mobile.

Percentage Unit

Unit	Name	Relative to	Best For
`%`	Percentage	Depends on property: width → parent width, height → parent height, font-size → parent font-size, padding/margin → parent width (even for vertical padding)	Fluid layouts, responsive widths, aspect ratios

💡 Percentage Padding Quirk

When using padding-top: 50% or padding-bottom: 50%, the percentage is calculated from the parent's width, not height. This is actually useful for creating fixed-aspect-ratio boxes (like a 16:9 container) without JavaScript.

When to Use Each Unit

The table below maps common CSS properties to their recommended units.

Property	Recommended Unit	Why
`font-size`	`rem`	Respects user's browser font size setting. Avoids compounding issues of em.
`padding / margin`	`rem`	Consistent spacing regardless of nested font sizes.
`width / max-width`	`% or rem`	% for fluid layouts, rem for fixed content widths (e.g., article max-width).
`height`	`auto (avoid fixed)`	Let content determine height. Use min-height with vh for full-screen sections.
`border-width`	`px`	Borders should be crisp and not scale with text size.
`border-radius`	`px or rem`	px for small radii, rem for larger rounded corners that should scale.
`box-shadow`	`px`	Shadow blur and spread should stay crisp.
`line-height`	`unitless (e.g., 1.5)`	Unitless values scale proportionally with font-size changes.
`gap`	`rem`	Grid/flexbox gaps should scale with content size.
`hero / full-screen`	`dvh`	Dynamic viewport handles mobile browser toolbar correctly.
`fluid typography`	`clamp()`	Combine rem + vw with min/max bounds (e.g., clamp(1rem, 2.5vw, 2rem)).
`icon sizing`	`em`	Icon scales with surrounding text size automatically.

Practical Examples

Fluid Typography with clamp()

The clamp() CSS function lets you set a font size that scales between a minimum and maximum value. This is the modern way to do responsive typography without media queries.

/* Fluid heading: scales from 1.5rem to 3rem between 320px and 1200px viewports */
h1 {
  font-size: clamp(1.5rem, 1rem + 2.5vw, 3rem);
  line-height: 1.1;
}

/* Fluid body text */
p {
  font-size: clamp(0.875rem, 0.75rem + 0.5vw, 1.125rem);
  line-height: 1.6;
}

Full-Height Hero Section (Mobile-Safe)

.hero {
  /* dvh = dynamic viewport height — handles mobile browser toolbar */
  min-height: 100dvh;
  /* Fallback for older browsers */
  min-height: 100vh;
  min-height: 100svh;
  display: flex;
  align-items: center;
  justify-content: center;
}

Consistent Spacing with rem

:root {
  /* Set root font size. Browser default is 16px = 1rem */
  font-size: 100%; /* Respects user preferences */
}

.card {
  padding: 1.5rem;    /* = 24px at default font size */
  margin-bottom: 1rem; /* = 16px */
  border-radius: 0.5rem; /* = 8px */
  gap: 0.75rem;       /* = 12px grid gap */
}

h2 {
  font-size: 1.25rem; /* = 20px */
  margin-bottom: 0.5em; /* relative to h2 font size */
}

16:9 Aspect Ratio Box

.aspect-16-9 {
  /* Padding % is calculated from parent width */
  /* 9/16 = 56.25% */
  width: 100%;
  padding-bottom: 56.25%;
  position: relative;
  overflow: hidden;
}

.aspect-16-9 > * {
  position: absolute;
  inset: 0;
  width: 100%;
  height: 100%;
  object-fit: cover;
}

Perfectly Centered Modal

.modal-overlay {
  position: fixed;
  inset: 0;
  display: flex;
  align-items: center;
  justify-content: center;
  background: rgba(0, 0, 0, 0.5);
}

.modal {
  width: min(90vw, 600px);  /* 90% of viewport width, max 600px */
  max-height: 90dvh;        /* 90% of dynamic viewport height */
  overflow-y: auto;
  padding: 2rem;
  background: #fff;
  border-radius: 0.75rem;
}

calc() in Practice

The calc() function lets you mix units freely. It's extremely useful for fluid layouts where you need arithmetic operations on CSS values.

/* Sidebar + main: 250px sidebar, rest is main */
.main-layout {
  display: grid;
  grid-template-columns: 250px 1fr;
  gap: 2rem;
}

/* Full-width container with fixed gutters */
.container {
  width: calc(100% - 3rem);
  max-width: 1200px;
  margin-inline: auto;
}

/* Fluid typography alternative */
h1 {
  font-size: calc(1.5rem + 2vw);
}

/* Height minus header */
.content {
  min-height: calc(100dvh - 4rem);
}

/* Background that extends beyond content area */
.hero {
  width: 100vw;
  margin-left: calc(-50vw + 50%);
}

Unit Comparison Table

A quick comparison of how different units behave at different scales. Assumes root font size of 16px and a 1200px wide viewport.

Value	px	rem	em (parent 16px)	vw (1200px)	%
Small	8px	0.5rem	0.5em	0.67vw	0.67%
Body	16px	1rem	1em	1.33vw	1.33%
Medium	24px	1.5rem	1.5em	2vw	2%
Large	32px	2rem	2em	2.67vw	2.67%
Heading	48px	3rem	3em	4vw	4%

🎯 Summary: Unit Decision Flow

font-size → rem (or clamp() for fluid scaling)

spacing (padding, margin, gap) → rem (consistent everywhere)

widths → % (fluid), rem (fixed content), min() (max bound)

heights → auto (preferred), dvh (full-screen)

borders / shadows → px (keep them crisp)

icon sizes → em (scale with text)

line-height → unitless number (always)

fluid typography → clamp() with rem and vw

full viewport sections → 100dvh (dynamic) or 100svh (small)

mixed calculations → calc()

Common Mistakes & How to Avoid Them

CSS units seem simple until a layout breaks. These are the mistakes developers make most often — and the fixes that prevent them.

1. Using px for Font Sizes Hurts Accessibility

px font sizes ignore the user's browser font-size setting, so users who increase their default font size (often for vision reasons) see no change on your site. Use rem for font sizes — it scales with the root font size — and reserve px for borders, shadows, and 1px hairline rules that should stay crisp.

2. Confusing em with rem

rem is always relative to the root element font size (usually 16px), so it is predictable anywhere in the tree. em is relative to the current element's font size, and because it compounds, nested elements can produce surprising sizes: a 1.5em padding inside a 1.5em font becomes 2.25em of effective spacing. Use rem for global spacing and typography; use em deliberately when a component should scale with its own font size (icons, button padding).

3. Using 100vh for Mobile Full-Height Sections

On mobile browsers, 100vh refers to the largest viewport, which includes the area hidden behind the URL bar — so a 100vh section gets cut off or causes scroll jumps when the bar collapses. Use 100dvh (dynamic viewport height) for mobile full-height layouts, with 100svh as a fallback for older browsers.

4. Using vw for Font Sizes Without clamp()

A headline set to 4vw looks great on desktop but becomes unreadably small on phones and comically huge on ultrawide monitors. Wrap viewport units in clamp() with rem bounds: font-size: clamp(1.5rem, 4vw, 3rem). This gives you fluid scaling without ever crossing accessibility limits.

5. Expecting Percentage Heights to "Just Work"

height: 50% only works when the parent has an explicit height (not auto). A common trap is setting a child to 100% inside a parent whose height comes from content — the percentage resolves to auto and the layout collapses. If the parent's height is content-driven, use flexbox/grid stretch, min-height, or viewport units instead of percentages.

Frequently Asked Questions

What is the difference between px and rem?

px is an absolute unit — 1px is 1/96th of an inch on screen — so it never changes regardless of browser settings. rem is relative to the root element font size (usually 16px, so 1rem = 16px). Because rem scales when users change their browser's default font size, it is the recommended unit for font sizes, padding, and margin. Use px for borders and shadows that must stay visually identical at any zoom level.

What is the difference between em and rem?

rem is relative to the root element font size, so 1rem is the same everywhere in the document. em is relative to the current element's font size, and it compounds through nesting — a 2em margin inside a 1.5em font resolves to 3em. This makes em great for components that should scale with their own text (icon sizes, button padding) and rem better for site-wide spacing and typography.

When should I use vw and vh?

vw and vh are 1% of the viewport width and height. Use them for full-screen hero sections, overlays, and fluid typography inside clamp(). Avoid raw vh for mobile heights — the URL bar changes the visible viewport, so use 100dvh (dynamic) or 100svh (small) instead. For widths, prefer % when the size should relate to a container rather than the whole viewport.

Should I use px or rem for font sizes?

Use rem. Because rem is relative to the root font size, it respects the user's browser font-size preference — a core accessibility requirement. px ignores that setting, which can make your text impossible to resize for users with low vision. A common pattern is setting the root font size in rem (or leaving it at the default 16px) and sizing everything else in rem, with clamp() for fluid type.

What is the difference between vh, svh, lvh, and dvh?

These are the four viewport-height units. vh equals 1% of the largest viewport — on mobile that includes the area hidden behind the browser UI. svh is the small viewport (visible area when the URL bar is shown), lvh is the large viewport (URL bar hidden), and dvh is the dynamic viewport, which updates live as the browser UI expands and collapses. For mobile full-height sections, 100dvh gives the smoothest behavior, with 100svh as a fallback.

Try It Yourself

If this cheat sheet helped you clean up your CSS, try the free developer tools on DevToolsHub. The Color Converter is handy when you're writing CSS that mixes hex, rgb(), and hsl() values alongside your unit choices, and the JSON Formatter is a quick way to tidy up the design tokens and theme config files where your spacing and typography scales live. Both run entirely in your browser — no sign-up, no tracking.

Related Tools: Color Converter · JSON Formatter · Base64 Encoder/Decoder · Regex Tester

Git Commands Cheat Sheet: The Commands You Actually Use Daily

kingfujing — Thu, 12 Nov 2026 01:52:36 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

Git is the backbone of modern software development, but its command surface is vast. Even experienced developers reach for documentation daily. This cheat sheet covers the essential Git commands you'll use every day — from initializing a repository to interactive rebase and everything in between.

Each section groups related commands with common options, flags, and practical examples. Bookmark this page and come back whenever you need to remember the exact syntax for a tricky operation.

⚡ Quick Tip

Use git status constantly. It's the safest command in Git — it tells you exactly what's going on without changing anything.

1. Setup & Configuration

Configure your Git identity and preferences. These are the first commands you run on a new machine.

Command	Description
`git init`	Create a new Git repository in the current directory
`git clone <url>`	Clone an existing repository from a remote URL
`git config --global user.name "Name"`	Set your global Git username for all commits
`git config --global user.email "email@example.com"`	Set your global Git email for all commits
`git config --global core.editor "code --wait"`	Set VS Code as your Git editor
`git config --global init.defaultBranch main`	Set default branch name to "main" instead of "master"
`git config --list`	Show all configured Git settings
`git config --global alias.st status`	Create an alias: `git st` = `git status`

Pro tip: Set up aliases early. Common ones include co for checkout, br for branch, ci for commit, and lg for a custom pretty log.

git config --global alias.co checkout
git config --global alias.br branch
git config --global alias.ci commit
git config --global alias.st status
git config --global alias.lg "log --oneline --graph --all --decorate"

2. Staging & Committing

The core workflow: make changes, stage them, commit them. Master these commands to keep your history clean and meaningful.

Command	Description
`git status`	Show working tree status — modified, staged, and untracked files
`git add <file>`	Stage a specific file for commit
`git add .`	Stage all changes in current directory (new, modified, deleted)
`git add -p`	Stage changes interactively — choose which hunks to stage (patches)
`git commit -m "message"`	Commit staged changes with an inline message
`git commit -am "message"`	Stage all tracked files and commit in one step (skips `git add`)
`git commit --amend`	Amend the last commit with new changes or a new message
`git restore <file>`	Discard uncommitted changes in a working file (modern alternative to checkout)
`git restore --staged <file>`	Unstage a file but keep the changes in working directory
`git rm <file>`	Remove a file from both working tree and staging area
`git mv <old> <new>`	Rename or move a file and stage the change

💡 Interactive Staging

git add -p lets you stage parts of a file. This is invaluable for separating refactoring from feature work in a single file. Press y to stage a hunk, n to skip, s to split, e to manually edit.

3. Branching

Branches are Git's superpower. Create, switch, list, and manage branches efficiently.

Command	Description
`git branch`	List local branches. Current branch highlighted with *
`git branch -a`	List all branches — local and remote tracking
`git branch <name>`	Create a new branch at current HEAD (does not switch to it)
`git checkout <branch>`	Switch to an existing branch
`git checkout -b <name>`	Create and switch to a new branch in one step
`git switch <branch>`	Modern alternative to checkout — switch branches cleanly
`git switch -c <name>`	Create and switch to a new branch (modern `-b` equivalent)
`git branch -d <name>`	Delete a branch (only if fully merged)
`git branch -D <name>`	Force delete a branch even if not merged
`git branch -m <old> <new>`	Rename a branch
`git show-branch`	Show branches and their commits with ASCII graph

4. Remote Repositories

Working with remotes — GitHub, GitLab, Bitbucket, or your own server. Push, pull, fetch, and manage remote connections.

Command	Description
`git remote -v`	List remote repositories with fetch/push URLs
`git remote add origin <url>`	Add a new remote named "origin"
`git remote remove <name>`	Remove a remote connection
`git remote rename <old> <new>`	Rename a remote
`git fetch <remote>`	Download objects and refs from remote without merging
`git pull`	Fetch from remote and merge into current branch (shortcut)
`git pull --rebase`	Fetch and rebase instead of merge (cleaner history)
`git push`	Push commits to the remote tracking branch
`git push -u origin <branch>`	Push a new branch and set up tracking (`-u` = `--set-upstream`)
`git push --force`	Force push (use with extreme caution — prefer `--force-with-lease`)
`git push --force-with-lease`	Safer force push — refuses if remote has new commits you haven't seen
`git push -d origin <branch>`	Delete a remote branch

⚠️ Force Push Safety

Always use --force-with-lease instead of --force. It checks that the remote branch is in the state you expect before overwriting. Plain --force can silently destroy a collaborator's work.

5. Undoing & Amending

Everyone makes mistakes. Here's how to undo them safely at every stage.

Command	Description
`git restore <file>`	Discard unstaged changes in working directory
`git restore --staged <file>`	Unstage a file (keep working changes)
`git reset HEAD~1`	Undo last commit, keep changes staged
`git reset --soft HEAD~1`	Undo last commit, keep changes staged (same as above)
`git reset --mixed HEAD~1`	Undo last commit, keep changes unstaged (default behavior)
`git reset --hard HEAD~1`	Undo last commit and discard all changes completely
`git revert <commit>`	Create a new commit that undoes a specific commit (safe for shared history)
`git revert HEAD`	Undo the most recent commit with a new inverse commit
`git commit --amend -m "new msg"`	Change the message of the last commit
`git commit --amend --no-edit`	Add staged changes to last commit without changing message

💡 Reset vs Revert

Reset rewrites history — use only on local commits that haven't been pushed. Revert creates a new commit that undoes the old one — safe for commits already pushed to shared branches.

6. Merging

Combine work from different branches. Understand merge vs rebase, and how to resolve conflicts.

Command	Description
`git merge <branch>`	Merge the specified branch into the current branch
`git merge --no-ff <branch>`	Merge with a merge commit even if fast-forward is possible
`git merge --squash <branch>`	Merge all commits from branch into one single commit (no merge history)
`git rebase <branch>`	Reapply current commits on top of another branch (linear history)
`git rebase -i HEAD~3`	Interactive rebase: squash, reword, reorder, drop commits
`git cherry-pick <commit>`	Apply a specific commit from another branch onto current branch
`git mergetool`	Launch the configured merge tool to resolve conflicts
`git merge --abort`	Abort current merge and restore pre-merge state
`git rebase --abort`	Abort current rebase and restore pre-rebase state
`git rebase --continue`	Continue rebase after resolving conflicts

Interactive rebase is one of Git's most powerful features. Use it to clean up commits before merging:

# Squash last 3 commits into one
git rebase -i HEAD~3

# Available actions in the editor:
# pick   - use commit as-is
# reword - use commit but edit message
# squash - combine with previous commit
# fixup  - like squash but discard message
# drop   - remove commit entirely
# edit   - stop to amend the commit

7. Stashing

Temporarily save uncommitted work when you need to switch branches or pull in changes. Your changes are saved in a stack and can be reapplied later.

Command	Description
`git stash`	Stash all uncommitted changes (tracked files only)
`git stash push -m "message"`	Stash with a descriptive message
`git stash -u`	Stash including untracked files (`--include-untracked`)
`git stash -a`	Stash all files including ignored ones (`--all`)
`git stash list`	List all stashes in the stack
`git stash pop`	Apply the most recent stash and remove it from the stack
`git stash apply`	Apply the most recent stash but keep it in the stack
`git stash apply stash@{2}`	Apply a specific stash by index
`git stash drop stash@{n}`	Remove a specific stash without applying it
`git stash clear`	Remove all stashes (irreversible)
`git stash show -p`	Show the diff of the most recent stash
`git stash branch <name>`	Create a new branch from a stash and drop the stash

8. Logs & History

Explore commit history, find changes, track down bugs, and understand who changed what and when.

Command	Description
`git log`	Show commit log with author, date, and message
`git log --oneline`	Compact log — one line per commit (hash + message)
`git log --graph --oneline --all`	ASCII graph of branch structure with compact log
`git log --oneline -n 5`	Show only the last 5 commits
`git log --author="name"`	Filter commits by author
`git log --grep="pattern"`	Search commit messages for a pattern
`git log -p`	Show full diff with each commit (very verbose)
`git log --stat`	Show commit metadata plus summary of changed files
`git diff`	Show unstaged changes in working tree
`git diff --staged`	Show staged changes (what will be committed)
`git diff A..B`	Show changes between two commits or branches
`git show <commit>`	Show a specific commit with its diff
`git blame <file>`	Show who last modified each line of a file and when
`git shortlog -sn`	Summary of commits per author, sorted by count

A useful alias for a beautiful, compact log view:

git log --graph --pretty=format:'%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset' --all

🎯 Quick Reference Card

Setup

git init

git clone <url>

git config --global user.name

Daily

git status

git add -p

git commit -m

git push

Branches

git switch -c <name>

git merge <branch>

git rebase -i HEAD~3

Fix Mistakes

git restore <file>

git commit --amend

git revert HEAD

git stash

Common Mistakes & How to Avoid Them

These are the mistakes I see most often in pull requests and on incident calls — and the exact commands to recover from them before they cost you an afternoon.

Committing secrets to the repository. A stray .env file or API key in a commit is the most expensive mistake in git. Rotate the credential immediately, then scrub history with git filter-repo --path .env --invert-paths. Deleting the file and committing again is not enough — the secret stays in history.
Trusting git commit -am to catch everything. The -a flag only stages changes to already tracked files; brand-new files are silently skipped. That's how "forgot to add file" commits happen. Run git status before committing and review hunks with git add -p.
Force-pushing to shared branches. A bare git push --force rewrites history and can destroy your teammates' commits. Use git push --force-with-lease instead — it aborts if the remote contains commits you haven't seen.
Amending commits that were already pushed. git commit --amend is a local operation. Amending a pushed commit creates divergent history and a confusing merge on the next pull. If the commit is on the remote, use git revert <sha> to add a new commit that undoes it.
Deleting both sides of a merge conflict. Stripping everything between the <<<<<<< and >>>>>>> markers often discards both versions. Read both sides, decide what to keep, then verify with git diff --check that no conflict markers remain before staging.

Frequently Asked Questions

How do I undo the last commit but keep my changes?

Run git reset --soft HEAD~1 to undo the commit while keeping your changes staged, or git reset HEAD~1 to unstage them. If the commit was already pushed, don't rewrite history — use git revert HEAD to add a new commit that undoes it. For a simple message fix, git commit --amend is enough.

How do I resolve merge conflicts?

Run git status to list conflicted files. Open each one, remove the <<<<<<<, =======, and >>>>>>> markers, and keep the version(s) you want. Stage with git add, then finish with git commit. To bail out entirely, run git merge --abort. To take one side wholesale: git checkout --ours <file> or git checkout --theirs <file>.

What's the difference between git fetch and git pull?

git fetch downloads new commits into remote-tracking branches (like origin/main) without touching your working tree. git pull is fetch followed by a merge — or a rebase with git pull --rebase. Fetch when you want to inspect changes first; pull when you're ready to integrate them into your branch.

How do I recover a deleted branch or lost commits?

Run git reflog to see every HEAD movement, find the SHA of the commit you lost, then recreate the branch with git branch <name> <sha> or check it out directly. Reflog entries expire after about 90 days (default), so act quickly before garbage collection removes them.

Why does git keep asking me for my password?

You're using HTTPS without a credential helper. Set one with git config --global credential.helper store (or cache for temporary caching), or switch to SSH keys generated with ssh-keygen. For HTTPS, GitHub and GitLab now require personal access tokens instead of account passwords.

Related Tools: Regex Tester · Base64 Encoder/Decoder · JSON Formatter

If you found this cheat sheet useful, bookmark DevToolsHub — it's a free, privacy-first toolkit for developers with no sign-ups and no tracking: regex testing, Base64 and JSON utilities, timestamp conversion, JWT decoding, UUID generation, and more. All tools run entirely in your browser.

REST vs GraphQL: Which API Style Should You Use in 2026?

kingfujing — Fri, 04 Sep 2026 11:29:50 +0000

Originally published on DevToolsHub — free, privacy-first developer tools that run entirely in your browser.

REST and GraphQL are the two dominant ways to design a web API today, and the debate between them is still alive — for good reason. They embody different philosophies: REST organizes an API around resources and HTTP semantics, while GraphQL organizes it around a typed schema and client-specified queries.

In this guide, we'll compare them across data fetching, caching, versioning, and real-world performance — so you can pick the right style for your next project instead of just following the hype.

💡 Quick Try: Both styles return JSON. Paste any API response into the free DevToolsHub JSON Formatter to inspect it with syntax highlighting and validation.

What is REST?

REST (Representational State Transfer) is an architectural style formalized by Roy Fielding in 2000. A RESTful API exposes resources as URLs, manipulates them with HTTP verbs (GET, POST, PUT, DELETE), and communicates outcomes through status codes (200, 201, 404, 429...). There is no single spec to implement — HTTP itself is the protocol, and conventions do the rest.

GET    /users/42          → 200 OK (one user)
GET    /users/42/posts    → 200 OK (their posts)
POST   /users             → 201 Created
DELETE /users/42          → 204 No Content

Pros: Simple and universally understood. HTTP caching (ETags, Cache-Control, CDNs) works out of the box. Status codes carry meaning. Any client, from curl to a smart fridge, can consume it.

Cons: Clients often need multiple round trips to assemble one view (under-fetching) or receive more data than they need (over-fetching). Endpoint sprawl grows with every new screen, and versioning (v1, v2...) becomes a maintenance burden.

What is GraphQL?

GraphQL is a query language for APIs and a runtime for executing those queries, open-sourced by Facebook in 2015 and now governed by the GraphQL Foundation. Instead of many endpoints, there is one endpoint and one strongly-typed schema. The client asks for exactly the fields it needs — in the exact shape it wants — and the server resolves them.

# One request: user + their posts, precisely shaped
query {
  user(id: 42) {
    name
    posts(last: 5) {
      title
      commentsCount
    }
  }
}

Pros: No over-fetching — the response mirrors the query. One round trip for nested data. A self-documenting type system with introspection (GraphiQL, generated SDKs). Frontend teams ship features without waiting for new endpoints.

Cons: HTTP-level caching largely disappears (everything is a POST to one URL). Resolver complexity can hide N+1 database queries. Query depth and cost must be limited to prevent abuse. More server-side machinery and a real learning curve.

Head-to-Head Comparison

Feature	REST	GraphQL
Type	✅ Architectural style	✅ Query language + runtime
Endpoints	Many (per resource)	One
Data shape	⚠️ Fixed by server	✅ Chosen by client
Over-fetching	❌ Common	✅ Eliminated
HTTP caching / CDN	✅ Native	❌ Needs custom layers
Versioning	⚠️ URL/header versions	✅ Schema evolution + deprecation
Learning curve	✅ Low	❌ Moderate to high

The Real Story: Trade-offs in Production

GraphQL was born from a concrete pain: Facebook's mobile news feed needed a deeply nested view of stories, authors, likes, and comments. With REST, that meant either a bespoke aggregation endpoint per screen or a waterfall of small requests over slow mobile networks. GraphQL flipped the contract — the client declares the view, the server composes it. For product teams iterating on UI weekly, that flexibility is the real selling point, not the absence of over-fetching alone.

But the costs are equally concrete. Because GraphQL requests are typically POSTs to a single URL, you lose HTTP caching almost entirely — no more free CDN caching of GET responses; caching moves into client libraries (Apollo, Relay) and custom server layers. And the resolver model introduces the classic N+1 problem: a list of 50 users can trigger 50 separate database lookups unless you batch with a tool like DataLoader. REST avoids this by design because each endpoint is a single handler you profile once.

The mature take in 2026: most serious platforms run both — REST for public, cache-heavy, resource-shaped APIs; GraphQL as an internal BFF (backend-for-frontend) layer where the client shape flexibility pays off.

When to Use Each

Use REST when:

You're building a public API for third-party developers
Responses are cacheable and CDN/HTTP caching matters
The domain is resource-shaped (CRUD on clear entities)
You need file uploads/downloads or streaming
The team wants standard tooling and a low learning curve

Use GraphQL when:

Clients are mobile or bandwidth-sensitive and over-fetching hurts
Screens need nested, aggregated data from many services
The frontend iterates fast and endpoint sprawl is slowing you down
You're unifying microservices behind a graph/federation layer
Multiple clients need different views of the same data

Code Examples

Node.js / Express: A REST endpoint

import express from 'express';
const app = express();

app.get('/api/users/:id', async (req, res) => {
  const user = await db.users.findById(req.params.id);
  if (!user) return res.status(404).json({ error: 'User not found' });
  res.set('Cache-Control', 'public, max-age=60'); // HTTP caching, free
  res.json(user);
});

app.listen(3000);

Apollo Server: The same data as GraphQL

import { ApolloServer } from '@apollo/server';
import { startStandaloneServer } from '@apollo/server/standalone';

const typeDefs = `
  type Post { title: String! }
  type User { name: String! posts: [Post!]! }
  type Query { user(id: ID!): User }
`;

const resolvers = {
  Query: {
    user: (_, { id }) => db.users.findById(id),
  },
  User: {
    posts: (user) => db.posts.findByUserId(user.id),
  },
};

const server = new ApolloServer({ typeDefs, resolvers });
await startStandaloneServer(server, { listen: { port: 4000 } });

Notice the difference: REST returns one fixed shape per URL; GraphQL lets the client compose user and posts in one request — at the price of managing a schema and resolvers on the server.

Final Verdict

🎯 Recommendation: Neither one "wins" — they solve different problems. Choose REST when your API is resource-shaped, benefits from HTTP caching, or is consumed by third parties. Choose GraphQL when client flexibility, nested views, and rapid frontend iteration are worth the extra server complexity. For most growing products: REST for the public edge, GraphQL as the internal BFF — the pragmatic hybrid.

Working with either style, you'll live in JSON responses — format and validate them in your browser with the free DevToolsHub JSON Formatter, no uploads required.

Common Mistakes & How to Avoid Them

Using GraphQL as a database. It's an API layer, not a query engine. Resolvers still execute database queries — a naive schema can generate worse queries than a hand-written REST handler.
Ignoring the N+1 problem. A list resolver that runs one query per item will melt your database under load. Batch with DataLoader or equivalent from day one.
Shipping GraphQL without depth limits. A malicious client can ask for infinitely nested queries and take your server down. Add depth limiting, cost analysis, or persisted queries.
Versioning GraphQL like REST. There is no v2 in GraphQL — evolve the schema: add fields, mark old ones @deprecated, and remove them only after usage monitoring shows they're gone.
Caching REST at the wrong level. If your REST responses vary by auth token, don't mark them publicly cacheable — you'll leak one user's data to another. Cache public resources; use ETags for the rest.

FAQ

Is GraphQL replacing REST?

No. REST remains the default for public APIs, simple resource operations, and anything that benefits from HTTP caching. GraphQL thrives in specific niches: mobile clients, aggregated views, and fast-moving frontend teams. Most large platforms run both.

Is GraphQL faster than REST?

It depends. GraphQL saves round trips for nested data (fewer network hops), but adds resolver overhead and loses HTTP caching. For a simple, cacheable resource, a well-designed REST endpoint served from a CDN is often faster end to end.

Can I use REST and GraphQL together?

Yes — and it's the most common architecture at scale. Expose a public REST API, and run an internal GraphQL BFF (backend-for-frontend) that aggregates your services for the app teams.

Does GraphQL only work over HTTP POST?

Queries and mutations are typically sent as HTTP POST to a single endpoint (GET is possible for queries but rare). Subscriptions use WebSocket or Server-Sent Events instead of plain HTTP.

How does caching work in GraphQL?

HTTP caching doesn't apply naturally because everything is a POST. Caching moves to normalized client-side stores (Apollo Client, Relay) and custom server layers like response caching or APQ (Automatic Persisted Queries).

Related Tools: JSON Formatter · URL Encoder / Decoder · JWT Decoder

If you found this useful, check out DevToolsHub — 9 free privacy-first developer tools, everything runs locally in your browser.

JWT vs OAuth2: What's the Difference and When to Use Each?

kingfujing — Tue, 25 Aug 2026 11:39:26 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

JWT and OAuth2 are two of the most confused terms in modern web development. Many developers treat them as interchangeable — but they solve completely different problems. JWT is a token format, while OAuth2 is an authorization framework. They often work together, which is exactly why the confusion exists.

In this guide, we'll compare JWT and OAuth2 across their roles, use cases, and how they combine — so you know what you're actually implementing in your next project.

💡 Quick Try: Have a token to inspect? Use our free JWT Decoder to decode and verify tokens right in your browser.

What is JWT?

JWT (JSON Web Token) is a compact, self-contained token format defined by RFC 7519. It's a JSON object encoded as a string, containing claims like user ID, role, and expiry, signed with a secret or public key. Anyone with the signing key can verify the token's authenticity without contacting a server.

header.payload.signature

// header: {"alg":"HS256","typ":"JWT"}
// payload: {"sub":"123","role":"admin","exp":1700000000}
// signature: HMACSHA256(base64Url(header)+"."+base64Url(payload), secret)

Pros: Self-contained — carries claims without a lookup. Verifiable offline. Works across any service that shares the key.

Cons: Just a token format — doesn't define how to get, refresh, or revoke it. No built-in scopes or third-party flow.

What is OAuth2?

OAuth2 is an authorization framework (RFC 6749) that defines how a user can grant a third-party application limited access to their resources. It involves roles (resource owner, client, authorization server, resource server), flows (authorization code, client credentials, PKCE), and scopes that limit what the token can do.

OAuth2 roles:
┌─────────────┐      ┌──────────────────┐
│  User (RO)  │      │ Client (App)     │
└──────┬──────┘      └────────┬─────────┘
       │                      │
       ▼                      ▼
┌─────────────────────────────────────┐
│  Authorization Server (e.g. Google) │
│  Issues access tokens + scopes      │
└─────────────────────────────────────┘

Pros: Standardized flows for third-party login. Scopes limit permissions. Industry standard for "Sign in with Google/GitHub".

Cons: Complex — multiple flows, redirects, and endpoints to manage. Tokens themselves can be any format (often JWT, but not required).

Head-to-Head Comparison

Feature	JWT	OAuth2
Type	✅ Token format	✅ Authorization framework
Solves	How to encode claims	How to grant access
Authentication	✅ Can carry auth data	❌ Authorization only
Scopes	❌ Not built-in	✅ First-class
Third-party login	❌ Not defined	✅ Core use case
Refresh flow	❌ Your job	✅ Standardized
Token format	✅ JWT (always)	⚠️ Opaque or JWT

How They Work Together: The Real Story

The confusion comes from the fact that OAuth2 often uses JWT as its access token format. When you sign in with Google, Google's authorization server issues an access token — and that token is frequently a JWT. So you're using both: OAuth2 for the flow, JWT for the token.

A common implementation: OAuth2 Authorization Code flow with PKCE obtains a JWT access token. The resource server verifies the JWT signature offline (no database lookup), while the authorization server handles issuing, refreshing, and revoking through OAuth2 endpoints.

JWT alone — fine for first-party apps (your SPA talking to your API)
OAuth2 alone — possible with opaque tokens (server validates via introspection)
OAuth2 + JWT — the industry standard for third-party access

When to Use Each

Use JWT when:

You need a self-contained, verifiable token for your own API
You want stateless auth across microservices sharing a key
You're building a first-party SPA/mobile app with your own login
You need to embed claims (role, permissions) in the token itself

Use OAuth2 when:

You need "Sign in with Google/GitHub/Facebook" third-party login
A third-party app needs limited access to your users' resources
You need scopes to control what each token can do
You're building an API platform that other developers integrate

Code Examples

Node.js: Sign-in with Google (OAuth2 + JWT)

const { OAuth2Client } = require('google-auth-library');
const jwt = require('jsonwebtoken');

const client = new OAuth2Client(GOOGLE_CLIENT_ID);

// Frontend sends the Google ID token after OAuth2 flow
async function googleLogin(idToken) {
  // 1. Verify the Google-issued token (OAuth2 flow result)
  const ticket = await client.verifyIdToken({
    idToken,
    audience: GOOGLE_CLIENT_ID
  });
  const { email, name } = ticket.getPayload();

  // 2. Issue your own JWT for your API
  const appToken = jwt.sign({ email, name }, JWT_SECRET, { expiresIn: '1h' });
  return appToken;
}

Python / FastAPI: JWT-only auth (first-party)

import jwt
from fastapi import Depends, HTTPException
from fastapi.security import OAuth2PasswordBearer

# OAuth2PasswordBearer is just a token extractor — the token itself is a JWT
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/login")

def get_current_user(token: str = Depends(oauth2_scheme)):
    try:
        payload = jwt.decode(token, SECRET, algorithms=["HS256"])
        return payload["sub"]
    except jwt.PyJWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

Final Verdict

🎯 Recommendation: They're not competitors — they're complementary. Use OAuth2 when you need standardized third-party login or scoped access to resources. Use JWT as the token format for fast, stateless verification. For most production apps: OAuth2 for the flow, JWT for the token — best of both worlds.

Decode and inspect any JWT instantly with our free online JWT Decoder. It runs entirely in your browser — no server uploads, no data leaks.

Common Mistakes & How to Avoid Them

Calling OAuth2 an authentication protocol. OAuth2 is about authorization (what you can access). For identity, pair it with OIDC (OpenID Connect) which adds an ID token.
Assuming OAuth2 requires JWT. OAuth2 tokens can be opaque strings validated via server introspection. JWT is optional — though very common.
Using JWT for third-party login. JWT alone has no flow for redirecting users to Google. You need OAuth2 (or OIDC) for the dance, JWT for the ticket.
Ignoring scopes. If you hand out full-access tokens, you've missed the point of OAuth2. Always request the minimum scopes needed.
Reinventing the wheel. Don't build your own OAuth2 server unless you must. Use Auth0, Keycloak, or the identity provider's managed flow.

Frequently Asked Questions

Is JWT the same as OAuth2?

No. JWT is a token format (how claims are encoded), while OAuth2 is an authorization framework (how access is granted). OAuth2 commonly uses JWT as its token format, but they are distinct concepts.

Does OAuth2 use JWT tokens?

Often yes, but not required. Many identity providers (Google, Auth0) issue JWT access tokens, but OAuth2 also supports opaque tokens validated via the introspection endpoint. JWT is the popular choice for stateless verification.

Should I use JWT or OAuth2 for my app?

For a first-party app with your own login, JWT alone is usually enough. For third-party login (Sign in with Google/GitHub) or building an API for other developers, use OAuth2 — with JWT as the token format.

What is the difference between OAuth2 and OIDC?

OAuth2 handles authorization (access tokens, scopes). OIDC (OpenID Connect) builds on OAuth2 and adds an ID token for authentication — so you know who the user is, not just what they can access.

Can I use JWT without OAuth2?

Absolutely. JWT is a standalone standard. You can issue and verify JWTs with your own login endpoint, no OAuth2 involved. OAuth2 only becomes necessary when you need third-party flows or scoped delegation.

SQL vs NoSQL: Which Database Should You Choose in 2026?

kingfujing — Tue, 25 Aug 2026 11:39:20 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

Choosing a database is one of the most consequential decisions in software architecture. SQL (PostgreSQL, MySQL) has ruled for 40+ years with rock-solid transactions. NoSQL (MongoDB, Redis, Cassandra) powers modern web scale with flexible schemas. But "SQL vs NoSQL" is not a one-size-fits-all battle — the right answer depends on your data, your scale, and your consistency requirements.

In this guide, we'll compare SQL and NoSQL across schema flexibility, scalability, transactions, and query power — so you can make an informed choice for your next project.

💡 Quick Try: Working with JSON data from your database? Use our free JSON Formatter to beautify and validate it right in your browser.

What is SQL (Relational)?

SQL databases organize data into tables with fixed schemas — rows and columns connected by relationships (foreign keys). They guarantee ACID transactions (Atomicity, Consistency, Isolation, Durability), which makes them the default choice for anything involving money, orders, or critical business data.

-- Fixed schema: every row has all columns
CREATE TABLE users (
  id SERIAL PRIMARY KEY,
  email VARCHAR(255) UNIQUE NOT NULL,
  name VARCHAR(100),
  created_at TIMESTAMPTZ DEFAULT now()
);

-- Powerful joins across related tables
SELECT u.name, o.total
FROM users u
JOIN orders o ON o.user_id = u.id
WHERE o.status = 'paid';

Pros: ACID transactions. Mature ecosystem and tooling. Complex queries with JOINs. Enforced data integrity.

Cons: Rigid schema — migrations are work. Vertical scaling is expensive. Sharding across nodes is complex.

What is NoSQL (Non-Relational)?

NoSQL is an umbrella term for databases that don't use the relational model. Common types: document (MongoDB), key-value (Redis), column-family (Cassandra), and graph (Neo4j). They trade strict consistency for flexibility and horizontal scalability — schemas are flexible, and data scales across many cheap nodes.

// Document store: schema-less, embed related data
{
  "_id": "507f1f77bcf86cd799439011",
  "email": "alice@example.com",
  "name": "Alice",
  "orders": [
    { "id": 1, "total": 99.5, "status": "paid" }
  ]  // related data embedded, no JOIN needed
}

Pros: Flexible schema — iterate fast. Horizontal scaling via sharding. Great for high write throughput and unstructured data.

Cons: No ACID guarantees (mostly). Complex queries require denormalization or aggregation pipelines. Consistency is often eventual.

Head-to-Head Comparison

Feature	SQL	NoSQL
Schema	✅ Fixed, enforced	❌ Flexible, dynamic
Transactions	✅ ACID	⚠️ Limited / eventual
Scaling	⚠️ Vertical (expensive)	✅ Horizontal (sharding)
Queries	✅ Powerful JOINs	⚠️ Limited relations
Flexibility	❌ Migrations needed	✅ Iterate instantly
Maturity	✅ 40+ years	⚠️ 15+ years
Best for	Money, orders, integrity	Scale, flexibility, speed

Scaling and Consistency: The Real Story

The biggest divide is the CAP theorem. SQL databases prioritize consistency — every read sees the latest write. NoSQL databases often prioritize availability and partition tolerance, accepting eventual consistency (reads may briefly see stale data).

In practice: a banking ledger must be consistent (SQL). A social media feed can tolerate a few seconds of staleness for the benefit of scaling to millions of users (NoSQL). Modern databases blur the line — PostgreSQL supports JSON columns for flexibility, and MongoDB added multi-document transactions — but the core tradeoff remains.

When to Use Each

Use SQL when:

Data has clear relationships (users → orders → items)
You need ACID transactions (payments, inventory, bookings)
You need complex queries with JOINs and aggregations
Data integrity is non-negotiable (finance, healthcare)

Use NoSQL when:

You have unstructured or rapidly changing data shapes
You need to scale horizontally to millions of users/writes
You're building real-time, high-throughput systems (caching, events)
Your queries are simple lookups, not complex joins

Code Examples

PostgreSQL: Relational with JSONB (hybrid)

-- Best of both: relational integrity + flexible JSON
CREATE TABLE products (
  id SERIAL PRIMARY KEY,
  name TEXT NOT NULL,
  price NUMERIC(10,2),
  attributes JSONB  -- flexible metadata
);

-- Query inside JSON
SELECT name FROM products
WHERE attributes->>'color' = 'red';

MongoDB: Document model

// Embedded documents avoid expensive joins
db.orders.insertOne({
  userId: ObjectId("..."),
  items: [
    { sku: "A1", qty: 2, price: 29.99 },
    { sku: "B2", qty: 1, price: 9.99 }
  ],
  total: 69.97,
  status: "pending"
});

// Flexible query with aggregation pipeline
db.orders.aggregate([
  { $match: { status: "paid" } },
  { $group: { _id: "$userId", total: { $sum: "$total" } } }
]);

Redis: Key-value cache

// Lightning-fast reads for hot data
SET session:user:1001 "{ \"name\": \"Alice\", \"role\": \"admin\" }"
EXPIRE session:user:1001 3600

// Rate limiting with atomic increment
INCR rate:api:user-1001
EXPIRE rate:api:user-1001 60

Final Verdict

🎯 Recommendation: Start with SQL (PostgreSQL) unless you have a specific reason not to. It handles 95% of applications with ACID guarantees and a mature ecosystem. Reach for NoSQL when you hit real scale problems, need flexible schemas for unstructured data, or require high write throughput. Most production systems use both — SQL for canonical data, NoSQL for caching and hot paths.

Format and validate JSON from your database queries with our free online JSON Formatter. It runs entirely in your browser — no server uploads, no data leaks.

Common Mistakes & How to Avoid Them

Choosing NoSQL for the wrong reason. "MongoDB is trendy" is not a requirement. If you need JOINs and transactions, SQL will save you months of pain.
Ignoring schema migrations in SQL. Every schema change is work. Plan migrations with tools like Prisma or Flyway from day one.
Assuming NoSQL means no constraints. Flexible schema still needs validation — enforce it in your application layer or schema validation features (MongoDB validation rules).
Storing everything in one database. Use the right tool for each job: PostgreSQL for canonical data, Redis for cache, Elasticsearch for search.
Ignoring the CAP tradeoff. If your NoSQL system promises strong consistency, you're paying for it elsewhere — usually in availability or latency. Know your tradeoff.

Frequently Asked Questions

Is NoSQL faster than SQL?

Not inherently. NoSQL is often faster for simple lookups and high write throughput because it avoids JOINs and scales horizontally. But SQL with proper indexes is extremely fast too. The speed difference comes from workload design, not the database category.

Can I use SQL and NoSQL together?

Yes, this is a polyglot persistence pattern. Use SQL for canonical data with ACID guarantees, Redis for caching, and Elasticsearch for full-text search. Many production systems combine multiple databases per concern.

Is MongoDB better than PostgreSQL?

Neither is universally better. PostgreSQL wins for relational data, complex queries, and transactions. MongoDB wins for flexible schemas and horizontal scaling. Modern PostgreSQL even supports JSONB, closing much of the gap.

When should I switch from SQL to NoSQL?

Only switch when you hit concrete problems SQL can't solve: horizontal write scaling beyond a single node, unstructured data with rapidly evolving shapes, or very high throughput requirements. "We might need it someday" is not a good reason.

What is the best database for a new startup?

PostgreSQL. It's free, battle-tested, handles JSON (JSONB) for flexibility, scales to millions of rows, and won't become a bottleneck as you grow. Add Redis for caching and NoSQL only when your workload demands it.

JSON vs YAML: Which Data Format Should You Use?

kingfujing — Tue, 25 Aug 2026 11:38:36 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

JSON and YAML are the two most popular data formats for developers. JSON powers almost every web API, while YAML is the default for Docker Compose, Kubernetes, GitHub Actions, and Ansible. But they solve overlapping problems in different ways — and choosing wrong can make your config files painful to maintain.

In this guide, we'll compare JSON and YAML across readability, nesting, comments, anchors, and parse speed — so you can pick the right format for your next config file or API.

💡 Quick Try: Need to format or validate JSON? Use our free JSON Formatter right in your browser.

What is JSON?

JSON (JavaScript Object Notation) is a text-based data format that mirrors JavaScript object syntax. It uses curly braces, brackets, and key-value pairs, and it's the de-facto standard for web APIs — every language has a built-in JSON parser.

{
  "name": "DevToolsHub",
  "tools": ["json", "base64", "regex"],
  "free": true,
  "rating": 4.8
}

Pros: Universal parser support. Strict syntax with no ambiguity. Great for data interchange between systems.

Cons: Verbose (brackets everywhere). No comments in the official spec. Hard to hand-write for complex nested configs.

What is YAML?

YAML (YAML Ain't Markup Language) is a human-friendly data format that uses indentation instead of brackets. It's designed to be readable by humans at a glance, which makes it the default for configuration files across Docker, Kubernetes, and CI/CD pipelines.

# Server config
tools:
  - json
  - base64
  - regex
free: true
rating: 4.8

Pros: Clean, readable syntax with minimal noise. Supports comments. Has anchors (&) for reusing values. Native multi-line strings.

Cons: Indentation-sensitive — a space can break your config. No universal parser (Python, Ruby, JS vary). Type coercion surprises (e.g., yes becoming a boolean).

Head-to-Head Comparison

Feature	JSON	YAML
Readability	⚠️ Verbose brackets	✅ Clean indentation
Comments	❌ Not in spec	✅ Native support
Parse Speed	✅ Fast (native parsers)	❌ 3-10x slower
Parser Support	✅ Universal (built-in)	⚠️ Library needed
Reuse / Anchors	❌ None	✅ Anchors & aliases
Multi-line Strings	⚠️ Escaping hell	✅ Native (\|, >)
Type Safety	✅ Strict types	⚠️ Type coercion traps

Parse Speed: The Real Story

JSON parsers are natively built into every language and optimized at the C/Rust level — JSON.parse() handles millions of operations per second. YAML parsers are separate libraries and typically run 3-10x slower, because the spec is far more complex (anchors, tags, multi-document, type resolution).

For config files loaded once at startup, this difference is irrelevant. For high-frequency data interchange (APIs, event streams, message queues), JSON's speed advantage is decisive.

When to Use Each

Use JSON when:

You're building a web API or exchanging data between services
Performance matters — high-frequency parse/serialize cycles
You need universal compatibility across languages and tools
Your data has strict types (numbers vs strings must be unambiguous)

Use YAML when:

You're writing configuration files humans will edit (CI/CD, Docker, K8s)
You need comments to document config options
Your config has lots of repeated values (anchors save duplication)
You're defining complex nested structures that JSON would be unreadable

Converting Between JSON and YAML

Python: JSON → YAML

import json
import yaml

data = {"name": "DevToolsHub", "free": True, "tools": ["json", "base64"]}

# JSON string
json_str = json.dumps(data, ensure_ascii=False)

# YAML string
yaml_str = yaml.dump(data, default_flow_style=False)
print(yaml_str)
# name: DevToolsHub
# free: true
# tools:
#   - json
#   - base64

JavaScript: JSON → YAML (js-yaml)

const yaml = require('js-yaml');

const json = {
  name: 'DevToolsHub',
  free: true,
  tools: ['json', 'base64', 'regex']
};

const yamlStr = yaml.dump(json);
console.log(yamlStr);
// name: DevToolsHub
// free: true
// tools:
//   - json
//   - base64
//   - regex

Node.js: CLI one-liner

# JSON file to YAML on the command line
npx js-yaml config.json > config.yaml

# YAML file to JSON
npx js-yaml --json config.yaml > config.json

Final Verdict

🎯 Recommendation: For data interchange (APIs, storage, messaging), use JSON — it's faster, universal, and unambiguous. For human-authored configuration files, use YAML — comments, anchors, and readable indentation make it far easier to maintain. The two aren't rivals; they're tools for different jobs.

Format, validate, and beautify your JSON instantly with our free online JSON Formatter. It runs entirely in your browser — no server uploads, no data leaks.

Common Mistakes & How to Avoid Them

Using YAML for API payloads. YAML's parsing ambiguity (type coercion, indentation) makes it a bad fit for cross-system data. Use JSON for anything that leaves your process.
Trusting YAML's implicit typing. yes, no, on, off become booleans in many parsers. Quote values when in doubt.
Mixing tabs and spaces in YAML. YAML forbids tabs for indentation. Configure your editor to use spaces and it'll never bite you.
Adding comments to JSON. Not part of the spec — tools will reject them. If you need comments in a config, that's a signal to use YAML.
Hand-writing JSON for big configs. Nested objects with 5+ levels of brackets are error-prone. Write it in YAML and convert, or generate JSON programmatically.

Frequently Asked Questions

Is YAML a superset of JSON?

Yes — JSON is valid YAML 1.2, so you can embed JSON directly in a YAML file. But not all YAML is valid JSON, and YAML's additional features (anchors, tags, multi-document) don't exist in JSON.

Why does Kubernetes use YAML instead of JSON?

Because manifests are human-authored configuration files. YAML's comments, anchors, and readability make long Kubernetes manifests far more maintainable. Internally, Kubernetes converts YAML to JSON before processing.

Which is faster, JSON or YAML parsing?

JSON parsing is typically 3-10x faster than YAML because JSON has native built-in parsers and a much simpler spec. For config files loaded once this doesn't matter; for high-frequency APIs it's decisive.

Can I add comments to JSON files?

Not in the official spec — standard JSON parsers reject comments. Some tools support JSONC (JSON with Comments) or JSON5, but for maximum compatibility you should use YAML if you need comments.

Should I use YAML for my application config?

If humans maintain the config and you need comments — yes, YAML is the better choice. If the config is machine-generated or must be validated strictly, JSON is safer and more portable.

JWT vs Session: Which Authentication Method Should You Use?

kingfujing — Tue, 25 Aug 2026 11:38:35 +0000

Originally published on DevToolsHub — free, privacy-first online tools for developers.

Every web developer eventually hits the same fork in the road: should I use JWT tokens or server-side sessions for authentication? It's one of the most debated topics in backend development — and the answer depends on your architecture, scale, and security requirements.

In this guide, we'll compare JWT and session-based auth across scalability, security, CSRF protection, and real-world use cases — so you can pick the right approach for your next project.

💡 Quick Try: Have a token you want to inspect? Use our free JWT Decoder to decode and verify tokens right in your browser.

What is JWT (JSON Web Token)?

JWT is a stateless authentication mechanism. When a user logs in, the server signs a JSON token containing claims (user ID, role, expiry) and hands it to the client. The client sends the token in the Authorization header on every request. The server just verifies the signature — it doesn't need to store anything about the session.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiIxMjM0NTYiLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE3MDAwMDAwMDB9.3Z8Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0Z0

Pros: Stateless and horizontally scalable. Works perfectly for mobile apps, SPAs, and microservices. No server-side lookup needed.

Cons: Hard to revoke before expiry. Token size adds to every request. Secret management is critical — a leaked signing key compromises everything.

What is Session-Based Authentication?

Sessions are stateful. The server stores session data (usually in memory, Redis, or a database) and hands the client a random opaque session ID — typically an HTTP-only cookie. On each request, the server looks up the session by ID.

// Session flow (simplified)
POST /login  →  { "sessionId": "a1b2c3d4..." } stored server-side
GET /profile  →  Cookie: sid=a1b2c3d4  →  server looks up session
// Logout  →  delete session → instantly invalid

Pros: Instant revocation (logout/ban works immediately). No sensitive data in the client. Smaller per-request payloads.

Cons: Stateful — horizontal scaling requires shared storage (Redis). Requires CSRF protection for cookies. Not ideal for cross-origin mobile APIs.

Head-to-Head Comparison

Feature	JWT	Session
State	✅ Stateless	❌ Stateful
Scalability	✅ Excellent (no shared store)	⚠️ Needs Redis/DB
Revocation	❌ Hard (until expiry)	✅ Instant (logout/ban)
CSRF Risk	✅ Low (header-based)	❌ High (cookies)
Payload Size	❌ Larger (token in each request)	✅ Tiny (just session ID)
Mobile / API	✅ Native fit	⚠️ Awkward (cookie handling)
Microservices	✅ Ideal	❌ Central store required

Security: The Real Story

The security comparison isn't as one-sided as it seems. JWT tokens live in localStorage are vulnerable to XSS — any injected script can read them. Sessions stored in HTTP-only cookies are immune to XSS but require CSRF protection.

XSS risk: JWT in localStorage → token theft. Session in HttpOnly cookie → safe.
CSRF risk: Session cookie → vulnerable (needs CSRF tokens). JWT in Authorization header → immune.
Token leakage: JWT appears in browser history/proxies if passed in URL — always use headers.

When to Use Each

Use JWT when:

You're building microservices or a distributed system
You need a stateless API for mobile apps or third-party clients
You want to avoid a shared session store (Redis) entirely
You need short-lived access tokens + refresh token flow

Use Session when:

You're building a traditional server-rendered web app
You need instant revocation (admin bans, account compromise)
You have a single server or already run Redis
You want the simplest secure default for a standard web app

Code Examples

Node.js / Express: JWT

const jwt = require('jsonwebtoken');

// Sign a token at login
const token = jwt.sign({ userId: 123, role: 'admin' }, process.env.JWT_SECRET, {
  expiresIn: '15m'
});

// Verify on every request (middleware)
function auth(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch (e) {
    res.status(401).json({ error: 'Invalid token' });
  }
}

Node.js / Express: Session with Redis

const session = require('express-session');
const RedisStore = require('connect-redis')(session);
const redis = require('redis').createClient();

app.use(session({
  store: new RedisStore({ client: redis }),
  secret: process.env.SESSION_SECRET,
  cookie: { httpOnly: true, sameSite: 'strict', maxAge: 24*60*60*1000 },
  resave: false,
  saveUninitialized: false
}));

// Logout = instant revocation
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.clearCookie('connect.sid');
  res.json({ ok: true });
});

Python / FastAPI: JWT

import jwt
from fastapi import Depends, HTTPException
from fastapi.security import HTTPBearer

security = HTTPBearer()

def verify_token(creds=Depends(security)):
    try:
        payload = jwt.decode(creds.credentials, SECRET, algorithms=["HS256"])
        return payload
    except jwt.PyJWTError:
        raise HTTPException(status_code=401, detail="Invalid token")

Final Verdict

🎯 Recommendation: For API-first applications, mobile backends, and microservices, start with JWT — the stateless design scales without a shared store. For traditional server-rendered web apps where you need instant revocation and the simplest secure default, stick with sessions. Many production systems use both: sessions for the web frontend, JWTs for the API.

Inspect and debug your tokens instantly with our free online JWT Decoder. It runs entirely in your browser — no server uploads, no data leaks.

Common Mistakes & How to Avoid Them

Storing JWTs in localStorage. XSS can steal them. Prefer short-lived tokens in memory or HTTP-only cookies (with CSRF protection).
Using a weak JWT secret. A brute-forceable secret means forged tokens. Use crypto.randomBytes(32).toString('hex').
No token expiry. Long-lived tokens that never expire are a security liability. Use 10-15 minute access tokens with a refresh token flow.
Not handling revocation. If you need to ban users instantly, sessions are simpler. For JWT, add a token blacklist or short expiry.
Ignoring CSRF with session cookies. Always add CSRF tokens or use SameSite=Strict cookies.

Frequently Asked Questions

Is JWT more secure than sessions?

Neither is inherently more secure — they have different threat models. JWT is vulnerable to XSS when stored in localStorage; sessions are vulnerable to CSRF when using cookies. Both are secure when implemented correctly.

Can I revoke a JWT token before it expires?

Not directly — JWTs are stateless by design. You can implement a token blacklist (Redis set of revoked jti values), use very short expiry with refresh tokens, or switch to sessions if instant revocation is a hard requirement.

Is JWT stateless really faster than sessions?

JWT skips the server-side lookup, but signature verification (HMAC or RSA) costs CPU. Sessions with Redis are often faster in practice for high-traffic apps because lookups are O(1) and tokens stay small.

Can I use JWT with cookies instead of localStorage?

Yes — storing the JWT in an HTTP-only cookie protects it from XSS. You still need CSRF protection, but this hybrid gives you stateless verification with cookie-grade XSS resistance.

Which is better for mobile apps, JWT or sessions?

JWT is the natural fit for mobile. Native apps handle the Authorization header cleanly, and you avoid cookie management entirely. Sessions work but require extra work for cookie storage and CSRF on mobile.