DEV Community: pulkitgovrani

How to Sign a PDF Without Printing It (And What Counts as a Valid Signature)

pulkitgovrani — Mon, 28 Sep 2026 16:30:00 +0000

Printing, signing, and scanning a form is a hassle you can skip. You can sign a PDF on screen in a minute. Whether that signature is enough depends on what the document is, so it helps to know the different kinds.

Three kinds of PDF signatures

Image (drawn or typed) signature: an image of your handwritten signature placed on the page. Quick and common for everyday forms, but it isn't cryptographically tied to you or to the document.
Electronic signature service: a platform that records who signed, when, and from where, and produces an audit trail.
Digital (cryptographic) signature: uses a certificate to sign the document's contents, so any later change invalidates it. Used where authenticity and integrity are critical.

How to add a drawn signature

Open the PDF in a signing tool that runs in your browser.
Draw your signature with a mouse, trackpad, or touchscreen.
Place it on the correct page and line, then resize it so it looks natural.
Download the signed copy and check the placement before sending.

Is it legally valid?

In many countries, electronic signatures are legally recognized for a wide range of agreements (for example under the ESIGN Act in the United States and eIDAS in the European Union). But rules vary, and some documents, such as certain property, court, or government forms, require stricter signatures, witnesses, or notarization. If the stakes are high, check the requirements with the recipient or a professional. This isn't legal advice.

Protect your signature

Don't share a clean image of your signature publicly; it can be copied.
Sign a copy, not your only original file.
Add the date next to the signature if the form requires one.
Use a tool that processes the file on your device, so the signed document isn't uploaded anywhere.

For serious contracts

A pasted image proves little on its own. For contracts where disputes are plausible, use a signing service that records an audit trail, or a certificate-based digital signature.

Frequently asked questions

Can I sign a PDF for free?

Yes. Browser-based tools let you draw and place a signature at no cost, and many PDF readers include a built-in sign feature too.

Is a drawn signature on a PDF legally binding?

Often yes for ordinary agreements, since electronic signatures are widely recognized, but requirements differ by country and document type.

What is a digital signature versus an electronic signature?

An electronic signature is any electronic indication of agreement, such as a drawn image. A digital signature uses cryptography and a certificate to bind the signer to the exact document content.

Is it safe to upload a document to sign it online?

Only if you trust the service. A tool that works locally in your browser doesn't upload the document at all.

Try it: Sign PDF — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Split a PDF Into Separate Pages or Sections

pulkitgovrani — Mon, 28 Sep 2026 04:30:00 +0000

Sometimes you don't need a whole 200-page PDF; you need chapter three, or just the signature page. Splitting a PDF lets you break it into smaller files or pull out specific pages to share, print, or archive.

Ways to split a PDF

Every page: one output file per page, useful for scanned batches of separate documents.
By range: for example pages 1-5 and 6-12 as two files, good for chapters or sections.
Extract selected pages: keep only the pages you name, such as 2, 7, and 10-12.
Delete pages instead: remove the pages you don't want and keep the rest.

Step by step

Open the PDF in a splitting tool. A visual page picker helps when you don't know the page numbers.
Choose how to split: by range, by every page, or by selected pages.
Double-check the page numbers against what you see in the document; the number printed on a page can differ from its position in the file.
Download the results and open one to confirm it contains what you expected.

Things that trip people up

Printed vs file page numbers: a book with roman-numeral front matter puts printed page 1 at file page 9 or later. Splitting works on file positions.
Bookmarks and links: internal links may break when their target page ends up in a different file.
Encrypted PDFs: you generally need to unlock the file with its password first.
Fillable forms: form fields belong to the pages they sit on and may lose connections to calculations on other pages.

Sharing a section privately

When you send one page from a larger document, make sure other pages (which may contain sensitive data) are not included. Open the extracted file and scroll through it before you share it.

Splitting locally

Documents you split are often exactly the ones you shouldn't upload: contracts, statements, and IDs. A browser-based splitter processes the file on your own device, so it never leaves your computer.

Frequently asked questions

How do I extract a single page from a PDF?

Use a split or extract tool and specify just that page number. The tool creates a new PDF containing only that page.

Will splitting change the quality of my pages?

No. The pages are copied as they are, so text and images keep their quality.

Can I split a password-protected PDF?

You usually need to remove the password first, using the password itself, and then split the file.

What is the difference between splitting and extracting pages?

Splitting divides a document into several files. Extracting pulls selected pages into one new file. Many tools offer both.

Try it: Split PDF — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Compress a PDF Without Losing Quality

pulkitgovrani — Sun, 27 Sep 2026 16:30:00 +0000

A PDF that is too big to email is one of life's small annoyances. The good news is that most oversized PDFs are large for a few predictable reasons, and you can usually cut the size dramatically without visible damage.

Why PDFs get big

Images: photos and scans dominate the file size. A 300 dpi color scan of an A4 page can be several megabytes.
Embedded fonts: each font family adds size, especially large ones with many glyphs.
Uncompressed or duplicated content: some exporters store the same image or resource repeatedly.
Metadata and edit history: incremental saves can leave old versions of objects inside the file.

What compression actually does

Compression tools typically combine several techniques: downsampling images to a lower resolution, re-encoding them at a lower JPEG quality, removing unused objects and metadata, and rewriting the file structure more efficiently. Downsampling and recompressing are lossy, so they trade a little detail for a much smaller file. Cleaning up structure is lossless.

Choosing a target

Email or web viewing: images around 96 to 150 dpi are usually fine on screen.
Standard printing: aim for about 300 dpi, which is where most photos look sharp on paper.
Text-only documents: they are rarely large; if one is, look for embedded images or fonts.
Scanned documents: run OCR-aware or black-and-white scanning at 200 to 300 dpi, since color scans of text are wasteful.

Make a copy of the original so you can go back if the result looks too soft.
Compress, then zoom in on a page with small text or a photo to check legibility.
If it is still too large, compress more or split the document into parts.
Compress once only; repeated compression stacks up quality loss.

Keep the original

Lossy compression can't be undone. Always keep the uncompressed original, especially for contracts, drawings, or anything you may need to print at full quality later.

Ways to shrink a PDF before you export it

Resize photos before placing them in the document instead of after.
Export from your design or word-processing tool with a 'web' or 'minimum size' preset.
Avoid embedding many font weights you don't use.
Scan in grayscale or black and white when color isn't needed.

Frequently asked questions

Why is my PDF so large?

Usually because of high-resolution images or scans. Embedded fonts and leftover edit data can add to it.

Does compressing a PDF reduce quality?

Image downsampling and recompression are lossy, so quality drops a little. Structural cleanup is lossless. Check the result before sending.

What is a good size for an emailed PDF?

Many email providers cap attachments around 20 to 25 MB, but staying under a few megabytes is friendlier to recipients.

Can I compress a PDF without uploading it?

Yes, with a browser-based compressor that processes the file locally, which keeps sensitive documents private.

Try it: Compress PDF — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Merge PDF Files Without Uploading Them Anywhere

pulkitgovrani — Sun, 27 Sep 2026 04:30:00 +0000

Merging PDFs is one of the most common document chores: stitching a cover letter to a resume, combining scanned pages into a single file, or bundling invoices for an accountant. Most free merge sites work by uploading your files to a server. For everyday documents that may be fine, but for contracts, IDs, and medical or financial records it is an unnecessary risk.

Why merge locally

Your files never leave your device, so there is nothing to intercept, store, or leak.
No file-size upload limits imposed by a server, and no waiting on a slow connection.
It works even with a weak or metered connection once the page has loaded.

How to merge PDFs, step by step

Open a browser-based PDF merger and add your files (drag and drop works in most tools).
Put the files in the order you want them to appear; the first file's pages come first.
Check page counts so you know what to expect in the result.
Merge, then download the combined file and open it to confirm the page order and orientation.

What to expect in the merged file

Bookmarks and outlines: depending on the tool, the original bookmarks may be dropped. If you rely on a table of contents, check the result.
Form fields: merging documents that contain forms with the same field names can cause them to share values. Flatten forms first if that matters.
Page sizes: pages keep their own dimensions, so mixing A4 and Letter gives a document with both.
File size: the result is roughly the sum of the inputs, so you may want to compress it afterwards.
Password-protected files: remove the password (with the password in hand) before merging.

Tip: name the output clearly

Use a descriptive filename with a date, such as 2026-09-application-bundle.pdf. Merged files tend to get sent to other people, and a clear name avoids mix-ups.

Common problems and fixes

Pages appear rotated: rotate the source pages before merging, or fix them after with a rotate tool.
The file is huge: scanned pages are large images. Compress the result, or rescan at a lower resolution.
Order is wrong: reorder the input list, or reorder pages in the merged output.

Frequently asked questions

Is it safe to merge PDFs online?

It depends on the tool. Sites that upload your files to a server can store or expose them. A tool that processes files in your browser never sends them anywhere, which is the safer choice for sensitive documents.

Does merging PDFs reduce quality?

No. Merging copies the pages into a new file without re-rendering them, so text and images keep their original quality.

Can I merge PDFs and images together?

Convert the images to PDF first (or use an images-to-PDF tool), then merge the resulting PDFs.

How many PDFs can I merge at once?

There is usually no fixed limit in a browser tool; the practical limit is your device's memory, so very large files may be slow.

Try it: Merge PDFs — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Decode a JWT Safely (Without Sending It to a Server)

pulkitgovrani — Sat, 26 Sep 2026 07:16:58 +0000

A JSON Web Token (JWT) looks like an opaque blob, but it is just three Base64URL-encoded pieces joined by dots. Anyone who holds the token can read what's inside; no secret key is needed. That is by design: JWTs are meant to be signed, not hidden. It is also exactly why you should care where you decode one.

The three parts of a JWT

header    eyJhbGciOiJIUzI1NiJ9
payload   eyJzdWIiOiIxMjMiLCJleHAiOjE3MDAwMDAwMDB9
signature <binary signature, Base64URL-encoded>

Joined with dots:  header.payload.signature

Decoding the first two segments (Base64URL, then JSON) gives you this:

// header
{ "alg": "HS256" }

// payload
{ "sub": "123", "exp": 1700000000 }

Header: metadata about the token, mainly the signing algorithm (alg) and sometimes the token type (typ) or a key ID (kid).
Payload: the claims. Registered claims include iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), and iat (issued at). Apps add their own, like roles or a user ID.
Signature: a cryptographic signature over the header and payload. It proves the token wasn't altered and was issued by someone holding the key.

How to decode one by hand

Split the token on the two dots to get three segments.
Take the first segment, swap - for + and _ for /, add = padding until the length is a multiple of 4, and Base64-decode it.
Parse the result as JSON. That is your header.
Repeat for the second segment to read the payload.
Leave the signature alone; it is binary data, not JSON.

In a browser console that is one line: JSON.parse(atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'))). Note that atob can mangle non-ASCII characters, which is one reason a purpose-built decoder is less error-prone.

Decoding is not verifying

The most common JWT mistake

A token that decodes into a perfectly sensible payload has not been checked at all. Anyone can craft a token with any claims they like; only signature verification tells you whether to trust it.

Verification happens on your server with the right key. It should also check that exp is in the future, that iss and aud match what you expect, and that the alg is one you allow. Never trust the alg header blindly: rejecting the none algorithm and pinning the expected algorithm closes a well-known class of attacks.

Why you shouldn't paste live tokens into random sites

An access token is a credential. Until it expires, whoever holds it can usually act as that user. Many online decoders send whatever you paste to their backend, or load third-party scripts that could log it. Even if the site is honest, you have copied a secret into a place you don't control.

Prefer a decoder that runs entirely in your browser.
Open your browser's Network tab while you decode; nothing should be sent.
Use tokens from a test environment whenever possible.
If you have pasted a production token somewhere you don't trust, revoke or rotate it.

A quick JWT debugging checklist

Getting 401 errors? Compare exp with the current time; expired tokens are the number one cause. Remember exp is in seconds, not milliseconds.
Token rejected as "not yet valid"? Check nbf and iat against clock skew between servers.
Wrong audience or issuer? Read aud and iss in the payload and compare them with your server's configuration.
Unexpected permissions? Look at role, scope, or permission claims; they may differ from what you assumed.
Never store secrets, passwords, or personal data in the payload; it is readable by everyone who sees the token.

Frequently asked questions

Can anyone read the contents of a JWT?

Yes. A standard signed JWT (JWS) is only encoded, not encrypted, so anyone with the token can decode the header and payload. Only the signature protects integrity. If you need the contents hidden, use an encrypted JWT (JWE) or keep sensitive data out of the token.

Is it safe to decode a JWT online?

Only if the decoder runs entirely in your browser and you can confirm nothing is uploaded. Treat any production token you paste into an untrusted site as exposed and rotate it.

What is the difference between decoding and verifying a JWT?

Decoding reads the header and payload. Verifying checks the signature with the correct key and validates claims like exp, iss, and aud. Only verification proves the token is genuine.

Why does my JWT say it is expired?

The exp claim is a Unix timestamp in seconds. If the current time is past that value, the token has expired. Check server clock drift if it expires too early.

Try it: JWT Decoder — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

What a Cron Expression Actually Means (With Examples)

pulkitgovrani — Sat, 26 Sep 2026 07:16:46 +0000

Cron is the classic Unix job scheduler, and its schedule syntax has spread far beyond it: CI pipelines, cloud schedulers, and job queues all accept cron expressions. The syntax is compact, which makes it easy to get subtly wrong. Here is how to read and write it with confidence.

The five fields

A standard cron expression has five space-separated fields. Read left to right, they say when a job should run:

minute   hour   day-of-month   month   day-of-week
0-59     0-23   1-31           1-12    0-6 (Sunday = 0)
*        *      *              *       *

A job runs when the current time matches every field. A * means "every possible value" for that field.

The special characters

* matches every value in the field.
, separates a list: 1,15 means the 1st and the 15th.
- defines a range: 1-5 means 1 through 5 (Monday to Friday in the day-of-week field).
/ defines a step: */15 means every 15 units, and 10-40/10 means 10, 20, 30, 40.

Common schedules

*/5 * * * * runs every 5 minutes.
0 * * * * runs at the top of every hour.
0 9 * * 1-5 runs at 09:00 on weekdays.
30 2 * * 0 runs at 02:30 every Sunday.
0 0 1 * * runs at midnight on the first of every month.
0 0 1 1 * runs once a year, at midnight on 1 January.
15 14 1 * * runs at 14:15 on the 1st of each month.

The gotchas that cause missed jobs

Time zones

Cron runs in the time zone of the machine or service, which is very often UTC. A job you wrote as "9 AM" may fire at 9 AM UTC, not in your local time. Cloud schedulers usually let you set a time zone explicitly; check before you assume.

Day of month plus day of week

In classic Vixie cron, if you restrict both the day-of-month and the day-of-week fields, the job runs when either one matches, not both. 0 0 13 * 5 fires on every 13th and on every Friday, not only on Friday the 13th. Other schedulers may behave differently, so read their docs.

Dialect differences

Some systems (Quartz, Spring, AWS EventBridge) add a seconds or year field, so expressions have six or seven fields.
Some support names such as MON or JAN and shortcuts like @daily or @hourly; others do not.
Characters like L, W, and # (last day, nearest weekday, nth weekday) exist in some dialects only.

Daylight saving time

In a local time zone that observes daylight saving, a job scheduled during the skipped hour may not run, and one in the repeated hour may run twice. Scheduling in UTC avoids the problem entirely.

Sanity-check before you deploy

Paste the expression into a parser and read the plain-English translation. If it doesn't say what you meant, fix it before it silently runs at the wrong time in production.

Frequently asked questions

What does /5 * * * mean in cron?

It means run every 5 minutes: the */5 in the minute field is a step of 5, and the other fields are wildcards.

How do I run a cron job every day at midnight?

Use 0 0 * * *. That is minute 0, hour 0, every day of the month, every month, every day of the week.

Does cron use UTC or local time?

It uses the time zone of the machine or scheduling service running it. Many servers and cloud schedulers default to UTC, so confirm and set the time zone explicitly when it matters.

What is the difference between 5-field and 6-field cron?

Standard Unix cron has five fields (minute to day of week). Some schedulers add a leading seconds field, or a trailing year field, so always check which format your tool expects.

Try it: Cron Expression Parser — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Why You Should Remove EXIF Data Before Sharing Photos

pulkitgovrani — Sat, 26 Sep 2026 07:16:34 +0000

Every photo from a phone or camera carries a block of hidden information called EXIF (Exchangeable Image File Format) metadata. It is useful for photographers and for organizing libraries, but it can reveal far more than you intend when you share an image publicly or send it to a stranger.

What EXIF data can contain

Device details: camera or phone make and model, lens, and sometimes the serial number.
Capture settings: exposure, aperture, ISO, focal length, and flash.
Date and time: when the photo was taken, often to the second.
Location: GPS latitude and longitude, altitude, and sometimes direction, if location tagging was on.
Software: the app that edited or exported the file.
Orientation and a small embedded thumbnail, which can occasionally still show the original image after cropping.

Why it matters

A photo taken at home and posted publicly can carry the coordinates of that home. A picture of an item for sale can show where you live, and a series of timestamps can reveal your routine. Journalists, activists, and anyone with a stalker have very real reasons to be careful, but so does everyone else.

Do social networks remove it?

Many large platforms strip location metadata from images when they're uploaded, but not all do, and policies change. Email attachments, direct file transfers, forums, classified-ad sites, cloud share links, and personal websites often keep the original file untouched. Don't assume; check, or remove it yourself before sharing.

How to check and remove EXIF data

Open the photo in a metadata viewer to see exactly what it contains, including any GPS fields.
Remove the metadata and export a clean copy. The pixels stay the same; only the hidden fields are dropped.
Open the cleaned file in the viewer again to confirm the location and device fields are gone.
Share the cleaned copy and keep the original for your own library.

Do it locally

Uploading a personal photo to a website just to strip its metadata defeats the purpose. Use a tool that works entirely in your browser, so the image never leaves your device.

Other ways to avoid leaking location

Turn off location tagging for the camera app in your phone's settings.
Take a screenshot of the photo. It usually has no GPS data, though it may lose quality.
On iOS and Android, the share sheet often has an option to exclude location when sending a photo.
Remember that the image itself can leak information: street signs, house numbers, reflections, and landmarks.

Frequently asked questions

What is EXIF data in a photo?

EXIF is metadata embedded in image files by cameras and phones. It records details like device model, capture settings, date and time, and often GPS location.

Does removing EXIF data reduce image quality?

No. Stripping metadata leaves the pixel data unchanged; only the hidden fields are removed.

Do screenshots contain EXIF data?

Screenshots generally don't include GPS location, though they may include basic details like the device or software. Check with a metadata viewer if it matters.

Can I remove EXIF data without uploading my photo?

Yes. A browser-based tool processes the file locally on your device, so the image is never sent to a server.

Try it: EXIF Viewer & Remover — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

JSON vs YAML: When to Use Which

pulkitgovrani — Sat, 26 Sep 2026 07:16:24 +0000

JSON and YAML can describe the same data, so the choice comes down to who (or what) reads and writes the file. JSON is strict, small, and easy for software to parse. YAML is looser and friendlier for humans to edit. Picking the right one prevents a surprising number of config bugs.

The same data, two ways

// JSON
{
  "name": "api",
  "ports": [80, 443],
  "debug": false,
  "env": { "NODE_ENV": "production" }
}

# YAML
name: api
ports:
  - 80
  - 443
debug: false
env:
  NODE_ENV: production

Where JSON is the better choice

APIs and data exchange. Every language has a fast, built-in JSON parser and the grammar is tiny.
Strictness. There is one way to write each value, so there is little room for ambiguity.
Machine-generated files, such as lock files and API responses, that people rarely edit by hand.
Anywhere parser differences would be risky.

Where YAML is the better choice

Configuration that humans maintain: Kubernetes manifests, GitHub Actions, Docker Compose, Ansible.
Comments. YAML supports # comments, which are invaluable in config; standard JSON has none.
Readability of deeply nested data, since there are no braces, brackets, or trailing-comma errors.
Multi-line strings, which YAML handles cleanly with | and > block scalars.

YAML pitfalls to know about

Indentation is syntax

Structure comes from indentation, and tabs are not allowed for indentation. One misaligned line silently changes the meaning of the document, or breaks it.

Unquoted values get guessed

In YAML 1.1 (still used by many parsers) unquoted yes, no, on, and off can be read as booleans. This is the famous "Norway problem": the country code NO becomes false. Version numbers like 1.10 can become the number 1.1. Quote any value that must stay a string.

A big spec, so parsers vary

YAML has anchors, aliases, tags, and multiple document forms. Different parsers support different subsets, so the same file can behave differently across tools. Loading untrusted YAML with a full-featured loader can also be a security risk; use a safe loader.

A simple rule of thumb

Use JSON when software talks to software

Use YAML when humans maintain the file. If a config file needs comments or is edited often by people, prefer YAML; if it's an API payload or generated data, prefer JSON.

Converting between them safely

Converting JSON to YAML is lossless, but going the other way can drop comments and anchors. Re-validate the result after any conversion. Config files often contain hostnames and secrets, so convert them with a tool that runs locally in your browser.

Frequently asked questions

Is YAML a superset of JSON?

Since YAML 1.2, valid JSON is intended to be valid YAML, so most JSON documents parse as YAML. The reverse is not true.

Why doesn't JSON support comments?

The format was kept deliberately minimal. If you need comments, use JSONC, JSON5, or YAML, or keep documentation outside the file.

Which is faster to parse, JSON or YAML?

JSON is generally much faster and simpler to parse, which is one reason it dominates APIs.

Should I use YAML for API responses?

Almost never. JSON is the standard for APIs because of its strictness, speed, and universal support.

Try it: JSON to YAML Converter — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Fix "Unexpected Token" and Other Invalid JSON Errors

pulkitgovrani — Sat, 26 Sep 2026 07:16:10 +0000

Errors such as "Unexpected token } in JSON at position 42" or "Expected property name or '}'" almost always come from a small syntax slip. JSON is stricter than JavaScript object syntax, and it is easy to write something that looks fine but is not valid. These are the mistakes behind the vast majority of parse errors.

1. Trailing commas

JSON does not allow a comma after the last item in an object or array. This is the single most common error, especially after deleting a line from the end of a list.

{ "a": 1, "b": 2, }    // invalid
{ "a": 1, "b": 2 }     // valid

[1, 2, 3, ]              // invalid
[1, 2, 3]                // valid

2. Single quotes

Strings and keys must use double quotes. { 'name': 'Ada' } is valid JavaScript but invalid JSON. Replace every single quote used as a delimiter with a double quote, and escape any double quote inside a string as \".

3. Unquoted keys

In JavaScript you can write { name: "Ada" }. In JSON every key must be a double-quoted string: { "name": "Ada" }.

4. Comments

Standard JSON has no comments. Neither // nor /* */ is allowed. If you need comments, use a superset such as JSONC (used by editors like VS Code) or a format like YAML, or strip the comments before parsing.

5. Values JSON does not support

undefined, NaN, and Infinity are not valid JSON values. Use null or a string instead.
Numbers cannot have leading zeros (007) or a leading plus sign, and hex like 0xFF is not allowed.
Strings cannot contain raw newlines or tabs; escape them as \n and \t.
Dates have no native type; store them as ISO 8601 strings.

6. Invisible and structural problems

A byte-order mark (BOM) at the start of a file can trigger "unexpected token" at position 0.
Two objects back to back ({...}{...}) instead of a single object or an array.
A truncated response: the payload was cut off, so a closing brace or bracket is missing.
The response is actually HTML (an error page or a login redirect) rather than JSON, which shows up as "Unexpected token <".

How to find the problem fast

Copy the exact text that is being parsed, not what you think it contains.
Paste it into a validator; it should point to the line and column of the first error.
Look at the character just before the reported position. The real mistake is usually right there, such as a missing comma or an extra one.
Fix one error at a time and re-validate; later errors are often hidden behind the first.
If the error is at position 0 and you see "<", log the raw response body and check the HTTP status.

Keep real data private

API responses often contain tokens, emails, and other personal data. Validate them with a tool that runs in your browser, so the payload isn't uploaded to someone else's server.

Frequently asked questions

Why does JSON.parse say "Unexpected token < in JSON at position 0"?

The text starts with a "<", which almost always means you received an HTML page (a 404, 500, or login page) instead of JSON. Check the HTTP status and log the raw response.

Can JSON have comments or trailing commas?

Not in standard JSON. Comments and trailing commas are allowed in supersets such as JSONC or JSON5, but a strict parser will reject them.

Are single quotes valid in JSON?

No. Keys and string values must use double quotes.

How do I validate JSON without uploading it?

Use a validator that runs client-side in your browser and confirm in the Network tab that no request is made when you paste your data.

Try it: JSON Formatter & Validator — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Regex Cheatsheet for Beginners (With Copy-Paste Examples)

pulkitgovrani — Sat, 26 Sep 2026 07:15:55 +0000

Regular expressions look cryptic at first, but a small set of building blocks covers most real-world tasks: validating input, searching logs, and doing bulk find-and-replace. Learn these pieces and you can read and write most patterns you'll meet.

The basic building blocks

. matches any single character except a newline.
\d matches a digit, \w a word character (letters, digits, underscore), and \s whitespace. The capitals \D, \W, and \S mean the opposite.
[abc] matches any one of a, b, or c. [a-z] is a range, and [^abc] matches anything except those.
^ and $ match the start and end of the string (or of each line with the m flag).
\b matches a word boundary, which is handy for whole-word matches.
Use a backslash to match a special character literally: \. matches a period, \( a parenthesis.

Quantifiers: how many times

* means zero or more, + means one or more, and ? means zero or one.
{3} means exactly 3, {2,5} means between 2 and 5, and {2,} means 2 or more.
Quantifiers are greedy by default and grab as much as they can. Add a ? after one (like .*?) to make it lazy so it matches as little as possible.

<.+>     // greedy: on "<b>hi</b>" matches the whole string
<.+?>    // lazy:   matches "<b>" first

Groups, alternation, and backreferences

(cat|dog)s?                      // cat, cats, dog, dogs
(\d{4})-(\d{2})-(\d{2})         // capture year, month, day
(?<year>\d{4})-(?<month>\d{2})   // named groups
(?:abc)+                         // group without capturing
(\w)\1                           // a repeated character, like "ll" in "hello"

Lookaheads and lookbehinds

Lookarounds check what surrounds a position without including it in the match.

\d+(?= dollars)      // digits followed by " dollars"
\d+(?! dollars)      // digits NOT followed by " dollars"
(?<=\$)\d+           // digits preceded by "$"
(?<!\$)\b\d+          // digits NOT preceded by "$"

Flags

g finds all matches instead of stopping at the first.
i makes the match case-insensitive.
m makes ^ and $ match at line boundaries.
s lets . match newlines as well.

Practical patterns you can reuse

ISO date (format only): ^\d{4}-\d{2}-\d{2}$
Hex color: ^#(?:[0-9a-fA-F]{3}){1,2}$
Simple email shape: ^[^\s@]+@[^\s@]+\.[^\s@]+$
Trim extra spaces: \s{2,} replaced with a single space
Slug: ^[a-z0-9]+(?:-[a-z0-9]+)*$

Regex checks shape, not truth

The email pattern above accepts anything that looks like an address. Confirming an address actually exists means sending a message to it. Likewise, the date pattern accepts 2026-13-45; validate the values in code.

Common mistakes

Forgetting to escape special characters like . and ?, which then match far more than intended.
Using greedy .* and swallowing more text than you meant to.
Nested quantifiers such as (a+)+ that can cause catastrophic backtracking on certain inputs and freeze your program.
Assuming every engine behaves the same; lookbehind and named-group syntax differ between JavaScript, Python, and PCRE.

The fastest way to learn is to test against sample text and watch each match and group light up. Build the pattern one piece at a time.

Frequently asked questions

What does \d+ mean in regex?

\d matches a single digit and + means one or more, so \d+ matches a run of one or more digits, like 2026.

What is the difference between greedy and lazy quantifiers?

A greedy quantifier (.*) matches as much as possible; a lazy one (.*?) matches as little as possible. Lazy is often what you want when matching between delimiters.

How do I match a literal dot or bracket?

Escape it with a backslash: \. matches a period and \[ matches an opening bracket.

Is regex the right tool to validate an email address?

A simple shape check is fine for a form, but regex cannot prove an address exists. Send a confirmation email for real verification.

Try it: Regex Tester — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Base64 Is Not Encryption (And Other Common Misconceptions)

pulkitgovrani — Sat, 26 Sep 2026 07:15:40 +0000

Base64 shows up everywhere: emails, data URLs, HTTP headers, JWTs. Because the output looks scrambled, it is often mistaken for encryption. It isn't. Base64 is an encoding: a reversible way to represent binary data as plain text, with no key and no secret.

How Base64 works

Base64 takes your data three bytes (24 bits) at a time and splits them into four groups of six bits. Each 6-bit value (0 to 63) maps to one character from an alphabet of 64: A-Z, a-z, 0-9, +, and /. If the input length isn't a multiple of three, the output is padded with = characters.

"hello"   →  aGVsbG8=
"hello!"  →  aGVsbG8h
"hi"      →  aGk=

Going the other way needs nothing but the same table, so anyone can decode it in seconds.

Never rely on Base64 to hide anything

If a password, API key, or token is only Base64-encoded, treat it as plain text. Anyone who sees it can read it.

What Base64 is genuinely for

Moving binary data through text-only channels, such as email attachments (MIME) and JSON fields.
Embedding small images or fonts directly in HTML or CSS as data: URLs.
The HTTP Basic authentication header, which Base64-encodes username:password. This offers no protection, so it must only be used over HTTPS.
JWTs, which use the URL-safe variant for their three segments.

Details worth knowing

Size overhead: the output is about 33% larger than the input, because 3 bytes become 4 characters.
URL-safe Base64 replaces + and / with - and _ and often drops the = padding, so the result can sit safely in URLs and filenames.
Text encoding matters: convert text to bytes (usually UTF-8) before encoding, or non-ASCII characters will break. Browser atob and btoa only handle Latin-1 directly.
Base64 is not compression; it always makes data bigger.

Encoding vs hashing vs encryption

Encoding (Base64, URL encoding) changes the representation. It is reversible by anyone and provides no secrecy.
Hashing (SHA-256, bcrypt) is one-way. You can't get the original back, only check whether an input matches.
Encryption (AES-GCM, ChaCha20) is reversible only with the right key. This is what provides confidentiality.

If you need secrecy

Use authenticated encryption such as AES-GCM with a properly generated key, or a well-reviewed library that does it for you. Store passwords with a slow, salted hash such as bcrypt or Argon2. Never invent your own scheme, and never treat Base64 as a security layer.

Frequently asked questions

Is Base64 encryption?

No. Base64 is a reversible encoding with no key, so anyone can decode it. It provides no confidentiality.

Why does Base64 make data larger?

Every 3 bytes of input become 4 characters of output, so the encoded data is roughly 33% bigger.

What does the = at the end of Base64 mean?

It is padding, added when the input length isn't a multiple of three bytes. URL-safe variants often omit it.

What is URL-safe Base64?

A variant that replaces + and / with - and _ so the output can be used safely in URLs, filenames, and JWTs.

Try it: Base64 & URL Encoder — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How Strong Should a Password Be? Length vs. Complexity

pulkitgovrani — Sat, 26 Sep 2026 07:15:27 +0000

Password strength is really a question of how many guesses an attacker would need. Every extra character multiplies that number, which is why length matters far more than swapping an a for an @. Understanding this lets you stop memorizing rules and start choosing passwords that hold up.

Entropy: the number behind strength

Entropy measures unpredictability in bits; each extra bit doubles the number of guesses needed. For a password picked uniformly at random from a set of characters, entropy is length multiplied by log2 of the set size. A random character from the roughly 94 printable ASCII characters adds about 6.5 bits.

8 random characters is about 52 bits.
12 random characters is about 79 bits.
16 random characters is about 105 bits.
20 random characters is about 131 bits.

These figures only apply to genuinely random passwords. Human-chosen ones are far weaker than their length suggests.

Why clever tricks don't help much

Attackers don't try every combination in order. They start with leaked-password lists, common words, keyboard patterns, names, dates, and predictable substitutions (P@ssw0rd!). A password like Summer2026! looks complex, but it follows a pattern crackers try early, so its real strength is low.

Passphrases: long and memorable

A passphrase made of several random, unrelated words is easier to remember and can be very strong. The catch is that the words must be chosen randomly (for example with dice or a generator), not picked because they feel meaningful. Each word from a 7,776-word list adds about 12.9 bits, so five words is roughly 65 bits and six is roughly 78 bits.

A simple set of rules that works

Use a password manager and let it generate a unique random password of 16+ characters for every account.
For the few passwords you must remember (the manager itself, your device), use a random passphrase of five or six words.
Never reuse passwords. Reuse is how one breach turns into ten.
Turn on two-factor authentication wherever it's offered, preferably with an authenticator app or a hardware key.
Change a password when you have a reason to (a breach, sharing, suspicion), not on a fixed schedule.

What about length limits and special characters?

Modern guidance (such as NIST's) favors length over composition rules and discourages forced periodic changes. Sites that cap passwords at short lengths or forbid certain characters are working against you; a password manager helps you work around them.

Check strength privately

Don't paste real passwords into a checker that sends them to a server. Use one that runs entirely in your browser, and assume any password you've pasted into an untrusted site is compromised.

Frequently asked questions

How long should a password be in 2026?

For accounts protected by a manager, 16 or more random characters. For a memorized passphrase, five or six random words.

Are passphrases more secure than passwords?

A random passphrase of enough words can be as strong as a random character password while being much easier to remember and type.

Do special characters make a password stronger?

A bit, but length adds much more. A longer password beats a short one with symbols, especially if the symbols follow predictable patterns.

Should I change my passwords regularly?

Not on a fixed schedule. Change them after a breach or suspicious activity, and use unique passwords with two-factor authentication instead.

Try it: Password Strength Checker — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

DEV Community: pulkitgovrani

How to Sign a PDF Without Printing It (And What Counts as a Valid Signature)

Three kinds of PDF signatures

How to add a drawn signature

Is it legally valid?

Protect your signature

Frequently asked questions

Can I sign a PDF for free?

Is a drawn signature on a PDF legally binding?

What is a digital signature versus an electronic signature?

Is it safe to upload a document to sign it online?

How to Split a PDF Into Separate Pages or Sections

Ways to split a PDF

Step by step

Things that trip people up

Splitting locally

Frequently asked questions

How do I extract a single page from a PDF?

Will splitting change the quality of my pages?

Can I split a password-protected PDF?

What is the difference between splitting and extracting pages?

How to Compress a PDF Without Losing Quality

Why PDFs get big

What compression actually does

Choosing a target

Ways to shrink a PDF before you export it

Frequently asked questions

Why is my PDF so large?

Does compressing a PDF reduce quality?

What is a good size for an emailed PDF?

Can I compress a PDF without uploading it?

How to Merge PDF Files Without Uploading Them Anywhere

Why merge locally

How to merge PDFs, step by step

What to expect in the merged file

Common problems and fixes

Frequently asked questions

Is it safe to merge PDFs online?

Does merging PDFs reduce quality?

Can I merge PDFs and images together?

How many PDFs can I merge at once?

How to Decode a JWT Safely (Without Sending It to a Server)

The three parts of a JWT

How to decode one by hand

Decoding is not verifying

Why you shouldn't paste live tokens into random sites

A quick JWT debugging checklist

Frequently asked questions

Can anyone read the contents of a JWT?

Is it safe to decode a JWT online?

What is the difference between decoding and verifying a JWT?

Why does my JWT say it is expired?

What a Cron Expression Actually Means (With Examples)

The five fields

The special characters

Common schedules

The gotchas that cause missed jobs

Time zones

Day of month plus day of week

Dialect differences

Daylight saving time

Frequently asked questions

What does */5 * * * * mean in cron?

How do I run a cron job every day at midnight?

Does cron use UTC or local time?

What is the difference between 5-field and 6-field cron?

Why You Should Remove EXIF Data Before Sharing Photos

What EXIF data can contain

Why it matters

Do social networks remove it?

How to check and remove EXIF data

Other ways to avoid leaking location

Frequently asked questions

What is EXIF data in a photo?

Does removing EXIF data reduce image quality?

Do screenshots contain EXIF data?

Can I remove EXIF data without uploading my photo?

JSON vs YAML: When to Use Which

The same data, two ways

Where JSON is the better choice

What does /5 * * * mean in cron?