DEV Community: pulkitgovrani

How to Generate a Secure API Key or Secret (Length, Encoding, and Storage)

pulkitgovrani — Thu, 15 Oct 2026 04:30:00 +0000

API keys, session tokens, and signing secrets are all just random values that must be impossible to guess. Generating them well is straightforward, but a few common shortcuts, such as using a weak random function, undermine everything.

How much randomness do you need?

Aim for at least 128 bits of entropy, and 256 bits (32 random bytes) is a comfortable default for long-lived secrets. That is far beyond what can be brute-forced.

16 bytes = 128 bits: 32 hex characters, or 22 base64url characters.
32 bytes = 256 bits: 64 hex characters, or 43 base64url characters.

Use a cryptographically secure generator

Never use Math.random() or similar for secrets

General-purpose random functions are predictable. Use the operating system's cryptographically secure source through your language's standard library.

// Node.js
require("crypto").randomBytes(32).toString("hex")

// Browser
const a = new Uint8Array(32); crypto.getRandomValues(a);

# Python
import secrets; secrets.token_urlsafe(32)

# Shell
openssl rand -hex 32

Encoding and format

Hex is simple and safe everywhere but longer.
Base64url packs more entropy per character and is safe in URLs and headers.
A readable prefix (like sk_live_ or ghp_) helps people and scanners recognize a key and tell environments apart. The prefix isn't part of the secret's strength.
Consider including a short key ID separate from the secret so you can look keys up without storing the secret itself.

Storing and handling keys

Show the full key to the user only once, at creation.
Store only a hash of the key on the server (a fast hash like SHA-256 is fine for high-entropy random keys, unlike passwords).
Compare using a constant-time comparison to avoid timing leaks.
Keep secrets out of source control, client-side code, and logs; use environment variables or a secrets manager.
Support rotation and revocation: keys should be replaceable and expire when appropriate.

If a key leaks

Revoke it immediately, issue a new one, and review access logs for misuse. Removing it from a public repository after the fact doesn't un-leak it.

When you generate keys with an online tool, choose one that creates them in your browser using the Web Crypto API so the value is never transmitted.

Frequently asked questions

How long should an API key be?

At least 128 bits of randomness; 32 random bytes (256 bits) is a strong default.

Is Math.random() safe for generating secrets?

No. Use a cryptographically secure generator such as crypto.randomBytes or crypto.getRandomValues.

Should I store API keys in plain text?

No. Store only a hash of the key and show the full value once when it is created.

What should I do if an API key is exposed?

Revoke and rotate it immediately, then check logs for unauthorized use.

Try it: Secret/API Key Generator — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

URL Encoding (Percent-Encoding) Explained: encodeURIComponent, Spaces, and Double Encoding

pulkitgovrani — Wed, 14 Oct 2026 16:30:00 +0000

URLs can only contain a limited set of characters. To include anything else, such as spaces, accented letters, or symbols with special meaning, they are converted to percent-encoding: a percent sign followed by two hexadecimal digits representing the byte.

How it works

Text is first converted to bytes using UTF-8, and each byte that isn't allowed is written as %XX. A space is the byte 0x20, so it becomes %20. The letter e with an acute accent takes two bytes in UTF-8, so it becomes %C3%A9.

hello world      ->  hello%20world
a&b=c            ->  a%26b%3Dc
café             ->  caf%C3%A9

Reserved characters

Characters like : / ? # [ ] @ ! $ & ' ( ) * + , ; = have special roles in URLs.
If you want one of them as data (for example, an ampersand inside a query value), it must be encoded so it isn't mistaken for structure.
Unreserved characters (letters, digits, - . _ ~) never need encoding.

encodeURI vs encodeURIComponent

encodeURI() encodes a whole URL and leaves structural characters like : / ? & = # alone.
encodeURIComponent() encodes a single value and does encode those characters, which is what you want for a query parameter or path segment.
Use encodeURIComponent for values you insert into a URL; using encodeURI on a value would leave & and = unescaped and can corrupt the query string.

const q = "cats & dogs";
const url = "/search?q=" + encodeURIComponent(q);
// /search?q=cats%20%26%20dogs

%20 vs +

In a query string produced by an HTML form (application/x-www-form-urlencoded), spaces are written as +. In other parts of a URL, and in most modern APIs, a space is %20. Decoders for form data treat + as a space, so a literal plus sign must be sent as %2B.

Double encoding and other pitfalls

Double encoding: encoding an already-encoded string turns %20 into %2520. Encode raw values exactly once.
Decode once as well; decoding twice can change meaning and is a source of security bugs.
Encode the value, not the whole URL with its structure.
Let your HTTP client or URL builder handle it when possible instead of concatenating strings.

Debugging

If a link breaks, paste the URL into an encoder/decoder to see the raw text. Do it locally if the URL contains tokens or personal data.

Frequently asked questions

What is percent-encoding?

A way to represent special or unsafe characters in URLs as a percent sign followed by two hex digits, such as %20 for a space.

What is the difference between encodeURI and encodeURIComponent?

encodeURI leaves URL structure characters intact, while encodeURIComponent encodes them, making it correct for individual parameter values.

Is a space %20 or +?

%20 works everywhere in URLs. The + form is used only in form-encoded query strings.

What is double encoding?

Encoding a value twice, turning %20 into %2520. It causes garbled data and should be avoided by encoding exactly once.

Try it: Base64 & URL Encoder — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Write a .gitignore File: Patterns, Examples, and Common Mistakes

pulkitgovrani — Wed, 14 Oct 2026 04:30:00 +0000

A .gitignore file tells Git which files and folders to leave untracked: build output, dependency folders, editor settings, and secrets. Getting it right early keeps your repository small and clean and helps prevent accidents.

Pattern syntax

# Comments must be on their own line

# any .log file
*.log

# a directory named build, anywhere
build/

# only dist in the repo root
/dist

# temp directories at any depth
**/temp

# negate: track this file even though *.log is ignored
!important.log

# environment file with secrets
.env

* matches anything except a slash; ** matches directories at any depth.
A trailing slash matches only directories.
A leading slash anchors the pattern to the repo root.
A # starts a comment only at the beginning of a line; text after a pattern on the same line becomes part of the pattern.
Patterns are evaluated top to bottom, and later rules can override earlier ones.
You can't re-include a file if a parent directory is ignored.

What to ignore

Dependencies: node_modules/, vendor/, virtual environments.
Build output: dist/, build/, .next/, target/, __pycache__/.
Logs and temporary files: *.log, *.tmp.
OS and editor files: .DS_Store, Thumbs.db, .idea/, .vscode/ (unless you share settings).
Secrets and local config: .env, *.pem, credentials files.

It doesn't work on files already tracked

If a file was committed before you added it to .gitignore, Git keeps tracking it. Remove it from the index (not from disk) and commit:

git rm --cached path/to/file
git rm -r --cached node_modules
git commit -m "Stop tracking ignored files"

Secrets: prevention and cleanup

Ignoring a secret after committing it isn't enough

Once a secret is in Git history, it stays there and may already be copied elsewhere. Rotate the credential immediately, then remove it from history if needed.

Useful extras

A global ignore file (git config --global core.excludesfile ~/.gitignore_global) handles personal editor and OS files across all repos.
git check-ignore -v path shows which rule is ignoring a file.
Start from a template for your language or framework, then trim it.
Commit a .env.example with placeholder values so others know which variables are needed.

Frequently asked questions

Why isn't my .gitignore working?

The file is probably already tracked. Run git rm --cached on it, then commit; the ignore rule will apply afterwards.

How do I ignore a folder except one file?

Ignore the folder's contents with folder/* (not the folder itself), then add a negation like !folder/keep.txt.

Should I commit .env files?

No. Commit a .env.example with dummy values and keep the real .env ignored.

What is a global gitignore?

A personal ignore file that applies to all your repositories, useful for editor and OS files.

Try it: .gitignore Generator — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

UUID Versions Explained: v1, v4, v5, v7 and Which One to Use

pulkitgovrani — Tue, 13 Oct 2026 16:30:00 +0000

A UUID (universally unique identifier) is a 128-bit value used to identify things without a central authority handing out numbers. It's written as 32 hexadecimal digits in five groups, like 3f2b8c1e-9a4d-4c7e-8f01-2b6d5e7a9c10.

Reading a UUID

The layout is 8-4-4-4-12 hex digits.
The first digit of the third group is the version. In 3f2b8c1e-9a4d-4c7e-..., the 4 marks version 4.
The first digit of the fourth group encodes the variant (usually 8, 9, a, or b for standard UUIDs).

The main versions

v1: based on a timestamp and the machine's MAC address. Sortable-ish, but it can leak the machine and creation time.
v3 and v5: name-based; hash a namespace plus a name (v3 with MD5, v5 with SHA-1) to get the same UUID every time for the same input.
v4: random. The most common; 122 of its 128 bits are random.
v6 and v7: time-ordered versions standardized in RFC 9562 (2024). v7 puts a millisecond timestamp first followed by random bits.

Will two UUIDs ever collide?

With v4 there are 2^122, about 5.3 x 10^36, possible values. Even generating a billion UUIDs, the chance of any collision is on the order of 10^-19, so for practical purposes collisions are not a concern when a good random source is used.

Why v7 is nice for databases

Random v4 keys land all over a B-tree index, which causes page splits and poorer cache locality on large tables. Time-ordered UUIDs (v7) are roughly sequential, so inserts append near the end of the index, like an auto-increment key, while still being globally unique and generated without coordination.

Which should you use?

General unique IDs: v4 is simple and universally supported.
Primary keys in large databases: consider v7 for better index behavior.
Deterministic IDs from a name: v5.
Avoid v1 if you don't want to expose timing or machine details.

A UUID is not a secret

UUIDs are identifiers, not authorization tokens. Don't rely on them being hard to guess as your only access control; use proper authentication, and generate secrets with a cryptographic random generator.

Frequently asked questions

What is a UUID?

A 128-bit identifier written as 32 hex digits in the 8-4-4-4-12 format, designed to be unique without central coordination.

Can two UUIDs be the same?

In theory yes, but with random v4 UUIDs the probability is so small it is negligible in practice.

What is the difference between UUID v4 and v7?

v4 is entirely random. v7 begins with a timestamp, so values sort roughly by creation time, which is better for database indexes.

Are UUIDs safe to use as security tokens?

Not by themselves. Use a cryptographically secure random token for secrets and proper access control for resources.

Try it: UUID Generator — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

HTTP Status Codes Cheatsheet: What 200, 301, 404, 500 and the Rest Mean

pulkitgovrani — Tue, 13 Oct 2026 04:30:00 +0000

Every HTTP response starts with a three-digit status code that tells the client what happened. Learning the five classes gives you most of the picture, and a couple of dozen specific codes cover nearly everything you'll see.

The five classes

1xx Informational: the request was received and processing continues (rarely seen directly).
2xx Success: the request worked.
3xx Redirection: the client needs to take another step, usually going to a different URL.
4xx Client error: something is wrong with the request.
5xx Server error: the server failed to handle a valid request.

Success codes

200 OK: standard success.
201 Created: a new resource was created (typical for POST).
202 Accepted: the request was accepted but processing isn't finished.
204 No Content: success with no body, common for DELETE and some PUTs.

Redirects

301 Moved Permanently: the resource has a new permanent URL; search engines transfer ranking.
302 Found: a temporary redirect.
307 Temporary Redirect and 308 Permanent Redirect: like 302 and 301, but the request method and body are preserved.
304 Not Modified: the cached copy is still valid.

Client errors

400 Bad Request: malformed or invalid request.
401 Unauthorized: authentication is missing or invalid (despite the name, it means unauthenticated).
403 Forbidden: you are identified but not allowed.
404 Not Found: nothing exists at that URL.
405 Method Not Allowed: the path exists but not for that method.
409 Conflict: the request conflicts with the current state, such as a duplicate.
410 Gone: the resource was intentionally removed permanently.
422 Unprocessable Content: the request was well-formed but failed validation.
429 Too Many Requests: you're being rate limited; check the Retry-After header.

Server errors

500 Internal Server Error: an unexpected failure on the server.
502 Bad Gateway: a proxy or gateway received an invalid response from upstream.
503 Service Unavailable: temporarily overloaded or down for maintenance.
504 Gateway Timeout: an upstream server didn't respond in time.

401 vs 403

Use 401 when the caller hasn't proven who they are (log in or send a valid token). Use 403 when they are known but don't have permission for that resource.

Frequently asked questions

What is the difference between 301 and 302?

301 is a permanent redirect and passes SEO value to the new URL. 302 is temporary, so search engines keep the original URL.

What does a 500 error mean?

The server hit an unexpected problem. It is a server-side issue, not something the client did wrong.

What is the difference between 401 and 403?

401 means authentication is missing or invalid. 403 means you're authenticated but not permitted.

What should I do when I get a 429?

Slow down and retry after the delay in the Retry-After header, using exponential backoff.

Try it: HTTP Status Code Lookup — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Compound Interest Explained: The Formula, the Rule of 72, and Why Time Matters

pulkitgovrani — Mon, 12 Oct 2026 16:30:00 +0000

Simple interest is paid only on the original amount. Compound interest is paid on the original amount plus the interest already earned, so the growth builds on itself. Over long periods the difference is dramatic.

The formulas

Simple:    A = P x (1 + r x t)
Compound:  A = P x (1 + r/n)^(n x t)

P = starting amount   r = annual rate (as a decimal)
t = years             n = compounding periods per year

A worked example

Invest 10,000 at 7% per year for 20 years:

Simple interest: 10,000 x (1 + 0.07 x 20) = 24,000.
Compounded annually: 10,000 x 1.07^20 = about 38,697.
Compounded monthly: 10,000 x (1 + 0.07/12)^240 = about 40,387.

The difference between simple and compound is almost 15,000 on the same rate and time, entirely from earning interest on interest.

Compounding frequency

The more often interest compounds (annually, monthly, daily), the more you earn, but the gains from increasing frequency shrink quickly. Moving from annual to monthly matters more than going from monthly to daily.

The rule of 72

To estimate how long money takes to double, divide 72 by the annual rate in percent. At 6%, 72 / 6 = 12 years (the exact figure is about 11.9). It is a handy mental shortcut that works best for rates between about 4% and 12%.

What this means in practice

Starting early matters more than starting big; time is the main ingredient.
Regular contributions add fresh principal that also compounds.
The same math works against you on debt: credit card balances compound too.
Fees and taxes reduce the effective rate, so compare after-cost returns.

Illustration, not a forecast

Real returns vary and are never guaranteed, and this is not financial advice. Use the formula to understand the mechanics, not to predict outcomes.

Frequently asked questions

What is the compound interest formula?

A = P(1 + r/n)^(nt), where P is principal, r the annual rate, n compounding periods per year, and t years.

What is the difference between simple and compound interest?

Simple interest is calculated only on the principal. Compound interest is calculated on the principal plus accumulated interest.

What is the rule of 72?

A shortcut: divide 72 by the annual interest rate to estimate the years needed to double your money.

Does compounding more often earn more?

Yes, but with diminishing returns; the jump from annual to monthly is larger than from monthly to daily.

Try it: Simple & Compound Interest — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How Loan EMI Is Calculated: The Formula, a Worked Example, and How to Reduce It

pulkitgovrani — Mon, 12 Oct 2026 04:30:00 +0000

An EMI (equated monthly installment) is the fixed amount you pay every month to repay a loan. Each payment covers the interest for the month plus part of the principal. Early on, most of the payment is interest; later, most of it is principal.

The formula

EMI = P x r x (1 + r)^n / ((1 + r)^n - 1)

P = loan amount (principal)
r = monthly interest rate = annual rate / 12 / 100
n = number of monthly installments

A worked example

Borrow 1,000,000 at 9% per year for 5 years. Here r = 9 / 12 / 100 = 0.0075 and n = 60. Plugging these into the formula gives an EMI of about 20,758.36 per month.

Total paid: 20,758.36 x 60 = about 1,245,501.
Total interest: about 245,501 on a 1,000,000 loan.
The same loan over 10 years gives an EMI of about 12,668 but total interest of about 520,109.

What changes the EMI

Loan amount: the EMI scales in proportion to the principal.
Interest rate: even a one-point difference adds up over the years.
Tenure: longer means a lower EMI but much more total interest, as the 5-year versus 10-year example shows.

Ways to reduce the interest you pay

Make a larger down payment so you borrow less.
Choose the shortest tenure whose EMI you can comfortably afford.
Make part-prepayments; they reduce the outstanding principal, cutting interest, and you can choose to shorten the tenure or lower the EMI.
Compare rates and fees across lenders, and check whether floating rates can be reset.
Check for prepayment charges before committing.

Educational only

This explains the standard reducing-balance formula. Actual loans may include processing fees, insurance, or different compounding, so use your lender's schedule for exact numbers. This is not financial advice.

Frequently asked questions

What is the formula for EMI?

EMI = P x r x (1 + r)^n / ((1 + r)^n - 1), where P is the principal, r the monthly rate, and n the number of months.

Does a longer tenure reduce total cost?

No. It lowers the monthly payment but increases the total interest paid.

How does prepayment help?

It reduces the outstanding principal, so less interest accrues. You can use it to shorten the loan or lower the EMI.

Is EMI the same for the whole loan?

For a fixed-rate loan, yes. The split between interest and principal changes each month, but the total stays the same.

Try it: Loan EMI Calculator — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

FrostLine: A Garden Planner Powered by a Local Open-Source LLM

pulkitgovrani — Sun, 11 Oct 2026 18:34:56 +0000

What I Built

FrostLine tells you what to do in the garden this week. You type your town. It pulls 15 years of nightly lows, works out your median and 1-in-10 "safe" last spring frost and first fall frost, and lists what to sow, start indoors or transplant right now, plus tonight's frost risk.

A local LLM then turns the plan into a short field note that always ends the same way: put the phone down and go outside.

It is for anyone with a patch of soil, a balcony or an allotment who is tired of generic "plant in spring" advice. It also works in places that never freeze: I tested Pune and Sydney, where it switches to the local cool/warm cycle instead of frost dates.

Demo

Live: frostline-h8z9.onrender.com. It runs on Render's free tier, so the first load can take about 50 seconds to wake up. The hosted version has no Ollama, so its field note comes from a template; the local LLM version is the one in the video.

Code

pulkitgovrani / frostline

Garden jobs from your town's frost history, narrated by a local open-weight LLM

FrostLine

Live demo: https://frostline-h8z9.onrender.com (free tier, first load may take ~50s; no local LLM there, so the note is templated)

This week's garden jobs, computed from your own town's frost history, with a local open-weight LLM writing the field note Weather history is fetched once (Open-Meteo, no key) and cached in data/, so afterwards it works without signal.

python3 -m venv .venv && .venv/bin/pip install -r requirements.txt
ollama pull gemma4:e4b            # any Ollama model works: FROSTLINE_MODEL=llama3.2 ...
.venv/bin/python -m frostline.cli "Minneapolis"          # CLI
.venv/bin/python -m frostline 8765                       # web UI on http://localhost:8765
.venv/bin/python -m pytest -q

How it works

climate.py: 15 years of daily minimum temperature -> median and 1-in-10 safe last-spring / first-fall frost dates (hemisphere-aware).
planner.py: transparent rules for ~17 crops anchored on those dates. Tender crops wait for the safe date. Frost-free climates use the local cool/warm cycle instead.
model.py: tonight's…

View on GitHub

How I Built It

Open-weight LLM, running locally: Gemma (gemma4:e4b) through Ollama. The LLM only narrates. Planting dates come from code, because small models invent dates. I caught mine inventing chores (compost, gloves) when the plan was empty, so empty weeks now skip the LLM and use a template.
Rules, not vibes: planner.py anchors about 17 crops on the frost dates. Tender crops wait for the 1-in-10 safe date; hardy ones use the median.
Frost model: a gradient-boosting classifier predicts tonight's frost from day of year, latitude and recent lows. On two held-out years it scored a Brier of 0.054 against 0.068 for a plain day-of-year baseline (Minneapolis), so it does beat climatology. If you set a TABPFN_TOKEN, it can use TabPFN instead; I have not run that path.
Data: Open-Meteo history is fetched once and cached on disk, so after the first run for a town it works with no signal.
Stack: plain Python, pandas, scikit-learn and the standard-library HTTP server, with a single static page for the UI. Tests cover the planner and the frost model.

Why Does Open Innovation Matter?

It works where gardens are: the garden has no wifi. The weights and the cached data live on the device, which a closed API cannot offer.
Your location stays yours: your town and your garden never reach a server I don't control.
Swappable: FROSTLINE_MODEL=llama3.2 changes the narrator with no code change, and the frost model can swap sklearn for TabPFN.
Free to run: no API bill for a weekend hobby.

Prize Categories

Best Use of Render: the web UI is hosted on Render as a free web service, deployed from a render.yaml Blueprint in the repo.

Binary, Octal, Decimal, and Hexadecimal Explained (With Conversion Methods)

pulkitgovrani — Sun, 11 Oct 2026 16:30:00 +0000

We write numbers in base 10 because we have ten fingers. Computers work in base 2, and programmers often use base 8 and base 16 as compact ways to write binary. Once you see the pattern, conversions become straightforward.

What a base means

In any base, each digit position is worth a power of the base. In decimal, 345 means 3 x 100 + 4 x 10 + 5 x 1. In binary, each position is a power of 2, so 1101 means 1 x 8 + 1 x 4 + 0 x 2 + 1 x 1, which is 13.

The four common bases

Binary (base 2): digits 0 and 1. How hardware stores everything.
Octal (base 8): digits 0 to 7. Used for Unix file permissions (chmod 755).
Decimal (base 10): digits 0 to 9. Everyday numbers.
Hexadecimal (base 16): digits 0 to 9 and A to F. Colors, memory addresses, and byte values.

Decimal  Binary     Octal  Hex
10       1010       12     A
255      11111111   377    FF
4095     111111111111  7777  FFF

Converting decimal to another base

Divide the number by the target base and record the remainder.
Divide the quotient again, repeating until the quotient is 0.
Read the remainders from last to first.

Example: 255 in hex. 255 divided by 16 is 15 remainder 15, and 15 divided by 16 is 0 remainder 15. Both remainders are F, so 255 is FF.

Why hex is so common

One hex digit represents exactly four bits, so one byte is always two hex digits. That is why colors are written like #4338ca, and why 0xFF is 255, the largest value of a single byte. Converting between binary and hex is just grouping bits in fours.

Prefixes in code

0b1010 for binary, 0o12 for octal (or a leading 0 in some older languages), and 0xFF for hex.
In JavaScript, parseInt('ff', 16) parses hex and (255).toString(2) gives binary.
In Python, int('ff', 16), bin(255), oct(255), and hex(255) do the conversions.

Negative numbers

Computers usually store negative integers in two's complement form, so the same bits can mean different values depending on whether the number is signed. Check the type when converting negative values.

Frequently asked questions

How do I convert binary to decimal?

Add up the powers of 2 for each 1 bit. 1101 is 8 + 4 + 1 = 13.

Why do programmers use hexadecimal?

Each hex digit maps to four bits, making binary values compact and easy to read.

What is 255 in binary and hex?

255 is 11111111 in binary and FF in hexadecimal.

What does chmod 755 mean?

It is an octal permission value: 7 (read, write, execute) for the owner, and 5 (read, execute) for group and others.

Try it: Number Base Converter — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

Time Zone Conversion: 7 Mistakes That Break Schedules and Timestamps

pulkitgovrani — Sun, 11 Oct 2026 04:30:00 +0000

Time zones are a classic source of bugs: meetings scheduled an hour off, reports that miss a day, jobs that run twice. Most of the pain comes from a small set of avoidable mistakes.

1. Storing local times without a zone

A value like 2026-03-08 02:30 is ambiguous. Store instants in UTC (or as an ISO 8601 string with an offset, such as 2026-03-08T02:30:00Z) and convert to local time only when displaying it.

2. Using abbreviations

CST can mean Central Standard Time, China Standard Time, or Cuba Standard Time. IST can be India, Ireland, or Israel. Use IANA names such as America/Chicago, Asia/Kolkata, or Europe/London, which are unambiguous and carry the daylight saving rules.

3. Confusing offsets with zones

An offset like UTC-5 is a fixed number. A zone like America/New_York is a set of rules that changes between UTC-5 and UTC-4 during the year. Recurring events need a zone, not just an offset.

4. Ignoring daylight saving transitions

When clocks spring forward, a local hour doesn't exist (2:30 AM may be skipped).
When clocks fall back, a local hour happens twice, so a local time can map to two different instants.
Not all places observe DST, and the rules change by government decision.

5. Assuming whole-hour offsets

India is UTC+5:30, Nepal is UTC+5:45, and some regions use half-hour offsets. Code that assumes whole hours will be wrong for millions of people.

6. Adding 24 hours to mean 'tomorrow'

On a DST change a local day can be 23 or 25 hours long. Use a date library to add calendar days in a specific zone.

7. Scheduling recurring meetings in UTC

A meeting at 09:00 in New York stays at 09:00 local all year, which is a different UTC time in summer and winter. Store the zone and local time for recurring events.

Rules of thumb

Store UTC, store IANA zone names when the local time matters, convert at the edges, and use a maintained library instead of hand-written offset math.

Frequently asked questions

What is the best way to store dates and times?

Store instants in UTC (or ISO 8601 with an offset) and convert to the user's time zone only when displaying.

Why shouldn't I use EST or IST?

Abbreviations are ambiguous and don't encode daylight saving rules. Use IANA zone names like America/New_York.

How do I convert between time zones?

Convert the local time to a UTC instant using the source zone's rules, then express that instant in the target zone.

Which time zones use half-hour offsets?

Examples include India (UTC+5:30), and Nepal uses UTC+5:45.

Try it: Timezone Converter — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

bcrypt vs Argon2: How to Hash Passwords Properly

pulkitgovrani — Sat, 10 Oct 2026 16:30:00 +0000

Storing passwords safely is one of the few areas where doing the standard thing well matters more than being clever. The standard thing is to use a purpose-built, deliberately slow password hashing function, and never a general-purpose hash such as MD5 or SHA-256 by itself.

What a password hash needs

Slow by design: hashing should cost enough that guessing billions of passwords is impractical.
Salted: a unique random value per password, so identical passwords hash differently and precomputed tables are useless.
Tunable: a work factor you can raise as hardware improves.
Memory-hard (ideally): making GPU and ASIC attacks more expensive.

bcrypt

Around since 1999 and available in essentially every language.
Controlled by a cost factor: each increase of 1 doubles the work. OWASP suggests a cost of at least 10, and many teams use 12 or more, tuned so a hash takes a noticeable fraction of a second on your server.
Only the first 72 bytes of the password are used, so very long passwords or passphrases are truncated. Some libraries pre-hash to handle this.
Not memory-hard, which makes it somewhat easier to attack with specialized hardware.

Argon2id

Winner of the Password Hashing Competition in 2015; Argon2id is the recommended variant.
Has three parameters: memory, iterations (time), and parallelism.
OWASP's minimum configuration is roughly 19 MiB of memory, 2 iterations, and 1 degree of parallelism, with other combinations offering similar strength.
Memory-hardness makes large-scale cracking substantially more expensive.

Which should you choose?

Practical guidance

For new systems, use Argon2id if your platform has a well-maintained library. If not, bcrypt with a sensible cost remains a solid, widely supported choice. Either is vastly better than MD5, SHA-1, or plain SHA-256.

Good practices

Use the library's built-in salt handling; never invent your own scheme.
Store the full output string (it embeds the algorithm, parameters, and salt).
Benchmark on production hardware and pick parameters that take roughly 100 to 500 milliseconds.
Rehash on login when parameters are outdated, upgrading users gradually.
Add rate limiting and multi-factor authentication; hashing doesn't stop online guessing.

Frequently asked questions

Is bcrypt still secure?

Yes, with a sufficient cost factor it remains secure and widely used, though Argon2id is preferred for new designs.

Why not just use SHA-256 for passwords?

It is designed to be fast, which lets attackers test billions of guesses per second. Password hashes are deliberately slow.

What is a salt?

A unique random value added to each password before hashing so identical passwords produce different hashes.

What bcrypt cost factor should I use?

At least 10, and commonly 12 or higher, tuned to take a noticeable fraction of a second on your hardware.

Try it: Bcrypt Hash Generator/Checker — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.

How to Verify a File Checksum (SHA-256) on Windows, macOS, and Linux

pulkitgovrani — Sat, 10 Oct 2026 04:30:00 +0000

Software downloads often list a checksum, a short string computed from the file's contents. If you compute the same checksum on your copy and it matches, the file is intact. If it doesn't, the download is corrupt or the file was changed.

What a checksum proves (and doesn't)

A match shows your file is identical to the one the checksum was computed from.
It protects against corruption and accidental changes.
It only protects against tampering if the checksum itself came from a trustworthy source, ideally a different channel than the file, such as the vendor's HTTPS page or a signed release.
If an attacker can replace both the file and the checksum on the same site, a match proves nothing.

Compute a SHA-256 hash

# macOS
shasum -a 256 file.iso

# Linux
sha256sum file.iso

# Windows (Command Prompt)
certutil -hashfile file.iso SHA256

# Windows (PowerShell)
Get-FileHash file.iso -Algorithm SHA256

Compare the result

Copy the checksum published by the vendor.
Run the command above on your downloaded file.
Compare the two values character by character; hex case doesn't matter, but every digit does.
Or paste both into a verifier tool that reports match or mismatch for you.

If it doesn't match

Re-download the file; interrupted or flaky downloads are the usual cause.
Make sure you compared the right algorithm (SHA-256 vs SHA-1 vs MD5) and the right file version.
Check you didn't copy extra whitespace.
If it still fails, don't run the file; get it from an official source again.

Hash locally

Hashing a large file in your browser doesn't upload it anywhere, so you can check installers and private documents without exposing them.

Frequently asked questions

What is a file checksum?

A short fingerprint computed from a file's contents. Any change to the file produces a different checksum.

Which algorithm should I use to verify downloads?

SHA-256 is the common standard. Use whichever algorithm the publisher lists.

Does a matching checksum mean the file is safe?

It means it matches the published one. It is only as trustworthy as the source of the checksum.

How do I check a SHA-256 hash on Windows?

Run Get-FileHash file -Algorithm SHA256 in PowerShell, or certutil -hashfile file SHA256 in Command Prompt.

Try it: Checksum Verifier — free, runs in your browser, nothing is uploaded.

Originally published at ilovekit.app.