TwoThink Dev blog
Tutorials and techniques
How do I format SQL online? Uppercase keywords and indentation rules
Generic SQL layout: breaking SELECT fields onto new lines, indenting WHERE continuations, subqueries and CASE WHEN — with the TwoThink SQL formatter running entirely in the browser.
How do you test regular expressions online? g/i/m flags and capture groups in one go
An explanation of the g/i/m/s/u/y flags, capture groups and replacement previews using the browser's native RegExp, plus an introduction to the TwoThink regex tester (nothing is uploaded).
How do I write Markdown online? Live preview and XSS safety
A hand-written Markdown parser renders React elements, and a URL allow-list blocks javascript: — the TwoThink online editor uploads nothing.
How do CSV to JSON converters handle quotes and nested fields?
CSV quote escaping, commas and newlines inside fields, and the trade-off of flattening nested JSON objects with dots when converting to CSV — plus a recommendation for the TwoThink local converter.
The 12 free developer tools we shipped (no ads)
A list of TwoThink Dev tools: JSON, regex, password generation and more — pure front-end, 0 uploads, 0 sign-ups.
How does base conversion work? 2/8/10/16 and big numbers
What to watch out for when converting between binary, octal, decimal and hexadecimal (prefixes, negatives, big integers), plus an introduction to the TwoThink base converter.
Is using Math.random in an online password generator dangerous? Entropy and Web Crypto
Why a password generator should use crypto.getRandomValues, how entropy is estimated, and how the TwoThink password generator works — including the option to exclude look-alike characters.
How do you diff code? Three tools compared
Self-checking before a PR and comparing config differences — a single diff can save half an hour of arguing.
How do you write a cron expression? 5-field and 6-field forms
Cannot make sense of 0 0 * * *? Split the fields and look at the next run times instead.
Why is MD5 unsafe in the SHA-256 era?
Practical MD5 collisions are affordable now; use SHA-256 for integrity checks and bcrypt/argon2 for passwords.
What is a JWT? Understand tokens in three steps (without the signature rabbit hole)
When debugging a login session, look at the header and payload first — signature verification comes later.
What is a UUID? Why is v4 the default? (with a look at v7)
Primary keys, request IDs, de-duplicated filenames — for most cases a plain UUID v4 is enough.
What is a timestamp? Three common formats explained
Those 10-digit or 13-digit numbers in your logs — telling seconds from milliseconds avoids half of the time zone pitfalls.
Five scenarios where URL encoding matters (with JS / Python)
When a URL contains non-ASCII text or & and =, correct encoding stops parameters from being truncated.
What is Base64? Why does it show up in data transfer?
Base64 turns binary into printable characters — JWTs, email attachments and data URLs all rely on it.
How do I format JSON? Three approaches (online / CLI / editor plugin)
When an API returns unreadable JSON, or a config file looks misaligned — format it first so you can actually see the structure.