Practical, citation-backed guides written for engineers at the keyboard.
How ToolRunner runs Real-ESRGAN super-resolution client-side: ONNX session setup, WebGL/WASM fallback, 128px tiling with feathered stitching, no server.
by Dowon Oh
How ToolRunner generates RFC 6238 TOTP codes entirely in the browser, and how the AES-GCM vault with PBKDF2 and WebAuthn PRF key wrapping protects the secrets.
by Dowon Oh
Building ToolRunner's Cron Generator: two-way builder sync, where cron-parser and cronstrue disagree, and why next-run previews need an explicit IANA timezone.
by Dowon Oh
Pasting a JWT into a server-backed decoder means handing out a live credential. How ToolRunner decodes and verifies tokens entirely in your browser.
by Dowon Oh
Why big JSON freezes browser tabs: JSON.parse cost vs DOM node count, how ToolRunner's JSON Viewer renders trees, and the honest limits of client-side.
by Dowon Oh
The threat model of pasting API keys and production JSON into web tools, what client-side only really guarantees, and how to verify it yourself in DevTools.
by Dowon Oh
How ToolRunner's PDF Merger & Splitter merges, reorders, and extracts PDF pages entirely in the browser with pdf-lib and pdf.js — no server, no upload.
by Dowon Oh
How ToolRunner turns a client-side React Router app into fully prerendered static pages with renderToString, react-helmet-async, and one Node script.
by Dowon Oh
How ToolRunner packs entire tool sessions into query parameters with debounced replaceState, lz-string compression, and a hard 8,000-character URL budget.
by Dowon Oh
How ToolRunner's Hash Generator computes SHA digests with crypto.subtle.digest, why MD5 and bcrypt need pure-JS libraries, and the trade-offs involved.
by Dowon Oh
Why an HTTP tester running in your browser gets blocked by CORS while Postman sails through — and why proxying around it costs more than it looks.
by Dowon Oh
A practical guide to Strict-Transport-Security: how the max-age ramp works, when to add includeSubDomains and preload, and the cases where deploying HSTS too aggressively will break a site you cannot easily roll back.
by Dowon Oh
A working developer's reference for the modern HTTP security-header set: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Permissions-Policy, Cross-Origin-Opener-Policy + Cross-Origin-Embedder-Policy, and Referrer-Policy — what each does, how to set it, and the realistic ways each one breaks a production site.
by Dowon Oh
A working developer's guide to Content-Security-Policy: how the directives compose, why inline scripts and eval are flagged, when nonces beat hashes, and the report-only-first migration path that keeps a real site from breaking on day one.
by Dowon Oh