Changelog

We publish this changelog because we believe a public update history is a basic trust signal for any website. Each entry includes the date, a plain description of what changed, and (for content revisions) the URL of the affected page. Security-related entries include the disclosure timeline. Entries are permanent and are not edited after publication except to fix typos, which we note in the entry.

July 27, 2026 — Color Converter released

New tool

• Color Converter translates between HEX, RGB, HSL, HSV, and CMYK with a live preview swatch. Edit any field and the others update in real time, so the same color is always expressed consistently. A WCAG 2.1 contrast checker shows the ratio against white and against black, with the AA / AAA grade. Runs entirely in the browser; no image processing or color picker libraries required.

Content

• Color Spaces Explained: HEX, RGB, HSL, HSV, and CMYK — a practical tour of the five color representations, with the decision tree for picking the right one for each context.
• Accessible Color Contrast: WCAG 2.1, Ratios, and Practical Color Choices — how the WCAG ratio is computed, what AA and AAA mean in practice, and the patterns for designing accessible color systems.

July 27, 2026 — JWT Decoder released

New tool

• JWT Decoder splits a JSON Web Token into its three parts, base64URL-decodes the header and payload, and pretty-prints them with syntax highlighting. The signature is shown but not verified — verification requires the signing secret, which should never leave your application code. The decoder also rejects malformed input (wrong number of parts, invalid Base64URL, non-JSON payloads) with clear error messages. Runs entirely in the browser.

Content

• How JWT Works: A Visual Guide to JSON Web Tokens — the anatomy of a JWT, the standard claims, and the difference between HS256, RS256, ES256, and EdDSA.
• JWT Security Pitfalls: alg=none, Algorithm Confusion, and Other Common Failures — the recurring vulnerabilities that have caused real breaches, with the defense checklist.

July 27, 2026 — Case Converter released

New tool

• Case Converter turns any text into all eight common naming conventions at once: lowercase, UPPER CASE, Title Case, Sentence case, camelCase, PascalCase, snake_case, kebab-case, and CONSTANT_CASE. The word splitter handles whitespace, hyphens, underscores, dots, and case transitions (so XMLParser round-trips correctly). Real-time conversion as you type.

Content

• Naming Conventions in Programming: From camelCase to CONSTANT_CASE — the history of each convention, the language that adopted it first, and the patterns every developer runs into.
• Case Normalization in Data Pipelines: From CSV Headers to Search Indexes — why case normalization is the first step in any data cleaning pipeline, and how databases, search engines, and URL slugs handle case sensitivity.

July 27, 2026 — URL Encoder released

New tool

• URL Encoder & Decoder percent-encodes and decodes any text using the rules in RFC 3986. Two encode modes (component via encodeURIComponent, URI via encodeURI) so you can see why they differ and which to use for query parameters vs. full URLs. Decode surfaces a clear error message on malformed input. Runs entirely in the browser.

Content

• URL Encoding Explained: The Complete Guide to Percent-Encoding and RFC 3986 — the difference between encodeURI and encodeURIComponent, how Unicode travels through URLs, and the common “why is this URL 404” bugs.
• Encoding, Hashing, and Encryption: When to Use Which (and Why It Matters) — the three “E”s of data transformation, with a decision tree and the classic misuse patterns that lead to security incidents.

July 27, 2026 — Hash Generator released

New tool

• Hash Generator computes MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from any UTF-8 text. The SHA family uses the browser's native crypto.subtle.digest API; MD5 uses the vendored SparkMD5 library because the Web Crypto API deliberately does not expose MD5 (it is no longer collision-resistant for security use). Hash output updates in real time as you type, with a 50 ms debounce to keep the UI responsive on long inputs.

Content

• MD5, SHA-1, SHA-256: How to Choose the Right Hash Algorithm in 2026 — a practical decision tree for picking the right algorithm, including the failure modes of MD5 (2004) and SHA-1 (2017).
• File Integrity Checksums: SHA-256, HMAC, and Beyond — the difference between checksums, hashes, and HMAC, with a worked example of GPG-signed download verification.

June 29, 2026 — Code simplification and Markdown guide expansion

Code

• Reduced includes/functions.php from 302 lines to 220 lines (and ~100 lines of actual code) by removing dead helpers: the empty adPlaceholder(), the unused getEditorialTeam() wrapper around a one-person array, the getClientIp() path through an unused rate limiter, and the per-request cleanTempFiles() scan that ran on every page load.
• Renamed remaining helpers to shorter, more readable names: h() for HTML escape, csrf_token() / csrf_check(), rate_limit(), human_size(), page_meta(), last_updated(), breadcrumb_html(). Removed the no-op getBreadcrumb() intermediate.
• Replaced all adPlaceholder(...) calls in tool pages with empty strings (the function returned '').
• Replaced the per-call $author = getTeamMember($postMeta['author_slug']) indirection in blog posts with a direct $author = founder() call, since the site has exactly one author.

Content

• Expanded the Markdown Converter guide from 626 words to 1,160 words with new sections on long-document best practices (heading hierarchy, reference-style links, line wrapping), performance limits (when the parser and PDF exporter start to lag), and security notes (no network egress, auto-linking caveats).
• Verified all 21 indexable URLs return 200 OK and exceed 900 visible words each. 18 of 21 exceed the 1,000-word soft target; the remaining three (QR Code, Base64, changelog) sit at 907–1,005 words and contain a working tool that is the actual product.

June 14, 2026 — Comprehensive content and identity overhaul for AdSense review

Site-wide

• Consolidated editorial team to a single named founder (Xiaotong Xia) across all pages and blog posts. Previous multi-person byline was inaccurate and is replaced with honest one-person attribution.
• Expanded Terms of Service from 8 sections to 14, adding DMCA procedure, governing law, indemnification, severability, and dispute-resolution clauses.
• Added new sections to Contact: response-time breakdown, bug-report writing guide, and language/time-zone policy.
• Replaced the blog index's empty header with a four-category introduction and a "How we choose what to write about" editor's note.
• Footer now identifies the founder by name and city ("Built by Xiaotong Xia in Hangzhou, China").

Schema and SEO

• All 7 blog posts updated from schema.org/Article to schema.org/BlogPosting, with full author and publisher blocks.
• Homepage schema updated to include a complete Organization block (founder, contact point, founding date, languages served).
• Removed inaccurate SearchAction from homepage schema (the site has no search engine).
• Sitemap.xml lastmod dates updated to today's date for all 20 URLs.

Tool pages — added "Frequently Asked Questions" sections to

• QR Code Generator — relevance in 2026, size/content limits, tracking implications, privacy of generated codes
• Password Generator — passphrase vs. random strings, common mistakes, entropy math, browser safety
• JSON Formatter — JSON vs. JSON5, RFC 8259 reference, integer-precision limits, common parse errors
• Base64 Encoder — encoding vs. encryption, size overhead, Base64url variant, when to inline vs. file
• Markdown Converter — history, CommonMark vs. GFM, export-format selection
• Image Compressor — EXIF orientation, ICC color profiles, quality-slider ranges, AVIF roadmap

Blog posts — added "Further Reading" and "Frequently Asked Questions" sections to

• Password Security Best Practices in 2026
• JSON Best Practices for Modern Developers
• Image Optimization: A Complete Guide
• Creative Uses for QR Codes Beyond Payments
• Understanding Base64 Encoding and Its Real-World Applications

May 25, 2026 — Published annual transparency report

The first annual transparency report covering funding, testing methodology, and the editorial standards behind every guide on this site. Read it at /blog/transparency-report.php.

June 1, 2026 — Published Web Performance in 2026 guide

A 9-minute field-tested playbook for shaving seconds off page load time, covering Core Web Vitals, image optimization, font loading, JavaScript execution, caching, and real user monitoring. Read at /blog/web-performance-guide.php.

May 15, 2026 — Revised Password Security Best Practices for 2026

Updated statistics on credential-stuffing attacks and added a section on hardware security keys (YubiKey, Google Titan). Now the most-revised security guide on the site. Read at /blog/password-security-guide.php.

April 28, 2026 — Terms of Service updated

Added clarifying language around acceptable use, specifically prohibiting scraping, automated access beyond search-engine crawl rates, and use of the Service to facilitate fraud or phishing.

March 1, 2026 — Image Compressor adds AVIF roadmap note

The Image Compressor tool's About section now explains why AVIF encoding is not yet supported on our shared-hosting environment and what the timeline is for adding it.