Articles

Guides, tutorials, and deep-dives on the tools we build at Toolhub.

• Designing for color blindness: what 8% of users see

  2026-08-02

  Color blindness affects roughly 8% of men and 0.5% of women. Most design failures aren't contrast failures — they're cases where color is the only signal. This piece covers the most common types, the most common UI mistakes, and the concrete fixes that work without sacrificing aesthetics.

• Crontab syntax that won't surprise you at 3am

  2026-07-30

  Crontab's five-field syntax looks simple but hides a day-of-month/day-of-week OR trap, a PATH environment that ignores your shell profile, a 1-minute resolution floor, and DST transitions that duplicate or skip runs entirely. This piece covers each pitfall with concrete examples and the exact fixes.

• 5 free citation generators compared (and which actually follow the spec)

  2026-07-27

  ZoteroBib, EasyBib, Citation Machine, Cite This For Me, and MyBib tested on a single journal-article source against APA 7, MLA 9, and Chicago 17th. The Chegg-owned tools still output the old APA 6 DOI prefix. ZoteroBib wins because it uses the same Citation Style Language engine that academic publishers use.

• Stripping EXIF GPS from mobile photos before sharing

  2026-07-27

  Modern smartphone GPS is accurate to 3–5 metres and embedded in every photo by default. This guide covers iOS and Android native controls, which sharing platforms strip GPS (and which don't), the WhatsApp document-mode trap, and how to verify a strip worked — including the embedded thumbnail that survives most naive attempts.

• Pre-tax vs post-tax math for indie founders

  2026-07-27

  Self-employment tax adds 15.3% on top of income tax, and most indie founders don't model it. This piece covers the SE tax deduction, solo 401(k) and SEP-IRA contribution limits, traditional vs Roth break-even math, the health insurance above-the-line deduction, and how tax drag compounds — with concrete numbers throughout.

• RNG seeding: why your "random" feels rigged

  2026-07-27

  Games use seeded pseudo-random number generators, not true randomness. The same seed always produces the same sequence, which explains loot streaks, speedrun exploits, and why Minecraft's world generation is reproducible. This piece unpacks how seeds work, what can go wrong, and how game designers use (and abuse) determinism.

• VAT MOSS for digital sellers: rules, pitfalls, and exemptions

  2026-07-27

  VAT MOSS became OSS in July 2021, but the underlying obligations for digital sellers remain. This article covers what changed (and what didn't), the two-evidence location rule most sellers get wrong, the €10k threshold exemption, B2B reverse charge, the UK's separate post-Brexit scheme, and the currency conversion trap in quarterly filings.

• Detecting prompt injection in your own bots

  2026-07-10

  Prompt injection attacks manipulate LLMs into ignoring your system prompt or leaking sensitive data. This guide covers direct vs indirect injection, input-layer and output-layer detection patterns, structural defenses in system prompts, and how to red-team your own bot before attackers do.

• AVIF vs WebP: when each is actually faster

  2026-07-05

  AVIF usually produces smaller files than WebP, and the internet has decided that settles the speed question. It doesn't. Fewer bytes on the wire is only one of three clocks that matter — decode time in the browser and encode time in your build both push the other way. This is when each format is genuinely faster, and how to tell without trusting a single-number benchmark.

• How to read a security advisory: CVE, CVSS, EPSS and KEV without the hype

  2026-07-03

  Security advisories throw four different acronyms at you — CVE, CVSS, EPSS and KEV — and each answers a different question. This guide explains what every one actually measures, why the headline severity score is the least useful number on the page, and how to triage a vulnerability in five minutes instead of panicking over a colour.

• Regex lookahead and lookbehind, explained without the headache

  2026-07-02

  Lookahead and lookbehind are zero-width assertions: they check a condition to the left or right of the cursor without including it in the match. This guide walks the four forms, the classic gotchas (variable-length lookbehind, greedy overlap), and when a lookaround is the clean answer versus overkill.

• Dice math: 2d6 and 1d12 aren't the same — here's why

  2026-06-21

  2d6 and 1d12 cover almost the same range but behave completely differently: 1d12 is flat, 2d6 clusters hard around 7. This piece walks the actual distributions, what they mean for damage and skill checks, and when a designer should reach for each.

• Invoice numbering: serial, date-based, prefix — what to pick

  2026-06-16

  Serial, date-based, and prefix invoice numbering each have genuine trade-offs. This guide explains how each scheme works, why tax authorities care about sequential numbering, and how to pick the right structure before you issue your first invoice.

• Markdown across platforms: 7 differences that bite you

  2026-06-09

  There's no single Markdown: CommonMark, GFM, Pandoc, Slack, Notion, and a dozen platform dialects are all subtly incompatible. These seven differences — line breaks, tables, strikethrough, code fences, inline HTML, autolinks, and list indentation — account for most formatting surprises when moving content between platforms.

• Why your VPN doesn't hide you from browser fingerprinting

  2026-06-02

  VPNs hide your IP. They don't hide your browser fingerprint — the dozens of low-entropy signals (screen, fonts, Canvas hash, audio context, timezone) that combine to identify you uniquely regardless of which IP you connect from. Here's what each tool actually defends against and what genuinely defeats fingerprinting.

• ROI vs CAGR: which number you actually want

  2026-05-31

  ROI is the headline finance number everyone quotes. CAGR is the one that survives scrutiny when investments have different durations. This article shows where ROI quietly misleads, what CAGR actually measures, when to use each, and three real-world traps the gap between them creates.

• Prompt versioning: keep your iterations honest

  2026-05-21

  Every team that ships LLM features eventually hits the same wall: a production prompt called v3-final-FIXED, no way to reproduce the eval from three weeks ago, and a slow drift toward worse output that nobody caught. This article lays out the minimum versioning discipline that prevents that — Git the prompts, couple them to evals, track cost-of-change, and chase clarity before cleverness.

• Base64: when to use it, when it ruins your life

  2026-05-20

  Base64 encodes binary as text — useful for email attachments, JWT payloads, and small inline assets. It's also routinely misused for fake encryption, oversized inline images, API payloads that should be multipart, and URL params past the 2KB limit. This article covers when Base64 is the right answer and when it's the source of your performance bug.

• EXIF metadata: what your photos quietly leak about you

  2026-05-20

  EXIF metadata embeds far more than GPS coordinates: device serial numbers, software-edit trails, sometimes the owner's name. This article walks through the four main categories of leak, where stripping fails, and which platforms preserve metadata when you upload (more than you'd guess).

• RPG damage formulas explained: subtractive vs divisive vs percent-resist

  2026-05-19

  Subtractive (D&D), divisive (Diablo), and percent-resist (MMO) — the three core damage formulas in RPG design, what each does to the player's experience, when each falls apart, and how to pick the right one for the game you're trying to build.

• Token counting for LLM cost management

  2026-05-19

  Most LLM cost surprises come from one mistake: assuming a token is roughly a word. It isn't. System prompts on every request, JSON whitespace, tool-use schemas, and vision tokens add up faster than developers expect. Five places where the bill actually lives, with real numbers.

• VAT for digital products: the 101 indie sellers actually need

  2026-05-19

  EU VAT on digital products: the €10k threshold, OSS vs IOSS, when a Merchant of Record makes sense, country quirks, and the rules that change when a B2B buyer enters their VAT number. The decisions an indie seller actually has to make, plus the math at each scale.

• Why browser-only tools matter for privacy (and why most "free online tools" sites aren't)

  2026-05-18

  Most "free online utility" sites quietly upload your input to a server, log it, and sometimes archive it for training data or resale. Browser-only tools don't have a server to upload to. This article defines the difference precisely and shows you how to verify it yourself.

• Citation styles cheat sheet: APA 7 vs MLA 9 vs Chicago vs Harvard (and when each is required)

  2026-05-18

  APA 7, MLA 9, Chicago, and Harvard are the four citation styles most likely to be required by an instructor or journal. Each has a personality, each has a domain where it's standard, and each has the specific rules that consistently trip up students. This article covers all four at the level you need to actually finish the assignment.

• Compound interest: three myths that cost real money

  2026-05-17

  Compound interest math is taught as a single magic formula. In practice three persistent myths cause real harm to savings projections. This article dismantles each, shows the corrected math, and walks through three Toolhub tools to validate your own numbers.

• JPG vs WebP vs AVIF: when to use each

  2026-05-16

  JPEG, WebP, and AVIF each win different fights — file size, compatibility, encode time, animation support. A practical guide to picking the right one without re-encoding your entire CDN.

• JSON: 5 common errors devs hit and how to fix them

  2026-05-16

  Trailing commas, single quotes, unquoted keys, comments, and unescaped characters cause the majority of "but it looks fine" JSON failures. Five concrete fixes, with code samples and a short RFC 8259 reference.