JSON Debugging Workflows for API Teams
A practical guide to formatting, validating, and diffing payloads before they hit production.
Read the guideGuides
Developer guides for payloads, patterns, tokens, encodings, and time
Each guide explains a topic that causes repeat incidents, then points at the tools that make the check quick. They are written for the moment a request is failing and you need to know which question to ask first.
Regex Patterns Developers Reuse Every Week
Email, slug, UUID, and password rules you can adapt instead of rewriting from scratch.
Read the guideJWT Claims, Expiration, and Safe Token Inspection
What to inspect in a JWT and what not to trust when you are debugging auth.
Read the guideHashes, UUIDs, and When Each One Fits
A concise decision guide for choosing identifiers and fingerprints in web systems.
Read the guideBase64, Hex, and Percent-Encoding Compared
Three encodings, three jobs. How to tell them apart, when each is correct, and why none of them protects data.
Read the guideUnix Time, Time Zones, and Expiry Bugs
Why tokens expire immediately, jobs run twice a year at the wrong hour, and two people see different dates for one record.
Read the guideBarcodes and QR Codes: A Practical Guide for Developers
Check digits, quiet zones, error correction, and the mistakes that prevent barcodes from scanning.
Read the guideXML Debugging for API Integrations
How to diagnose well-formedness errors, preserve mixed content through a reformat, and decide when to convert to JSON.
Read the guideEditorial approach
What these guides cover
JSON debugging
A repeatable process for validating syntax, comparing payload changes, and sharing safe examples during API incidents, including how to read parser error positions.
Authentication troubleshooting
The boundary between decoding a token and verifying one, which claims to check, and why a decoded payload is never evidence of authorisation.
Identifiers and hashing
Choosing between UUID versions, knowing what a digest proves, where MD5 is still acceptable, and why password storage needs a different class of function entirely.
Encodings and byte-level inspection
Telling Base64, hexadecimal, and percent-encoding apart, choosing the right one, and recognising the double-encoding that breaks redirects.
Time and expiry
Seconds versus milliseconds, UTC versus local rendering, clock skew at token boundaries, and the limits that still cause failures.
Regular expressions
Writing the rule in words first, anchoring whole-value validation, testing negative cases, and avoiding patterns that backtrack catastrophically.