ZeroUtil Blog
Long-form guides on the tools we build and the problems they solve. Every article stays focused on what runs in your browser — no cloud uploads, no accounts, no dark patterns.
Featured guides
How to Hear Voice Comms in a FACEIT Demo (CS2)
FACEIT records both teams' voice, but only into one of the two demos a match leaves you. Which file to open, the three commands FACEIT publishes, and how the slot bitmask works.
The Developer's JSON Guide: Everything Worth Knowing in 2026
The spec, the dialects that disagree, the numbers that quietly break, and the security advice that points at the wrong recursion. With the cluster map.
Online Privacy Guide: Threat Models for Browser-Based Work
Threat models worth naming, the thirty-second check that beats any privacy policy, and an honest list of which of our own tools upload your file.
All articles
What Importing a CS2 Crosshair Code Actually Changes
A crosshair share code writes 21 cl_crosshair variables, truncates a few, and never touches your scoped or observer crosshair. Why an imported crosshair can still look off.
SteamID64, STEAM_0 and SteamID3 Share One Account Number
STEAM_0:Y:Z, SteamID3 and SteamID64 all read from the same 32-bit account number. Where Valve's 64-bit layout comes from, and the one thing it cannot derive: a vanity URL.
Converting Mouse Sensitivity Between Games Is One Division
Every cross-game sensitivity converter runs on one division and seven numbers. Where those numbers come from, and four places the arithmetic stops matching how aim feels.
CS2 Crosshair Share Codes: What Those 25 Characters Hold
Twenty-five characters hold eighteen bytes, twenty-one console commands, and forty-one bits that carry nothing at all. Every field, decoded and measured.
How to Hear the Enemy Team's Voice in a CS2 Demo
Whether you can hear the enemy in a CS2 demo depends on what the server recorded, not on your console. Which demos carry it, and the mask for one side.
Why tsconfig.json Allows Comments and package.json Does Not
Both files end in .json. One accepts comments and trailing commas, the other throws. The difference is not the extension - it is which parser reads the file.
How to Compare a Design to Your Build, Pixel by Pixel
Overlay the mockup on the live page and let difference blending find the drift. The method, what each blend mode is for, and what the tools in this category actually cost.
The PDF Tools Everyone Should Know
A hands-on walkthrough of the PDF tasks you hit every week: compress, merge, split, convert, OCR, and sign, with steps you can follow right now.
Why You Can't Hear Voice in Your CS2 Demo (Fixes)
Can't hear voice comms in a CS2 or FACEIT demo? The real reasons - no voice in MM/Premier demos, unset tv_listen_voice_indices, commands resetting - and the fixes.
How to Hear Voice Comms in a CS2 Demo
Hear voice comms in any CS2 demo with tv_listen_voice_indices: which demos record voice, how the slot bitmask works, and how to aim it at one player or a whole side.
Hashing vs Encryption vs Encoding: What People Keep Confusing
Three transformations that all produce gibberish and solve different problems, with the measured cost of picking the wrong one for passwords.
Passkeys vs Passwords: How WebAuthn Actually Replaces the Password
How passkeys, FIDO2 and WebAuthn actually work, why origin scoping ends phishing, and the tradeoffs around recovery and syncing that still bite.
UUID vs ULID vs NanoID: Picking an ID Scheme in 2026
UUIDv4, UUIDv7, ULID and NanoID compared on sortability, index behaviour, size and computed collision odds, with a decision guide.
WCAG 2.2 Color Contrast: Hitting AA Without Guessing
The AA and AAA thresholds, the luminance maths behind them, the two pairs the formula scores identically and reads differently, and what APCA changes.
AES-GCM vs AES-CBC: Which Mode to Use and Why
What block cipher modes do, why GCM replaced CBC for new code, what nonce reuse actually leaks, and the NIST limits that make it a requirement rather than advice.
Flesch-Kincaid Explained: What the Score Means and How to Use It
How the two Flesch formulas are computed, why two syllable counters give different grades for the same text, and what Google actually does with readability.
How to Calculate a Sale Discount: Formulas, Examples, and Common Traps
Percent off, stacked discounts, coupon order, tax order, and why a 100 percent markup followed by 50 percent off leaves the shop at break-even.
The 90-Minute Sleep Cycle Rule: What It Actually Means
Where the 90-minute figure comes from, why the cycles are not interchangeable, what sleep inertia really costs, and how much a wearable can honestly tell you.
How US Federal Tax Brackets Work
Marginal versus effective rates, why a raise can never cost you money, and the 2026 thresholds worked through line by line.
How QR Codes Actually Work: A Practical Guide
What the squares mean, what error correction costs in millimetres, why upper case makes a smaller code, and the reasons a printed QR fails to scan.
Unix Timestamps and Timezones: The Confusion That Eats Your Week
What a Unix timestamp is, why the same date string parses two different ways, the two hours DST breaks every year, and what Temporal changes.
Compound Interest, Explained Like You Actually Have to Use It
The arithmetic behind compounding, where the Rule of 72 stops being accurate, and why the early years matter through contributions rather than magic.
Password Strength: What Length and Character Sets Buy You
Entropy done honestly, NIST's current 15-character floor, and measured GPU cracking speeds showing the hash function matters more than the extra characters.
Never Paste This Into a Random Online Tool
A working threat model for web tools at work: where a paste actually lands, which data is fine, and the thirty-second check that beats reading a privacy policy.
Base64 Explained: What It Is, Why It Exists, and When Not to Use It
What Base64 does to your bytes, the three variants that produce most decode failures, and the places it still earns its keep.
JWT Authentication Mistakes That Keep Appearing in Production
Algorithm confusion, weak secrets, missing expiry, and the library defaults that quietly changed underneath all the advice written about them.
Why Your PDF Tool Should Run in the Browser, Not the Cloud
What an upload actually exposes, which PDF operations a browser can genuinely perform, and which ones cannot run locally at all. Including ours.
Debugging Malformed JSON: A Field Guide
The parse error is better than its reputation. How to read what V8 says now, the five failure modes behind most broken payloads, and the two errors that hide their position.
Client-Side Image Compression: What Happens in the Browser
The real pipeline behind Canvas, OffscreenCanvas and WebCodecs, which formats a browser will and will not encode, and when you still need a server.
JSON vs JSON5 vs JSONC: What Each Parser Actually Accepts
Three formats, one file extension, and no agreement on what counts as valid. Measured against the real parsers, including two that disagree while being the same library.
Percentage Points vs Percent: 5 Mistakes That Change the Answer
A rate that falls 1% and a rate that falls 1 percentage point are ten times apart. That confusion, plus four more that quietly turn a correct number into a wrong one.
Social Media Character Limits 2026: What Each Platform Counts
Post limits for X, Bluesky, LinkedIn, Instagram, Threads, Mastodon, TikTok and Facebook in 2026, plus the four different units they use to count them.
What Counts as a Word? Why Counters Disagree on One Text
Paste one sentence into three word counters and get three numbers. Here is the algorithm behind each, which one your deadline actually uses, and where they break.
Get new tools by email
New tools and the occasional deep-dive, about once a month. No spam, no sharing your address, unsubscribe in one click.