Developer glossary

What the terms behind the tools actually mean — written for developers, with real examples and the mistakes people commonly make. Each entry links to the tool that lets you try the concept on your own data, entirely in your browser.

Certificates & PKI

Term	Expanded form	Definition
PEM	Privacy-Enhanced Mail	PEM is a text format that wraps Base64-encoded binary data, most often certificates and keys, between "BEGIN" and "END" marker lines so it can be copied, emailed and stored as plain text. RFC 7468 describes how it is used today.
SAN	Subject Alternative Name	The Subject Alternative Name is an X.509 certificate extension that lists every identity the certificate is valid for, such as DNS names, IP addresses, email addresses and URIs. Modern clients check the hostname against it and ignore the common name.
X.509 certificate	No expanded form	An X.509 certificate is a digitally signed document that binds a public key to an identity, such as a website's domain name. It is the foundation of HTTPS and most other public-key infrastructure, and the Internet profile is defined in RFC 5280.

Tokens & encoding

Term	Expanded form	Definition
Base64	No expanded form	Base64 is an encoding that represents any sequence of bytes using 64 printable text characters, so binary data can travel through systems built for text such as email, JSON, URLs and HTTP headers. It is not encryption, and it makes data about a third larger.
Base64URL	No expanded form	Base64URL is a variant of Base64 that swaps the characters "+" and "/" for "-" and "_" and usually drops the "=" padding, so encoded bytes can sit safely inside URLs, filenames and JWTs. It is defined in RFC 4648, section 5.
Encoding vs encryption	No expanded form	Encoding changes how data is represented so it survives a particular channel, and anyone can reverse it. Encryption hides data so that only someone holding the key can read it. Mistaking one for the other is a common source of leaked secrets.
JWT	JSON Web Token	A JSON Web Token is a compact, URL-safe string that carries a set of claims as JSON, usually signed so the receiver can detect tampering. It is defined in RFC 7519 and is widely used for API and session authentication.

Hashing & identifiers

Term	Expanded form	Definition
SHA-256	Secure Hash Algorithm, 256-bit	SHA-256 is a cryptographic hash function from the SHA-2 family that turns any input into a fixed 256-bit digest, usually written as 64 hexadecimal characters. The same input always gives the same output, and it is infeasible to work backwards from the digest.
UUID	Universally Unique Identifier	A UUID is a 128-bit identifier written as 32 hexadecimal digits in an 8-4-4-4-12 pattern, designed so that values can be generated independently anywhere with a negligible chance of collision. The current specification is RFC 9562.

Time

Term	Expanded form	Definition
Cron expression	No expanded form	A cron expression is a compact schedule of five space-separated fields (minute, hour, day of month, month and day of week) that tells the cron daemon, and many schedulers modeled on it, when to run a job. Different systems add fields or change the rules, so the same text can mean different things.
ISO 8601 timestamp	No expanded form	ISO 8601 is the international standard for writing dates and times unambiguously, and RFC 3339 is the strict internet profile of it, such as 2026-09-18T14:30:00Z. Both put the largest unit first, so the text sorts in chronological order.
Unix timestamp	No expanded form	A Unix timestamp is the number of seconds that have passed since 00:00:00 UTC on 1 January 1970, the Unix epoch. It is a single number that identifies a moment in time regardless of time zone, which makes it easy to store, sort and compare.

Data & text

Term	Expanded form	Definition
JSON	JavaScript Object Notation	JSON is a lightweight, language-independent text format for structured data made of objects, arrays, strings, numbers, booleans and null. It is specified by RFC 8259 and ECMA-404 and is the default data format of web APIs.
Regex capture group	No expanded form	A capture group is a part of a regular expression wrapped in parentheses that both groups its contents and remembers the text it matched, so you can extract it, reuse it later in the pattern with a backreference, or refer to it in a replacement.

Web & URLs

Term	Expanded form	Definition
HTML entity	No expanded form	An HTML entity, or character reference, is text like &, — or — that stands for a single character in HTML. It lets you write characters that would otherwise be read as markup, such as < and &, and characters that are hard to type or see.
Percent-encoding	No expanded form	Percent-encoding, also called URL encoding, writes a character as a percent sign followed by the hexadecimal value of each of its UTF-8 bytes, such as %20 for a space, so text can be carried safely inside a URL. It is defined in RFC 3986.
Query string	No expanded form	The query string is the part of a URL after the "?" and before any "#", made of key=value pairs joined by "&", used to pass parameters to a page or API. Its format is a convention layered on top of the URL standard, not one strict specification.

Unix & systems

Term	Expanded form	Definition
Unix file permissions	No expanded form	Unix file permissions are the read, write and execute bits that decide what a file's owner, its group and everyone else may do with it. They are written as three octal digits like 755 or as the rwxr-xr-x string that ls -l prints, and set with chmod.