DAILY NEWS

Stay Ahead, Stay Informed – Every Day

Advertisement
When (and when not) to inline images as Base64



Base64 image data URIs are one of those web techniques that look like a magic shortcut the first time you use them.

Instead of referencing an external file:

src=”/logo.png” alt=”Logo”>

Enter fullscreen mode

Exit fullscreen mode

you can put the image bytes directly in the document as text:

src=”data:image/png;base64,iVBORw0KGgoAAAANSUhEUg…” alt=”Logo”>

Enter fullscreen mode

Exit fullscreen mode

That can be useful. It can also make a page slower, harder to cache, and more annoying to maintain.

Here is the practical rule: inline images as Base64 when self-containment matters more than caching. Keep normal image files when the browser should be able to cache, resize, lazy-load, or optimize them independently.

What a Base64 image actually is

An image file is binary data. Base64 rewrites that binary data as plain text using a limited character set. To make the browser treat the text as an image, you wrap it in a data URI:

data:image/png;base64,iVBORw0KGgoAAAANSUhEUg…

Enter fullscreen mode

Exit fullscreen mode

The first part tells the browser the MIME type. The second part tells it the data is Base64 encoded. The long tail is the image itself.

Base64 is not compression. It is not encryption. It is just a text representation of the same bytes.

When inlining an image is worth it

1. Tiny icons and UI assets

For very small images, removing an extra HTTP request can be worth the extra bytes. This is especially true for small icons, logos, placeholders, simple UI sprites, or tiny transparent PNGs.

Modern HTTP/2 and HTTP/3 make extra requests cheaper than they used to be, so this is not an automatic win. But for a one-off tiny asset inside a small page or widget, a data URI can still be a clean choice.

2. Single-file deliverables

Sometimes the point is not raw page speed. Sometimes you need one file that carries everything with it:

an HTML report
an email template
a CodePen or demo snippet
a CMS block where you cannot upload assets
a test fixture that should not depend on external hosting

In those cases, Base64 is useful because the image travels with the HTML, CSS, JSON, or JavaScript.

3. Prototypes and throwaway snippets

If you are testing a layout, writing a bug reproduction, or pasting a minimal example into a ticket, a data URI can save time. You do not need to set up static hosting just to show one image.

4. Local-only conversion workflows

If the image is private, it is nice to avoid uploading it to a random converter. Browser APIs can generate a Base64 data URI locally, so the file never leaves your device.

When you should not inline the image

1. Large photos and hero images

Base64 usually makes the encoded data about 33% larger than the original binary file. That is because Base64 stores every 3 bytes as 4 text characters.

For a large JPG, PNG, or WebP, that extra size is not a rounding error. Keep big images as normal files.

2. Images reused across pages

An external image can be cached once and reused across page views. An inlined image is bundled into every document or stylesheet that contains it.

If the same logo appears on 20 pages, inlining it 20 times is usually worse than letting the browser cache one file.

3. Responsive images

Normal image files can use srcset, sizes, lazy loading, CDN transforms, format negotiation, and caching headers.

src=”/hero-800.webp”
srcset=”/hero-400.webp 400w, /hero-800.webp 800w, /hero-1600.webp 1600w”
sizes=”100vw”
loading=”lazy”
alt=”Product screenshot”
>

Enter fullscreen mode

Exit fullscreen mode

That is much harder to preserve when the image is baked into a string.

4. Anything you expect humans to edit

Base64 strings are unpleasant to review in Git diffs, easy to truncate by accident, and noisy inside templates. If designers, marketers, or other engineers need to update the image regularly, use a normal asset file.

How to generate a Base64 data URI in the browser

The simplest browser-native path is FileReader.readAsDataURL().

The result will look like this:

data:image/png;base64,iVBORw0KGgoAAAANSUhEUg…

Enter fullscreen mode

Exit fullscreen mode

You can use that string directly in HTML:

src=”data:image/png;base64,iVBORw0KGgoAAAANSUhEUg…” alt=”Logo”>

Enter fullscreen mode

Exit fullscreen mode

or in CSS:

.logo {
background-image: url(“data:image/png;base64,iVBORw0KGgoAAAANSUhEUg…”);
}

Enter fullscreen mode

Exit fullscreen mode

A simple checklist

Inline the image if:

it is small
it is not reused across many pages
self-contained delivery matters
you do not need responsive image behavior
the string will not make your source files painful to maintain

Keep it as a normal file if:

it is a photo or large graphic
it should be cached separately
it appears on many pages
it needs srcset, lazy loading, CDN resizing, or image optimization
non-developers need to replace it often

Tiny tool note

I built a small free tool for this workflow: PNG to Base64 converter. It runs entirely in the browser with FileReader, so the PNG is not uploaded, and it gives you the raw Base64 string plus ready-to-paste HTML and CSS snippets.

There is also a general image to Base64 converter for JPG, SVG, WebP, GIF, and other image formats.

Use Base64 as a packaging tool, not a default image strategy. When the image is tiny or the deliverable must be self-contained, it can be perfect. When performance, caching, and responsive delivery matter, boring old image files are still the better answer.



Source link

I got tired of rebuilding my diagnostic USB on every machine, so I fixed it once



very IT tech I know has the same ritual. New machine lands on the bench, or you’re at a client site, and before you can actually fix anything you spend twenty minutes assembling the same handful of tools. Download this. Extract that. Oh, this one wants .NET. Oh, this box has no internet. Oh, the client’s policy blocks installs.

I did that dance for years. Then I got tired of it and built a portable kit that lives on one USB stick and installs nothing. This post is mostly about what belongs on that stick — because whether you build your own or grab a packaged one, the thinking is the same, and I wish someone had just laid it out for me years ago.

Why “no install” is the whole game

The constraint that shapes everything is this: the machine you’re diagnosing is often the machine you can’t install software on.

Locked-down corporate profiles block installers.A dying machine can’t afford the disk writes or the reboot an installer wants.You don’t want to leave residue on a client’s PC that isn’t yours.Half the time there’s no internet to download anything anyway.

So the rule I settled on: everything runs from the USB, writes nothing to the host, and leaves no trace when I pull the drive. Portable executables and scripts only. If a tool needs to be installed, it doesn’t make the cut.

That one rule kills a lot of otherwise-good tools and forces you toward the portable ecosystem. It’s worth it.

What actually goes on the stick

I think about a diagnostic USB in three buckets. Same three problems, every single call:

System health — “is this machine actually okay?”

Before anything else, you want a fast read on the hardware and OS state:

Disk health — SMART status, because a failing drive explains a lot of “random” symptoms. Catch it before you spend an hour chasing software ghosts.Memory + CPU + temps — a quick snapshot so you know if you’re looking at a resource problem vs. a config problem.Boot and startup bloat — what’s loading at login and dragging the thing down.Windows integrity — a quick way to check for corruption (sfc /scannow and DISM are built in and free, but knowing when to reach for them is the skill).

The goal of this bucket is a 60-second answer to “hardware problem or software problem?” — because that split decides everything you do next.

Network diagnostics — “why won’t this thing connect?”

Half of all tickets are really network tickets wearing a costume. Portable tools I want on hand:

Adapter + IP config at a glance — faster than typing ipconfig /all and squinting.DNS resolution testing — because “the internet is down” is usually “DNS is down.”Connectivity + latency — ping, traceroute, port checks, packaged so you’re not building command lines by hand under pressure.Wi-Fi signal / channel info — for the “it’s slow in this room” calls that are really RF problems.

Built-in Windows commands cover a surprising amount of this (ipconfig, nslookup, ping, tracert, netsh wlan show). The value of a kit is having them wrapped so you’re reading answers, not typing syntax while the client watches.

Profile & user management — “the account is the problem”

This is the bucket people forget until they’re stuck. So much Windows weirdness is really a broken or bloated user profile:

Corrupt profile causing login loops or vanished settings.Profile bloat quietly eating the disk.Needing to move or reset a user’s environment without nuking their data.

Having a portable way to inspect and manage profiles turns a “reimage the whole machine” afternoon into a ten-minute fix more often than you’d think.

Put it on the right USB

Small thing that matters: use a decent USB 3.0+ drive. A slow stick makes portable tools feel broken when they’re just I/O-starved. Label it. Keep a second copy — the day your only diagnostic USB dies is always the day you need it most.

The honest part

You can absolutely build this yourself. Everything I described is assemblable from free portable tools plus commands already baked into Windows. If you enjoy curating your own kit, do that — you’ll learn more.

I got tired of maintaining mine and packaged it up so I stop rebuilding it every time I switch machines: three tools (system health, network diagnostics, profile manager) on one USB, Windows 11, no install, nothing left behind. If you’d rather not assemble your own, it’s here: Portable Windows IT Toolkit ($34, one-time, instant download).

Either way — build it or buy it — the lesson is the same one that took me too long to learn: decide your kit once, standardize on “no install,” and stop rebuilding it on every machine. Your future self, standing at a locked-down PC with no internet, will thank you.



Source link

Part 2 Building an Authentication System from Scratch – Backend Setup


User Registration & Secure Password Hashing with bcrypt

In the previous article, we built the backend foundation by setting up Express.js, PostgreSQL, environment variables, and a clean layered architecture.

With the backend ready, it’s time to implement the first authentication feature—User Registration.

Although registration appears straightforward, it involves much more than simply storing user details in a database. A secure registration system must validate user input, prevent duplicate accounts, protect passwords, and ensure that sensitive information is never exposed.

In this article, we’ll build the complete registration workflow while following security best practices.

The registration process follows a layered architecture, where each layer has a single responsibility.

Client


Routes


Controller


Service


Repository


PostgreSQL

Enter fullscreen mode

Exit fullscreen mode

The overall workflow is:

The client submits the registration form.
The controller receives the request.
The service validates the data.
The repository checks whether the email already exists.
The password is securely hashed using bcrypt.
The user is stored in PostgreSQL.
A success response is returned to the client.

Instead of placing all the registration logic inside the controller, I divided the implementation into three layers.

Controller

Responsible only for:

Receiving the HTTP request
Calling the service layer
Returning the HTTP response

The controller should never contain business logic or database queries.

Service

The service contains the application’s business logic.

For registration, it is responsible for:

Validating the request
Checking whether the email already exists
Hashing the password
Calling the repository to save the user

This layer acts as the brain of the application.

Repository

The repository communicates directly with PostgreSQL.

Its responsibilities include:

Checking if a user already exists
Creating a new user
Executing SQL queries

Keeping SQL isolated inside repositories makes the application easier to maintain and test.

The controller receives the registration request and forwards the data to the service layer.

// Register Controller Screenshot Here

Enter fullscreen mode

Exit fullscreen mode

The controller itself performs very little work.

Its responsibility is simply to:

Extract the request body
Call the service
Return either a success or an error response

This keeps controllers lightweight and easy to understand.

The service contains the actual registration workflow.

// Register Service Screenshot Here

Enter fullscreen mode

Exit fullscreen mode

The registration service performs the following steps:

Check whether the email already exists.
Generate a secure password hash.
Create the user in PostgreSQL.
Return the newly created user.

Because all business rules live inside the service layer, future changes become much easier.

For example, adding email verification later would require changes only inside the service, without affecting controllers or repositories.

The repository is responsible only for database communication.

// Repository Screenshot Here

Enter fullscreen mode

Exit fullscreen mode

Typical repository functions include:

findByEmail()
createUser()

Keeping SQL queries isolated improves readability and keeps the service layer database-agnostic.

One of the biggest mistakes an application can make is storing passwords in plain text.

Imagine a database leak.

If passwords are stored as plain text, every user’s credentials become immediately visible.

Instead, passwords should always be transformed into a secure one-way hash before being stored.

This is exactly why we use bcrypt.

bcrypt is one of the most trusted password hashing libraries available for Node.js.

Unlike encryption, hashing is a one-way operation.

This means:

The original password cannot be recovered.
Even the application itself cannot view the user’s password.
Only password verification is possible.

When a user registers, bcrypt performs several operations internally.

Password


Generate Random Salt


Password + Salt


Multiple Hashing Rounds


Store Hash in Database

Enter fullscreen mode

Exit fullscreen mode

Each password receives its own randomly generated salt before hashing.

Because of this:

Two users with the same password will have completely different hashes.
Rainbow table attacks become ineffective.
Brute-force attacks become significantly slower due to bcrypt’s configurable cost factor.

During login, the user enters their password as plain text.

bcrypt then:

Reads the stored hash.
Extracts the embedded salt.
Hashes the entered password using the same salt.
Compares the generated hash with the stored hash.

If both hashes match, the user is successfully authenticated.

const isMatch = await bcrypt.compare(
enteredPassword,
storedHash
);

Enter fullscreen mode

Exit fullscreen mode

One of bcrypt’s biggest advantages is that developers never need to manually manage salts or compare hashes—the library handles the entire verification process securely.

Using bcrypt provides several important security advantages.

✅ Passwords are never stored in plain text.

✅ Every password uses a unique random salt.

✅ Identical passwords generate different hashes.

✅ Brute-force attacks become significantly slower.

✅ Rainbow table attacks are mitigated.

These features make bcrypt one of the industry standards for password protection.

Once the backend implementation was complete, I verified the registration API using Postman.

Request

POST /api/auth/register

Enter fullscreen mode

Exit fullscreen mode

{
“username”: “Sriya”,
“email”: “sriya@gmail.com”,
“password”: “Password123”
}

Enter fullscreen mode

Exit fullscreen mode

Response

{
“success”: true,
“user”: {
“id”: 1,
“username”: “Sriya”,
“email”: “sriya@gmail.com”
}
}

Enter fullscreen mode

Exit fullscreen mode

Notice that the response never includes the password or its hash.

Only non-sensitive user information is returned to the client.

Now that users can securely register and their passwords are safely stored, the next step is allowing them to authenticate.

In the next article, we’ll build the Login Flow, where we’ll:

Verify user credentials
Compare passwords using bcrypt
Generate JWT Access Tokens
Generate Refresh Tokens
Understand how JWT authentication works internally



Source link