Developer Tools

Sixteen tools, and they share a property that makes this the category where running them locally matters most: the input is usually something you would not paste into a stranger's website. An API response with a bearer token in it. A production connection string. A JWT belonging to a real customer. An internal hostname.

Everything here executes in your browser's own JavaScript runtime. There is no request body for anyone to log, no proxy to place trust in, and nothing retained once you close the tab. That is not a policy statement — it is a consequence of the code being client-side, and you can confirm it with the network panel open.

JSON: format, validate, minify, inspect

JSON Formatter parses, validates and re-indents. The parse step is the part that earns its keep: JavaScript's JSON.parse reports a syntax error but describes it cryptically, and seeing the offending position turns a five-minute hunt into a five-second fix. Trailing commas, single quotes, unquoted keys and comments are all invalid JSON however natural they look inside a JavaScript object literal.

The tool also reports structure statistics — nesting depth, and how many objects, arrays, strings, numbers, booleans and nulls the document contains — which is a quick way to get the shape of an unfamiliar payload before writing code against it.

JSON Minifier strips whitespace for transmission. It can sort object keys recursively as well, which sounds cosmetic and is not: two responses holding the same data in a different key order are byte-different, and sorted keys mean a diff shows only the values that actually changed.

Encoding is not encryption

This is the commonest misunderstanding in the whole category, so it is worth stating without hedging.

Base64 Encoder / Decoder turns bytes into 64 printable ASCII characters so binary data can travel inside JSON, an HTTP header or a URL. It is reversible by anyone, instantly, with no key. If you can decode it, so can everybody else. Base64 hides nothing; it only changes the representation.

URL Encoder / Decoder percent-encodes the characters that would otherwise be read as URL structure — a space becomes %20, and reserved characters such as &, = and # are escaped so they survive as data rather than as delimiters. It can encode a whole URL while leaving its structure intact, which is the mode you want when only the query values need escaping. Decoding treats + as a space, following the form-encoding convention, and falls back to the raw text on a stray percent sign instead of throwing.

Neither protects a secret. Encryption does that, and there is deliberately no encryption tool here: a browser-side tool that asked you for a key would be worse than no tool at all.

Hashing, honestly

Hash Generator computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests. The SHA family comes from the browser's own audited Web Crypto implementation; MD5, which Web Crypto does not offer, is a direct implementation of RFC 1321.

A hash is one-way. It has no key and no inverse, so it is not encryption and nothing can be recovered from it. What it gives you is a fingerprint: the same input always yields the same digest, and changing one bit yields a completely different one. That makes it useful for verifying that a download arrived intact and for identifying a file without storing it.

MD5 and SHA-1 are included because a great deal of existing infrastructure still publishes checksums in those formats — download mirrors, package registries, and git, which uses SHA-1 for every object identifier it creates. Both are broken for security purposes, and the tool shows a warning whenever either is selected.

Do not use any of them to store passwords. They are built to be fast, which lets an attacker test billions of guesses a second. Credentials need a slow, salted, memory-hard function — Argon2, bcrypt or scrypt.

Reading a JWT without trusting it

JWT Decoder splits a token into its three Base64URL sections and shows the header and the claims. A leading Bearer prefix is stripped for you.

It does not verify the signature, and it says so on the page rather than leaving you to assume. Verification needs the issuer's secret or public key, which your browser does not have. Everything the decoder displays is therefore untrusted input: anyone can mint a token whose payload claims to be an administrator, and it will decode beautifully. The signature is shown for inspection and never checked.

What the tool adds is the time arithmetic, because that is what most people paste a token here to find out. exp, nbf and iat are Unix timestamps, and the decoder compares them against your current clock to tell you whether the token has expired, is not valid yet, or carries no expiry at all — a common and genuinely risky configuration.

Identifiers

UUID Generator produces RFC 4122 version 4 identifiers with 122 bits of randomness, via crypto.randomUUID(). They are the safe default for database keys and request IDs precisely because they are unpredictable and need no coordination between machines.

NanoID Generator builds shorter identifiers from the real NanoID default alphabet — 64 URL-safe symbols — at a length you choose, 21 by default. Each character is drawn with rejection sampling from the cryptographic RNG, so there is no modulo bias even though 64 does not divide a 32-bit word evenly. It also shows the collision arithmetic for your chosen size and alphabet, because “how many can I generate before one repeats” is the question that should decide the length.

Both sit on crypto.getRandomValues, the same entropy source that generates TLS session keys. Math.random() is never used anywhere in this codebase: it is a fast pseudorandom generator whose internal state can be recovered from a handful of outputs.

Time

Timestamp Converter moves between Unix time and human-readable dates in both directions, inferring the unit from magnitude rather than asking — ten digits is seconds, thirteen is milliseconds. That inference prevents the single most common date bug there is. UTC and local time are always shown together, negative values are correctly treated as dates before 1970, and values outside the range JavaScript can represent are rejected with an explanation instead of rendering as nonsense.

Cron Parser explains a five-field expression in plain English and lists the next run times. Field ranges are validated — minutes 0–59, hours 0–23, day of month 1–31, months 1–12, day of week 0–7 with both 0 and 7 meaning Sunday — month and day names are accepted, and the day-of-month and day-of-week interaction follows standard cron semantics: when both fields are restricted, matching either one is enough. A schedule that fires on the wrong day is a much worse bug than one that never fires, and that rule is where most of them come from.

Formatting and shrinking markup

HTML Formatter re-indents markup by tokenising it rather than counting angle brackets, so nesting comes out right and void elements such as img and br are not given closing tags they never had. HTML Minifier collapses whitespace and removes comments — except conditional comments, which some legacy build pipelines still depend on.

CSS Minifier removes comments and whitespace that cannot matter. JavaScript Minifier is deliberately conservative: it strips comments and collapses whitespace that is provably insignificant, tells a regex literal from a division operator by looking at what precedes the /, and preserves /*! licence banners. It does not rename identifiers, reorder expressions or eliminate dead code, so the output is semantically identical to the input rather than merely usually identical. For a production bundle use a minifier with a real parser — Terser, esbuild or SWC. This one is for the case where you need a smaller snippet now and cannot afford a subtle break.

Comparing and matching

Text Diff compares two texts line by line with a longest-common-subsequence algorithm, marking additions, deletions and unchanged lines with their original line numbers. It is line-level rather than character-level, so an edited word appears as one deleted line and one added line. Very large inputs are refused rather than attempted: the LCS table is quadratic in the two lengths, and past roughly four million cells it would freeze the tab.

Regex Tester runs a pattern against sample text live, with flags, match highlighting and the captured groups for each match. Because it executes locally, testing against real log lines or real customer records carries no risk of them going anywhere.

Why all of this still runs on your machine

Format, minify, hash, decode, generate: none of it needs a server, and all of it is faster without a network round trip. If you want proof rather than a promise, open the network panel, clear it, and use any tool in this category — you will see no request carrying your input.