Developer Tools
Format, encode, decode, hash and debug — safely, on your machine.
Coming soon
The first tools in this category are in development. In the meantime, browse everything that is already live.
About Developer Tools
A working developer touches the same handful of utilities dozens of times a week: formatting a JSON blob to find the one malformed field, decoding a token to check its claims, generating a UUID, testing a regular expression against real input.
These tools cover that daily set — JSON formatting and validation, Base64 and URL encoding, JWT decoding, hash generation, UUID generation, regular expression testing, code formatting and minification, and conversion between JSON, CSV, YAML and XML.
For this category in particular, local processing is not a nice-to-have. Developers routinely paste material into these tools that should never leave a machine: API responses containing customer records, JWTs carrying live session claims, connection strings, config files with credentials in them. Any online formatter that posts your input to a server is a data exfiltration risk, and plenty of them do exactly that.
Everything here runs client-side using the browser's native APIs where possible — the Web Crypto API for hashing, the platform's own parsers for structured data. You can verify this yourself: open your browser's network tab, use any tool on this site, and watch that no request carries your input.
The risk in online formatters
The material developers paste into utility sites is often exactly the material a security policy prohibits sharing. A production API response with real customer names and addresses. A JWT that is still valid and would let anyone holding it act as that user. A database connection string, complete with credentials, pasted in to check its encoding.
A server-side tool receives all of it, and what happens next depends on logging practices you cannot inspect. Even a well-intentioned operator writes request bodies to logs, ships them to an error tracker, and retains backups. This is not hypothetical: pasted secrets have been recovered from the caches and logs of public formatting services more than once.
Verifying a tool runs locally
Do not take a privacy claim on trust — check it, on any site including this one. Open your browser's developer tools, switch to the Network tab, clear it, then use the tool. If your input is being sent anywhere, a request appears with your data in its payload. If nothing appears, the processing happened locally.
A stronger check: load the page, disconnect from the network entirely, then use the tool. Anything that still works is running on your machine, because there is nowhere else for it to run. Every tool on this site passes that test once the page has loaded.
Frequently asked questions
Is it safe to paste a production JWT or API response here?
Safer than any server-side alternative, because nothing is transmitted — decoding happens entirely in your browser and you can verify that in the Network tab. That said, apply your own judgement and your employer's policy. A live token is a live credential regardless of what a website promises, and rotating anything genuinely sensitive after debugging is good practice.
Which hash algorithms are supported, and are they secure?
MD5, SHA-1, SHA-256 and SHA-512, computed with the browser's native Web Crypto API. MD5 and SHA-1 are cryptographically broken and must not be used for passwords, signatures or anything security-related — they remain useful only for checksums and matching against legacy systems. Use SHA-256 or stronger for anything that matters.
Does the JWT decoder verify the token's signature?
No. It decodes the header and payload so you can read the claims, expiry and issuer. Verifying a signature requires the signing key, which belongs on your server and should never be pasted into a web page. A decoded token tells you what it claims, not whether those claims are authentic.
Can I use these tools offline?
Yes, once the page has loaded. All the processing logic runs locally, so you can disconnect and keep working in that tab. This is also the simplest way to confirm that nothing is being sent anywhere.