13 tools, no uploads
Free online developer tools. Paste a token; it stays local.
13 everyday developer utilities — formatting, converting, decoding, hashing and diffing — each documented down to the spec it implements. They run in this browser tab, so the awkward question of what a website does with the token you just pasted does not arise.
- JSON FormatterFormat, validate and minify JSON
- JSON ↔ CSVConvert JSON to CSV and back
- JSON ↔ YAMLConvert JSON to YAML and back
- Base64 Encoder & DecoderEncode and decode base64 text
- URL EncodePercent-encode and decode URLs
- JWT DecoderDecode a JSON Web Token's claims
- UUID GeneratorGenerate UUID v4 and v7
- SHA HashSHA-256, SHA-384 and SHA-512 of text
- File ChecksumVerify a download against its published hash
- HMAC GeneratorSign and verify with HMAC-SHA
- Regex TesterTest a regular expression safely
- Timestamp ConverterUnix epoch to a human date, and back
- Text DiffCompare two texts line by line
On your device
Why these tools run in the page
Developer tools are where secrets get pasted: an access token into a JWT decoder, a webhook signing key into an HMAC generator, a production .env into a diff. On a server-side tool that data reaches someone else's machine, where it can be logged by the application, by a proxy, or by an error tracker that captured the request body — and a leaked bearer token is valid until it expires or is rotated, not until you close the tab. Here the work happens in JavaScript already loaded in the page: JSON is parsed by the browser's own parser, digests come from WebCrypto's SubtleCrypto, random UUIDs from crypto.getRandomValues, regular expressions run inside a Web Worker with a timeout, and files are read from disk with the File API rather than uploaded. Open your browser's network inspector and use any tool on this page — no request carries what you typed. The same property is why every tool keeps working with the network disconnected.
Questions
Developer tools here, answered
Is anything I paste into these tools sent to a server?
No. Every tool computes its result in this browser tab. You can verify it rather than take our word for it: open the network inspector, run a conversion, and watch that no request contains your input.
Is it safe to paste a real JWT or signing secret?
Safer than any tool that transmits it, because it never leaves the tab. It is still a live credential though — prefer an expired token or a test key where you can, and rotate anything you have previously pasted into tools whose behaviour you have not checked.
Do the tools work offline?
Yes. Once a page has loaded it needs no network, because there is no backend to call. That is a consequence of the design rather than an added feature.
Which developer tools are available?
JSON formatting and validation, JSON to CSV, JSON to YAML, Base64, URL encoding, JWT decoding, UUID v4 and v7, SHA-2 hashing, file checksums, HMAC, a regex tester, Unix timestamp conversion and a text diff — each with its own page documenting the relevant spec.
13 developer tools available, all running in the browser.