Developer Tools
JSON, Base64, regex, and coding utilities — 21 free tools available. No signup required.
Formatters, encoders, decoders, generators and network lookups: the utilities you reach for mid-task and want to finish in five seconds without creating an account.
Everything that can run locally does. JSON, Base64, JWT, hashing, regex, diffing, CSV and SQL formatting all execute in your browser, which matters more than convenience: pasting a production JWT, an API response or a config file into a server-side tool means handing that data to someone else. These do not have a server to send it to.
The exceptions are the lookups that genuinely require a network (DNS records, SSL connectivity, MAC vendor resolution), and each of those pages states exactly what it queries and what it cannot determine.
Where to start
- JSON Formatter & Validator — Format, validate and minify, with the parse error located rather than just reported.
- JWT Token Decoder & Inspector — Decodes header and payload locally, so the token never leaves your browser, which matters for a real one.
- Regex Tester — Live matching with capture groups, so you can see what a pattern actually captures.
- Diff Checker & Text Compare — Line-by-line comparison without uploading either file anywhere.
- Cron Expression Generator — Builds an expression and translates it back to English, which catches the classic day-of-week mistakes.
All developer tools (21)
JSON Formatter & Validator
Format and validate JSON in your browser, nothing uploaded. Covers the six value types, why trailing commas fail…
Base64 Encoder & Decoder
A Base64 encoder decoder for text, covering the URL-safe alphabet, padding and the 33% size overhead, and why…
URL Encoder & Decoder
A URL encoder decoder with a full percent-encoding reference and the encodeURI vs encodeURIComponent difference…
Regex Tester
Test regular expressions live against the JavaScript engine, with a flavor comparison for Python, Java, .NET and…
Password Generator
A password generator with a passphrase mode: six random words is 77.5 bits, the same as a 12-character password.
Diff Checker & Text Compare
Compare two texts side by side in your browser, nothing uploaded. Explains unified diff format and why CRLF line…
CSV to JSON Converter
Convert CSV to JSON in your browser, with control over type inference so leading zeros survive.
Markdown to HTML Converter
Convert markdown to HTML in your browser. Type on the left, watch the preview update, then copy the HTML in one…
HEX to RGB Color Converter
A HEX to RGB converter that also gives RGBA, HSL and CMYK, with a live picker, contrast check, and the 8-digit hex…
Cryptographic Hash Generator
Generate secure cryptographic checksums and hashes (SHA-256, SHA-512, SHA-384, SHA-1) directly in your browser…
JWT Token Decoder & Inspector
A JWT decoder that also verifies the signature in your browser: HS256 with a secret, RS256 and ES256 with a public…
Cron Expression Generator
A cron generator with plain-English output, common recipes, and the field-count differences for Quartz, Spring and…
SQL Formatter & Beautifier
Format SQL for readable diffs and code review, with an identifier-quoting table for PostgreSQL, MySQL, T-SQL…
UUID / GUID v4 Generator
A UUID generator for bulk, cryptographically secure Version 4 UUIDs and GUIDs, with uppercase and hyphen-removal…
Unix Epoch Timestamp Converter
Convert Unix epoch timestamps (seconds & milliseconds) to human-readable UTC and local dates, or convert any date…
HTML Entity Encoder / Decoder
Encode and decode HTML entities with a full reference table, plus why entity encoding alone is not safe inside…
CSS Gradient Generator
Build CSS linear and radial gradients with custom color stops, angles and presets, with 1-click CSS export.
IP Subnet Mask & CIDR Calculator
A subnet mask calculator for IPv4: CIDR prefix, network and broadcast address, usable host range, wildcard mask…
Linux Chmod Permissions Calculator
Calculate Linux/Unix file permissions with interactive read, write, and execute checkboxes.
WCAG 2.2 Color Contrast Ratio Calculator
A color contrast checker for text and background: the WCAG 2.2 ratio with AA and AAA pass/fail for normal and…
Binary, Decimal & Hex Converter
A binary decimal hex converter (and octal) with arbitrary precision, so 64-bit values stay exact.
Base64 is encoding, not encryption
This is the single most consequential misunderstanding in this category. Base64 converts binary data into a restricted character set so it can travel through systems that expect text. It is fully reversible by anyone, requires no key, and provides no confidentiality whatsoever. A credential stored Base64-encoded is a credential stored in plain text with an extra step. The same applies to a JWT: the header and payload are Base64url-encoded rather than encrypted, and anyone holding the token can read every claim in it. The signature proves the token was not altered; it does not hide the contents.
Hashing and encryption solve different problems
A hash is one-way: it produces a fixed-length digest that cannot be reversed to recover the input. That is what makes it right for integrity checking and wrong for anything you need to read back. It also means MD5 and SHA-1, both available here, should be treated as checksums for detecting accidental corruption rather than as security primitives, since practical collision attacks exist against both. For anything security-relevant, SHA-256 is the floor, and for password storage neither a plain hash nor a salted fast hash is appropriate; that needs a deliberately slow function such as bcrypt or Argon2.
What a browser cannot tell you about a network
Several tools in this category are limited by what a web page is permitted to observe, and each says so rather than filling the gap with plausible output. A browser cannot read a remote server's TLS certificate — no API exposes it — so our SSL tool reports whether a handshake completes and defers issuer, expiry and protocol detail to a server-side scanner. A MAC address carries no location information, so a vendor lookup returns a registrant and nothing more. Being explicit about the boundary is more useful than a confident answer that was never measured.
Regex: greedy, lazy, and the escaping that bites
Two patterns account for most regex frustration. Quantifiers are greedy by default, so `.*` consumes as much as it can and backtracks, matching from the first opening tag to the last closing one rather than the nearest. Appending `?` makes it lazy and usually fixes it. The second is character class escaping: a dot inside `[]` is a literal dot and needs no escape, while outside it matches anything. Testing against real input rather than reasoning about the pattern is faster than either, which is what the tester is for.
Frequently asked questions
Is my data uploaded when I use these tools?
Not for the local ones, which is most of them. JSON, Base64, JWT, hashing, regex, diff, CSV and SQL tools all run in your browser. The network lookups (DNS, SSL, MAC vendor) necessarily make a request, and each of those pages says what it sends.
Is it safe to paste a real JWT or API key here?
The JWT decoder and hash generator run entirely client-side, so nothing is transmitted. That said, treat any credential pasted into any browser tab as exposed to extensions and to anyone with access to your machine, and rotate anything you would not want logged.
Why does the SSL checker not show the certificate?
Because no browser API gives a web page access to a remote server's certificate. That requires a server-side connection. The tool reports what a browser genuinely establishes — whether the handshake completes — and links to scanners that can read the rest.
Are there rate limits?
The local tools have none. The ones backed by public APIs inherit whatever limits those services impose, and will tell you when a limit has been reached rather than showing an empty result.
Can I use these tools offline?
The client-side ones will keep working once the page has loaded, since the logic ships with the page. Anything that queries a live service needs a connection.