Developer Tools
JSON, JWT, regex, hashing, encoding and code generation — all client-side.
37 free tools · nothing is uploaded
About Developer Tools
This is the largest group on the site, and the one where running locally matters for a reason people underestimate. Developer tools get fed production data: a JWT from a live session, an API response with customer records, a connection string, a webhook payload. Pasting any of that into a website means sending a credential or personal data to a third party you have not audited.
Everything here is JavaScript executing in your tab. A JWT you decode is parsed in memory; a string you hash is hashed with the browser's own WebCrypto implementation. No request is made with your input, which means these tools are safe to use on real values rather than sanitised examples — and they keep working when you are offline or behind a network you do not trust.
The set covers the everyday cases: reading and reshaping JSON, inspecting tokens, testing patterns, converting between encodings and bases, and generating typed models from a JSON payload or a SQL schema.
Where to start
- Working with JSON
- The JSON Formatter beautifies, minifies and validates. The Validator explains errors with positions when a payload will not parse. Compare diffs two objects, Sort Keys makes two payloads comparable, and Minifier strips whitespace for transport.
- Generating types from data
- JSON to TypeScript, JSON to Go and JSON to Java turn a sample payload into interfaces, structs or classes. SQL to Code does the same from CREATE TABLE statements, and gets nullability right — a column is nullable unless declared NOT NULL, which is the opposite of the default assumption in most languages.
- Tokens and hashing
- The JWT Decoder reads header, payload and expiry without verifying a signature; the JWT Generator signs one with HMAC. Hash Generator covers SHA-256, SHA-512 and MD5 for strings, File Checksum does the same for files.
- Patterns
- Regex Tester matches live against sample text. Regex Explainer describes a pattern in plain English, which is the faster path when you inherited the pattern rather than wrote it. Replace and Extract handle the two things you usually want next.
- Encoding and conversion
- Base64, URL Encoder, HTML Entities and Unicode Converter cover the usual escaping questions. Number Base converts between binary, octal, decimal and hex. Timestamp Converter turns Unix epoch values into readable dates.
- Reference
- HTTP Status Codes and MIME Types are lookup tables rather than tools — faster than searching, and they load offline.
A habit worth forming: when a tool asks for a token or a payload, check the network tab once. If a request goes out carrying your input, stop using it for anything real. That is the whole reason this set exists.
Frequently asked
Is my data sent to a server?
No. Everything here is parsed, formatted and generated in your browser. That said, treat a production secret with care wherever you paste it: this page is safe, but the habit of pasting live tokens into web tools is not.
Is it safe to paste a real JWT into the decoder?
The decoding happens locally and nothing is transmitted. But a JWT is a bearer credential — anyone holding it can act as you until it expires. If it is a live production token, prefer an expired or test one, and rotate anything you are unsure about.
My JSON looks fine but the validator rejects it. Why?
Almost always one of three things: a trailing comma after the last item, single quotes instead of double, or an unquoted key. JavaScript object literals allow all three; JSON allows none. The formatter points at the line.
Do these tools work offline?
Not currently. The page has to load once over the network, and there is no offline cache. After it has loaded, the work itself is local — but reloading the tab without a connection will not work.
Are generated hashes and UUIDs cryptographically sound?
UUIDs come from the browser's crypto.randomUUID(), and hashes from the Web Crypto API — both are the platform's own implementations, not hand-rolled. Note that MD5 and SHA-1 are broken for security purposes and are offered only for checksums and legacy compatibility.