Developer utilities that don't send your payload to a server
Ten tools for JSON, Base64, URLs, hashes, UUIDs, JWTs, subnets, cron and timestamps. Everything runs client-side, which is the only sane default when the thing you are pasting might be a production token.
Every developer has pasted a JWT into a random site to see what is inside it, then felt the small cold moment of realising that site now has the token. The tools here exist so that moment stops happening: nothing you paste is transmitted, because there is no server-side step to transmit it to.
They are also fast in the way a utility should be. No framework boot, no spinner, no cookie wall before the formatter appears. Open the tab, paste, read the result, close it.
No tool matches that.
Encoding
- JSON Formatter & Validator
Pretty-print, minify, and validate JSON with clear error locations for malformed input.
- Base64 Encode/Decode
Convert text or files to and from Base64 instantly, entirely in your browser.
- URL Encoder/Decoder
Encode or decode URL components and query strings, with a full-URL mode for entire links.
Generators
- UUID Generator
Generate RFC 4122 version 4 UUIDs one at a time or in bulk, ready to copy.
- Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text, computed locally in your browser.
Web & Security
- JWT Decoder
Decode a JSON Web Token's header and payload, and check its expiry, without sending it anywhere.
- Subnet Calculator
Calculate network address, broadcast address, usable host range, and subnet mask from a CIDR block.
Text Patterns
- Regex Tester
Test a regular expression against sample text with live match and capture-group highlighting.
Time & Scheduling
- Cron Expression Parser
Turn a cron expression into a plain-language schedule and see its next run times.
- Unix Timestamp Converter
Convert between Unix epoch time and human-readable dates in any timezone, both directions live.
From the blog
What each one is actually for
The JSON formatter validates as it pretty-prints, so a failing parse gives you the line and the reason rather than a red cross. Paired with the JSON-to-YAML and CSV converters on our file tools, it covers most of the reformatting a config change needs.
The JWT decoder splits header, payload and signature and renders the timestamp claims as readable dates, because the usual reason for decoding a token is checking whether exp has already passed. It never verifies against a secret, which would mean sending the secret somewhere.
The cron parser translates an expression into the sentence you wanted and lists the next runs, which is the fastest way to catch the classic off-by-one between day-of-month and day-of-week. The subnet calculator does the same job for CIDR: usable range, broadcast, host count.
About the hash and UUID generators
Hashes are computed with the browser's own Web Crypto implementation rather than a bundled library, so they match what your language's standard library produces and there is no third-party code touching the input.
UUIDs come from crypto.randomUUID where available, which is a cryptographically strong source rather than Math.random dressed up. That difference matters the moment a generated ID ends up as a real identifier.
Common questions
Is it safe to paste a token or a secret here?
Nothing you paste leaves the page: every tool runs in your browser and there is no network request carrying the input. That said, treat any web page as a smaller risk rather than no risk. Rotate a production secret you have pasted anywhere, including here.
Does the JWT decoder verify signatures?
No, deliberately. Verifying requires the signing key, and a tool that asks you to paste a signing key into a web form is asking for the wrong thing. It decodes and displays claims; verify in your own runtime.
Do the hashes match my language's library?
Yes. SHA-1, SHA-256, SHA-384 and SHA-512 come from the browser's Web Crypto API, so a given input produces the same digest you would get from Python's hashlib, Node's crypto, or an equivalent standard library.
Is there a size limit?
Only your device's memory. There is no upload, so large payloads are limited by RAM rather than by a request body cap or a plan tier.
Can I use these offline?
Once a page has loaded, the tool itself keeps working without a connection, since the logic is already in the browser. Reloading the tab needs the network again.