Which Dev Tool Do I Need?
DevBox has 10 small, single-purpose tools instead of one do-everything utility, because encoding, generating, and inspecting are genuinely different jobs. They fall into 5 groups — here's a quick map from what you're doing to the tool that does it, a worked debugging session that chains several of them together, and the full list.
Encoding
- Pasting a JSON blob you can't read or that won't parse? Use the JSON Formatter & Validator — pretty-print, minify, or get the exact error location on malformed input.
- Need to convert text or a file to/from Base64? Use the Base64 Encode/Decode tool — handles Unicode and emoji correctly, entirely in your browser.
- Building a query string or a link with special characters in it? Use the URL Encoder/Decoder — encode just a component or a whole URL.
Generators
- Need a unique ID for a database row, request, or object? Use the UUID Generator — RFC 4122 v4, one at a time or in bulk.
- Need to verify a file or string hasn't changed, or generate a checksum? Use the Hash Generator — MD5, SHA-1, SHA-256, or SHA-512, computed locally.
Web & Security
- Need to see what's actually inside an auth token? Use the JWT Decoder to read the header, payload claims, and expiry — it decodes, it does not verify a signature (see the FAQ below).
- Working out network/broadcast addresses or how many hosts a CIDR block gives you? Use the Subnet Calculator.
Text Patterns
- Writing or debugging a regular expression? Use the Regex Tester to see matches and capture groups highlighted live against your own sample text.
Time & Scheduling
- Trying to figure out when a cron job actually runs? Use the Cron Expression Parser for a plain-language schedule and the next several run times.
- Have a raw epoch number and need a real date, or the reverse? Use the Unix Timestamp Converter, in any timezone, both directions live.
Worked scenario: debugging a broken webhook integration
A webhook payload isn't processing correctly, and the fix isn't obvious from the error alone — this is the kind of session that pulls in several tools from different categories, one after another:
- Paste the raw payload into the JSON Formatter & Validator first. Half the time "processing correctly" really means "isn't valid JSON in the first place" — the formatter pretty-prints it and points at the exact malformed spot if it's broken.
-
If the request carries an
Authorizationheader, drop the token into the JWT Decoder to inspect its claims and expiry. A payload can be perfectly valid JSON and still get rejected downstream because the token backing the request had already expired. - Notice a suspicious-looking number in the payload, like an epoch timestamp that doesn't match when you think the event fired? Run it through the Unix Timestamp Converter — it's a common bug source when a field is seconds in one place and milliseconds in another, and converting it tells you immediately whether that timestamp is actually in the past.
- If the payload was supposed to trigger a scheduled retry and it never fired, check the job's cron expression in the Cron Expression Parser — it'll show you the next several actual run times, which is often the fastest way to confirm a job is (or isn't) firing when everyone assumes it is.
All 10 tools
- JSON Formatter & Validator Pretty-print, minify, and validate JSON with clear error locations for malformed input.
- Base64 Encode/Decode Convert text or files to and from Base64 instantly, entirely in your browser.
- URL Encoder/Decoder Encode or decode URL components and query strings, with a full-URL mode for entire links.
- UUID Generator Generate RFC 4122 version 4 UUIDs one at a time or in bulk, ready to copy.
- Hash Generator Generate MD5, SHA-1, SHA-256, and SHA-512 hashes from text, computed locally in your browser.
- JWT Decoder Decode a JSON Web Token's header and payload, and check its expiry, without sending it anywhere.
- Subnet Calculator Calculate network address, broadcast address, usable host range, and subnet mask from a CIDR block.
- Regex Tester Test a regular expression against sample text with live match and capture-group highlighting.
- Cron Expression Parser Turn a cron expression into a plain-language schedule and see its next run times.
- Unix Timestamp Converter Convert between Unix epoch time and human-readable dates in any timezone, both directions live.
Frequently asked questions
If the JWT Decoder shows me a token's claims, does that mean the token is valid?
No — decoding and verifying are different operations, and this tool only does the first one. Decoding just base64-decodes the header and payload so you can read the claims and expiry, which is useful for debugging what a token says. It does not check the cryptographic signature, so it can't tell you whether the token was actually issued by your auth server or has been tampered with. Don't treat a successfully-decoded token as a validated one — signature verification needs the signing key and has to happen server-side (or with a library that has that key), not in a browser tool that never sees your secret.
What's the difference between the Base64 converter and the URL encoder — don't they both just scramble text?
They solve different problems and produce different output for the same input. Base64 re-encodes arbitrary bytes (text, images, binary files) into a compact ASCII-safe alphabet — it's how you embed an image inline or put credentials in an Authorization header. URL encoding (percent-encoding) leaves most characters alone and only escapes the specific ones that are reserved or unsafe in a URL, like spaces and `&`. If you base64-encode a string you'll get a short jumble of letters, digits, and a few symbols; if you URL-encode the same string, it'll look almost identical to the original with occasional `%XX` sequences.
Why are there separate Hash Generator and UUID Generator tools if both just spit out random-looking strings?
They're opposites in the one way that matters: a hash is deterministic and a UUID (v4) isn't. Feed the Hash Generator the same input twice and you get the identical hash every time — that's what makes hashes useful for verifying a file or payload hasn't changed. The UUID Generator does the reverse on purpose: every UUID it produces is meant to be unrelated to any input and practically unique, which is what you want for a database primary key or a request ID, not for checking integrity.
If I paste a real JWT, API payload, or config file into these tools, does any of that data leave my browser?
No. Every tool on this page — the JSON Formatter, JWT Decoder, Base64 converter, and the rest — runs entirely client-side; nothing you paste is uploaded anywhere, which matters when you're debugging with production tokens or payloads that contain real user data. That's also exactly why the JWT Decoder can't verify signatures (see above): real verification needs a signing key, and this tool deliberately never talks to a server to check one.
The Cron Parser and the Unix Timestamp Converter both deal with dates — when do I actually need which one?
The Cron Parser is for recurring schedules: paste a cron expression like `*/15 * * * *` and it tells you in plain language when that job runs and lists its next several run times. The Timestamp Converter is for a single point in time: it turns one Unix epoch number into a human-readable date (or back), in whatever timezone you pick. In practice you often need both in the same debugging session — the cron expression tells you when a job is supposed to fire, and the timestamp converter tells you whether a specific logged epoch value actually lines up with that.