Developer Tools

26 free developer tools — no accounts, no watermarks.

The utilities you reach for a dozen times a week, in four groups. Format and convert: JSON, SQL, XML, CSV, Markdown, JSON to TypeScript. Encode and escape: Base64, URL, HTML entities, string literals for JSON, SQL, shell and regex, Unicode inspection and Punycode. Inspect and compare: JWT decoding, hashes and checksums, regex testing, text diffing, epoch conversion, semver ranges. And configure: cron expressions with next-run previews, CIDR subnet maths, Content-Security-Policy headers, .gitignore files, .env linting and OAuth PKCE values.

Every one runs locally with no network call. That's not a marketing line for this category, it's a security requirement: pasting a production JWT, an API response, a customer CSV or a .env file into a random online tool is handing that payload to a third party, and those credentials are frequently still valid. You can load these pages, go offline, and keep working.

All developer tools

  • JSON Formatter — Pretty-print, minify and validate JSON on the fly.
  • Base64 Encode / Decode — Encode and decode Base64 text and files — UTF-8 safe, URL-safe option.
  • UUID Generator — Random v4 and time-sortable v7 UUIDs, single or in bulk.
  • Hash Generator — MD5, SHA-1, SHA-256 and SHA-512 for text and files.
  • Regex Tester — Test regular expressions with live highlighting and groups.
  • Diff Checker — Compare two texts line by line — like git diff, in your browser.
  • Unix Timestamp Converter — Epoch to date and back — seconds, milliseconds, ISO and local.
  • JWT Decoder — Decode JWT headers and payloads locally — with expiry checks.
  • CSV to JSON — Convert CSV to JSON and back — quoted fields handled properly.
  • URL Encoder / Decoder — Percent-encode or decode text and URLs, with a query-param breakdown.
  • Markdown Preview — Live GitHub-flavored Markdown rendering as you type.
  • Contrast Checker — WCAG contrast ratios with AA/AAA pass-fail at a glance.
  • Cron Expression Builder — Write cron, read it in plain English, and see the next five runs.
  • Subnet Calculator — CIDR to network, broadcast, host range, netmask and wildcard.
  • SQL Formatter — Format or minify SQL without touching string literals or comments.
  • JSON to TypeScript — Generate interfaces from sample JSON — arrays merged into one shape.
  • XML Formatter — Pretty-print or minify XML, validated by the browser's own parser.
  • HTML Entity Encoder — Encode and decode HTML entities — emoji-safe, sensible defaults.
  • String Escape — Escape strings for JSON, SQL, shell, CSV, regex and more.
  • Semver Calculator — Compare versions and test npm ranges like ^1.2.0 and ~2.1.
  • CSP Generator — Build a Content-Security-Policy header and get told what weakens it.
  • OAuth PKCE Generator — Generate a code verifier, S256 challenge, state and nonce locally.
  • .gitignore Generator — Build a .gitignore from your stack — with the secrets block included.
  • .env File Validator — Catch duplicate keys, unbalanced quotes and silent .env mistakes.
  • Unicode Inspector — See every code point, byte and invisible character in your text.
  • Punycode Converter — Convert IDN domains to punycode — and spot homograph lookalikes.

Frequently asked questions

Is it safe to paste a production JWT or API response here?

Yes — the decoder parses the token in your browser with no network request, so nothing is transmitted. It's still worth building the habit of checking: open your devtools network tab while you paste, and confirm nothing goes out. Do that on any online decoder before you trust it with a live token, because plenty do send what you paste.

Do these tools work offline?

Yes, once the page has loaded. There's no server round-trip in any of them, so you can use them on a plane, on a locked-down network, or with the machine disconnected entirely.

Can the hash generator handle large files?

Yes. Hashing uses the Web Crypto API and streams the file, so multi-gigabyte checksums work — the file is read from disk in your browser and never uploaded, which also makes it far faster than any upload-based checksum service.

Does the JWT decoder verify signatures?

It decodes the header and payload and checks the expiry, but does not verify the signature — that would require your signing secret, which should never be pasted into a web page. Use it to inspect claims and debug expiry, not to establish that a token is authentic.

Are these safe to use with production configuration?

The processing is, since nothing leaves your browser — the .env validator, CSP generator and SQL formatter all run entirely locally. The habit worth keeping is verifying that for yourself: open your devtools network tab and confirm nothing goes out. Do that on any online tool before you trust it with a config file, because plenty do upload what you paste.