Developer tools

A browser toolbox for the small jobs that interrupt real work

Most coding problems are big and interesting. The ones that actually slow you down aren't. You've got a minified API response in front of you, a JWT you can't read, a URL that's mangling its query string, and a regex that nearly works. None of these deserve a dependency, a CLI install, or a tab full of ads. They deserve thirty seconds and a clean text box.

That's the whole idea behind this collection: a single page of free developer utilities that load instantly, run entirely in your browser, and never ask you to sign up. JSON formatting, Base64, URL encoding, JWT decoding, color conversion, regex testing, timestamp math, and an HTTP status reference all live in one place. You stop pasting your data into whatever Google surfaces first, and you stop wondering whether that random site is logging it.

What each tool actually does

The JSON formatter takes a wall of escaped, single-line JSON and turns it into something a human can scan. Say a webhook fires and your logs capture the raw body as one enormous string. Paste it in, pick two- or four-space indentation, and you get a readable tree with the syntax error pinpointed if there is one. It validates as it formats, so a stray trailing comma or an unquoted key gets called out instead of failing silently three layers deep in your app.

Base64 encode/decode is the workhorse you reach for constantly without thinking about it. Data URIs, Basic Auth headers, binary blobs stuffed into config files, the segments of a token — all Base64. Decode a header value to confirm credentials are being sent the way you expect, or encode a small image to inline it. It handles UTF-8 cleanly, which matters the moment your input isn't plain ASCII.

The URL encode/decode tool fixes the classic bug where a query parameter contains a space, an ampersand, or a plus sign and quietly breaks your request. If you're building a link by hand and the value is name=John & Co, you need that ampersand escaped to %26 or the server reads it as a parameter separator. Paste, encode, copy. Decoding works the other way when you're staring at a logged URL full of percent codes and trying to figure out what was really requested.

The token tool, and an important caveat

The JWT decoder splits a token into its three dot-separated parts and shows you the header and payload as plain JSON. When you're debugging auth, this is gold: check which algorithm signed the token, read the sub, confirm the exp claim hasn't already passed, and see exactly which scopes or roles your gateway is handing the client.

Here's the part people forget. Decoding a JWT is not verifying it. The payload is just Base64url — anyone holding the token can read every claim in it, and this tool does exactly that and nothing more. It does not check the signature, so a decoded token tells you what a token says, not whether it's genuine. Never trust claims from a decoder for an authorization decision; that's your server's job, with the signing key. Use the decoder to understand and debug, never to validate.

The regex tester closes the loop on the most frustrating utility of all. Write your pattern, drop in some sample text, and watch matches highlight live as you type. Capture groups are listed out, so you can confirm group two really is grabbing the year and not the whole date. It beats the edit-save-rerun cycle of testing a pattern inside your actual codebase, and it's a fast way to learn why a greedy quantifier is swallowing more than you meant.

Rounding things out: the HEX↔RGB converter flips a #1a2b3c into rgb(26, 43, 60) and back for when your design tokens and your CSS disagree. The Unix timestamp converter turns 1718900000 into a real date and time, which you'll want every time a database stores epoch seconds and your eyes can't parse them. And the HTTP status code reference saves you from guessing whether 422 or 409 is the right answer when an API call goes sideways.

Local processing, so you can paste the sensitive stuff

This is the part that matters most for anyone touching production data. Every tool here runs client-side in JavaScript. Your input never leaves the browser — there's no upload, no round trip to a server, nothing to log. That means you can paste a real access token to inspect its claims, decode a Base64 header that contains a credential, or format an API response full of customer data without it ever crossing the network. Want proof? Open your dev tools, watch the network tab, and paste away. You'll see nothing go out. For sensitive payloads, a local-only tool isn't a nice-to-have; it's the only responsible option.

Frequently asked questions