Browse by category
Format, encode, generate and convert common developer data. Everything runs locally, with no account and no upload.
Use transformations safely
Developer utilities are useful for inspection and transformation, but similar-looking outputs can have very different security meanings. Each tool documents what it parses or generates, what it deliberately does not verify, and the local limits used to keep untrusted input responsive.
JSON Formatter parses JSON before formatting or minifying it. XML Formatter checks well-formed XML, not validity against an XSD or another schema, and rejects DOCTYPE and entity declarations so external entities cannot request files or network resources. A visually tidy document can still contain the wrong values for an application.
Base64 turns bytes into portable text and is reversible without a secret. URL encoding escapes data for parts of a URL; it is not access control. Hashing creates a one-way digest for comparison or integrity workflows but does not encrypt data. Keep secrets out of URLs and do not use an encoding step as a security boundary.
JWT Decoder displays a token's header, payload and time claims without verifying its signature, issuer or authenticity. UUID Generator creates version 4 identifiers with browser cryptography, but statistically strong uniqueness is not a substitute for database constraints. Timestamp conversions describe moments; local display can still be affected by time-zone and daylight-saving rules.
Some regular expressions can take excessive time on crafted input, so Regex Tester uses a bounded worker and input limits. Cron expressions describe schedules according to the supported field rules, not every vendor-specific extension. Validate the result in the system that will execute it before using it in production.
Pasted JSON, XML, tokens, expressions, hashes and identifiers stay in the browser and are not included in analytics. Local processing reduces disclosure to a conversion service, but it does not make untrusted content safe to execute or publish. Review decoded and formatted output before passing it to another application.
Inspect claims locally without implying signature verification.
Check well-formedness with external entities disabled.
Transform UTF-8 text or file bytes without treating encoding as encryption.
Inspect matches inside the tool's worker and input limits.
Understand why readable claims are not proof of authenticity.
Separate XML syntax checks from DTD, XSD and application validation.
The standard definitions for Base64 and Base64URL alphabets.
Security guidance for disabling risky XML external entity behavior.