Every developer has a bookmarks folder full of "quick tools" — JSON formatters, Base64 encoders, regex testers. And every one of those sites has the same dirty secret: whatever you paste gets sent to their server. Paste a production API key into an online JWT decoder and you've just handed it to a stranger. I've seen this cause real incidents. The tools on this page exist so you never have to make that trade again.
The everyday workhorses
Some tools you use ten times a day. The JSON formatter takes a minified blob and turns it into readable, validated, collapsible JSON — and tells you exactly which line breaks when it's invalid. The regex tester highlights matches live as you type, with a cheat-sheet for the syntax nobody memorizes. Base64 and URL encoder handle the translations that APIs demand constantly.
For tokens and identity work: the JWT decoder splits a token into header, payload, and signature so you can inspect claims without pasting the token into some random site. The UUID generator mints v4 GUIDs in bulk. And the hash generator computes SHA-256, SHA-512, and SHA-1 — useful for checksums, fingerprinting, and verifying downloads.
Security tools you can actually trust with secrets
Here's the irony of most "free password checkers": you type your real password into a website to see if it's strong. Don't. The password entropy analyzer here computes strength using NIST guidelines locally — your candidate password never leaves the tab. Same principle for the timestamp converter and everything else: the computation happens in your browser's JavaScript engine, and you can prove it by watching the network tab stay silent.
Quick password reality check while we're here: length beats complexity. A 16-character passphrase of random words ("correct horse battery staple" style) has far more entropy than an 8-character password with symbols. The analyzer shows you the math — entropy in bits — instead of a meaningless "strong/medium/weak" bar.
Network and infrastructure helpers
The CIDR subnet calculator turns 192.168.1.0/24 into usable ranges, broadcast addresses, and host counts — the thing every networking exam asks and every on-call engineer Googles at 2am. The cron expression builder translates "0 9 * * 1" into plain English ("at 9:00 AM every Monday") and builds expressions from a visual picker, because nobody should memorize cron field order.
For web ops: the .htaccess & nginx redirect generator writes correct 301 rules for both servers (getting redirect syntax wrong is a classic SEO disaster), and the robots.txt & sitemap generator produces valid directives so crawlers behave. The SQL formatter beautifies queries for readability — genuinely useful before pasting SQL into documentation or a PR.
Frontend and data conversion
The CSS box-shadow stacker and glassmorphism generator let you design layered shadows and frosted-glass effects visually and copy the CSS — faster than tweaking values blind in devtools. The flexbox playground is the fastest way I know to finally internalize how flex properties interact.
Data wranglers get the JSON ↔ CSV converter and HTML table converter — the unglamorous tools that save hours when you're moving data between a spreadsheet, an API, and a database.
Recipes: copy-paste solutions to common problems
Debugging an API: paste the raw response into the JSON formatter — invalid JSON gets flagged with the exact line and character. Nine times out of ten it's a trailing comma or an unescaped quote. Validating emails: don't write your own email regex (everyone gets it subtly wrong); test candidates in the regex tester against real addresses including plus-tags and subdomains.
Migrating servers: generate the .htaccess or nginx 301 rules before you move, test every old URL, and avoid the ranking collapse that follows a sloppy migration. Checking a download: hash the file with SHA-256 and compare against the published checksum — if it doesn't match, don't install it. These are five-minute tasks that prevent five-hour disasters.