Category
Developer
Sixteen utilities for the things you hit mid-task. Decode a token to check an expiry, work out what a cron line actually does, format a wall of JSON, test a regular expression against real input, or hash a file. They run locally, which is why pasting a production secret here is safe.
All Developer tools15 tools
Why local execution is the whole point
The values developers paste into these tools are exactly the values that should never be pasted into a web form: signed tokens, API keys, password hashes, config fragments containing connection strings. Every tool here runs in your tab. Nothing is transmitted to a server, and there is no request to intercept, log, or retain. JWT Decoder is deliberate about this: it decodes the header and payload and shows the expiry, and it never asks for your signing secret, because verifying a signature is a server's job and a tool that asked for the secret would be a tool you should not use.
Reading and writing the formats that bite
JSON Formatter validates as well as pretty-prints, and points at the character where parsing failed rather than saying the document is invalid. CRON Expression Explainer turns a five-field line into plain English plus the next several run times, which is the only reliable way to confirm a schedule fires when you think it does. Regex Tester uses the JavaScript engine with live match highlighting, capture groups, and flag toggles. Base64, URL, and HTML encoders round-trip full Unicode, so emoji and non-Latin scripts survive intact.
Generating and checking
UUID Generator and Password Generator both draw from the browser's cryptographic random source rather than Math.random, so the output is suitable for real use. Hash Generator computes MD5, SHA-1, SHA-256, and SHA-512 from text or a dropped file.
Frequently asked questions
Is it safe to paste a production token here?
Yes. The decoding happens entirely in your browser and no part of the token is sent to a server, stored, or logged. You can verify this by opening your network tab, or by disconnecting from the internet and watching the tool keep working.
Does the JWT decoder verify signatures?
No, and that is deliberate. Verifying a signature requires your secret or private key, which should never be pasted into a web page. The tool decodes the header and payload and reports the expiry, which is what you usually need when debugging.
Which regex flavour does the tester use?
JavaScript, meaning ECMAScript regular expressions, the same engine that runs in the browser. Syntax that only exists in PCRE or Python, such as lookbehind in older engines or named groups with a different syntax, may behave differently.