Free Online Developer Tools
Encoders, decoders, formatters, hashers, and validators for everyday development work. Ten of them run entirely in your browser, so a token or a payload you paste never leaves your machine. The JSON formatter, the JSON diff and the Base64 and URL encoders run on our server instead, and each of those pages says so on itself.
Encoding and decoding
Base64, URL and HTML encoding, including the Unicode edge cases that make a round trip come back different from what went in.
Base64 Encode / Decode
Convert text to Base64 and back, in both the standard and URL-safe alphabets. Unlike the one-line implementation most sites ship, this encodes to UTF-8 first, so accented letters and emoji survive the round trip instead of throwing an error. What people usually paste into a Base64 decoder is a token, which is exactly why nothing pasted here is ever stored — it is converted and discarded per request.
HTML Encoder and Decoder
Convert markup characters such as angle brackets, ampersands, quotes, and apostrophes into HTML entities, or decode those entities back into readable text. This is useful when preparing code examples, inspecting escaped API output, building fixture data, or checking why a browser displays markup instead of showing it literally. The transformation happens locally and leaves the decision about sanitizing or rendering untrusted HTML to the application that will consume it.
URL Encoder and Decoder
Encode a complete URL or just the value that will go inside a query string, then decode it again when you need to read what an API received. The component and URI modes are deliberately separate because encoding an entire address when you only meant to encode a search term can break its scheme, slashes, and separators. Private endpoints, tokens, and test payloads deserve caution, which is why nothing pasted here is stored — it is transformed and discarded per request.
JSON and APIs
Format, validate, diff and inspect the payloads an API actually returned, rather than the ones its documentation promised.
API Response Viewer
Make one GET request from your browser and inspect the response without installing an API client. JSON is pretty-printed, plain text is shown unchanged, and the status, content type, and byte size are visible. The request sends no credentials and no custom authorization header, requires the endpoint to allow browser CORS, and limits the response body to 2 MB.
JSON Diff
Compare two JSON documents without treating every reordered object key as a change. Both values are parsed, object key order is ignored, array order is preserved, and the report lists added, removed, or changed paths such as `$.user.name` and `$.items[2]`. It is useful for API response checks and configuration reviews, and the output is capped at 500 paths so a huge payload cannot produce an unusable wall of text.
JSON Formatter
Paste JSON and get it back indented, minified, or with its keys sorted. When it will not parse, you get a line and column number rather than a character offset, which is the difference between finding the problem and counting through four hundred characters by hand. An API response full of tokens and customer records is often what gets pasted here, which is why nothing is stored — it is formatted and discarded per request.
JSON Schema Validator
Check whether a JSON document matches a schema in your browser. This validator supports the everyday JSON Schema rules most useful for API payloads: types, required properties, nested properties, array items, enums, constants, string and number limits, regular-expression patterns, array sizes, and disallowed extra keys. Errors include a JSON path such as `$.user.email` or `$.items[2]`, making the first useful correction easier to find. Both the data and the schema stay in this tab. It is a deliberately documented subset, not a claim to implement every draft, reference resolver, conditional keyword, or vocabulary in the JSON Schema standard.
JWT Decoder
Paste a JSON Web Token and see its header and claims, with the expiry and issued-at timestamps converted into actual dates. It runs entirely in this tab, which matters more here than on any other tool on this site: a JWT is usually a live credential, and pasting one into a decoder that posts it to a server is handing someone your session.
Hashes and checksums
Verify that a file is the file you were sent, and produce the digest to check it against.
File Checksum Generator
Generate a checksum from the exact bytes of a local file, without uploading the file to a hash service. Choose SHA-256 for the usual integrity check, or select SHA-1, SHA-384, or SHA-512 when a published manifest explicitly requires that algorithm. The result is lowercase hexadecimal and can be compared with a vendor checksum for an installer, archive, document, image, or build artifact. The browser reads the selected file only after you choose it; the page does not send the bytes to a server. A matching hash confirms bytes match a reference, but it does not prove that the reference itself came from a trustworthy publisher.
SHA-256 Hash Generator
Generate a SHA-256 digest from text with the browser's Web Crypto API. The output is a lowercase hexadecimal string that you can compare with a published checksum, use in a fixture, or record beside a build artifact. Processing stays in this tab; the text is not posted to a hash service. The tool also lets you choose SHA-1, SHA-384, or SHA-512 when a protocol specifically requires another digest, but SHA-256 is the default for general integrity checks. A hash is not encryption: anyone who has the same input can calculate the same result.
Generators and testing
Identifiers, schedules, timestamps and a regex bench — the small things you reach for mid-task.
Cron Expression Generator
Build a five-field Unix cron expression without memorizing which position means minute, day of month, or day of week. Start with a common schedule, edit each field, and copy the exact expression into crontab, a deployment script, a container, or a scheduler that documents Unix cron syntax. The page validates the shape and numeric ranges locally, while leaving timezone and scheduler-specific behavior visible instead of pretending one cron dialect covers every platform.
Regex Tester
Write a JavaScript regular expression, choose its flags, and test it against real sample text without sending either one to a server. The result lists every match's value and character position, plus captured groups when your pattern uses them. Invalid syntax is reported immediately, which makes this useful for a small debugging check before a pattern goes into a validator, log parser, or application.
Unix Timestamp Converter
Turn a human date into the integer an API, database, or log uses, or turn an epoch value back into a readable UTC date. The seconds-versus-milliseconds switch is explicit because multiplying the wrong unit by 1,000 is one of the most common timestamp bugs. Choose the current time for a quick reference, or enter a date and see the result immediately in this browser tab.
UUID Generator
Generate one UUID or five hundred, as random version 4 or time-ordered version 7, formatted however your target system wants them. They come from your browser's own cryptographic random number generator, which means nobody else has ever seen them — including us, because there is no request to a server that could have handed the same value to somebody else.