Developer Tools
Format JSON and SQL, diff structures, decode JWTs, hash strings and generate UUIDs — all client-side.
All Developer Tools
JSON Formatter
Format, minify or validate JSON with a collapsible tree, key sorting, and warnings when parsing quietly loses data.
JSON Compare
Compare two JSON documents structurally: tree and side-by-side views, ignore key order or case, and a differences-only filter.
Base64 Encoder / Decoder
Encode and decode Base64 with correct UTF-8 both ways, the URL-safe RFC 4648 alphabet, data URIs, file upload and image preview.
UUID Generator
Generate UUID v4, v7 or v1 from the browser CSPRNG, 1 to 100 at a time, as a list, JSON array, CSV line or SQL INSERT rows.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-512 and CRC-32 over identical UTF-8 bytes, with an optional salt and HMAC signature mode.
Regex Tester
Test JavaScript regex with numbered and named groups, inline highlighting and a replace preview, run with a two-second timeout.
HTML Formatter
Reindent HTML from the browser's own parsed DOM, keeping pre, textarea, script and style contents byte for byte.
CSS Minifier
Minify CSS with a scanner that protects strings, data URIs, calc() spacing and attribute selectors, and keeps licence comments.
JS Minifier
Minify JavaScript with terser: real parsing, compression and name mangling, ES6 and modules, with parse errors located precisely.
SQL Formatter
Format SQL for 10 dialects with keyword, identifier and function casing, comma placement and indent control. Nothing is executed.
JWT Decoder
Decode a JWT header and payload from base64url, with alg plus epoch, UTC and relative times for iat, nbf and exp claims.
What to know about developer tools
The reason to use a local formatter rather than the first result on a search engine is that developers paste secrets into these boxes. A JWT is a bearer token; a connection string is a password. Nothing here is transmitted, which means a token you decode cannot end up in someone else's log.
Two honest caveats. The JWT tool decodes, it does not verify — reading a payload tells you what a token claims, not whether the signature is valid, and that distinction matters if you are debugging an authorisation bug. And MD5 and SHA-1 are here because you still meet them in checksums and legacy systems, not because they are safe for anything security-related.
The formatters parse rather than pattern-match. That sounds like a detail until a regex-based minifier truncates a line at the `//` inside a URL string, or a formatter collapses the whitespace inside a `<pre>` block. Parsing costs a little more and does not corrupt your input.
Frequently asked
Does the JWT decoder check the signature?
No. It splits the token and decodes the header and payload so you can read them. A decoded token is not a verified token — only your server, holding the key, can tell you whether it is genuine.
Are the generated UUIDs safe to use as tokens?
The v4 generator draws from the browser's cryptographic random source, so it is suitable where unpredictability matters. Note that v7 encodes a timestamp by design and therefore leaks creation time.
Should I use MD5 for passwords?
No — nor SHA-256 on its own. Password storage needs a slow, salted algorithm such as bcrypt or Argon2. The hashes here are for checksums, cache keys and comparing files.