Developer Tools

The inputs to developer tools are often the most sensitive strings you handle: access tokens, API responses with customer data, configuration with internal hostnames. Pasting them into a site that posts them to a server creates a copy you do not control. Every tool here works with the Web Platform alone: JSON.parse and JSON.stringify, TextEncoder and atob for Base64, encodeURIComponent, crypto.randomUUID, the Web Crypto digest function, and the JavaScript regex engine. You can load a page, disconnect from the network and keep working.

Because the engine is your browser's, results match what your front-end code will do. A regex that behaves here behaves the same in your JavaScript; a JSON document the formatter accepts is one that JSON.parse accepts.

Encoding changes how bytes are written so they survive a channel: Base64 (RFC 4648) turns any bytes into 64 safe ASCII characters for email and data URLs, and percent-encoding (RFC 3986) makes text safe inside a URL. Escaping with HTML entities stops characters like < and & from being read as markup. All three are reversible by anyone and provide no secrecy at all.

Hashing is one-way: SHA-256 turns any input into a fixed 256-bit fingerprint that cannot be turned back into the input. Hashes verify downloads and detect changes, but plain fast hashes are the wrong tool for storing passwords; use a slow password hash such as bcrypt, scrypt or Argon2 for that. A JWT, finally, is encoded rather than encrypted in its common signed form, which is why the decoder can show its contents without any key.

These tools work on text you paste. To turn a whole JSON export into a spreadsheet, use JSON to CSV; to move between JSON, XML, YAML and CSV files, the data converter handles the file formats.