Developer Tools
Format JSON, transform encoded values, inspect unverified JWTs, test regex safely, calculate hashes, convert timestamps, and generate UUIDs locally.
Start from the value you are holding
- JSON Formatter
- A response arrived as one unreadable line, or it will not parse and you need the position of the fault.
- JSON/YAML Converter
- A configuration file has to move between a YAML pipeline and a JSON API.
- CSV/JSON Converter
- A spreadsheet export needs to become records, or records need to go back into a spreadsheet.
- JWT Decoder
- A login is failing and you want to see the claims a token is actually carrying.
- Base64 Encoder and Decoder
- A field, a data URL, or a header contains a run of letters ending in one or two equals signs.
- URL Encoder and Decoder
- A query parameter is full of percent signs, or you are building one and a value contains an ampersand.
- Hash Generator
- You are comparing a downloaded file against a published checksum, or need a stable fingerprint for a string.
- Regex Tester
- A pattern matches too much, too little, or nothing, and you want to see which part of the text it took.
- Timestamp Converter
- A log line holds a ten- or thirteen-digit number where a date should be.
- UUID v4 Generator
- You need an identifier now — for a fixture, a test row, a placeholder key.
What these read, and what they do not check
Every one of these ten inspects or transforms a value; none of them vouches for it. The JWT tool splits a token and decodes its two JSON halves — it does not check the signature, the issuer, the audience, or whether the thing expired last March, and a token that displays perfectly here may still be rejected by the service that matters. Base64 is an encoding, not a secret: anything you encode is trivially readable by anyone who receives it. A hash is one-way but not private, since a short or common input is found instantly in a rainbow table.
The regex tester has a hard boundary you can see. A pattern runs in a separate worker that is killed after 750 milliseconds and returns at most two hundred matches, so a catastrophically backtracking expression stalls one worker instead of the page. That protects the interface; it does not certify the pattern. JavaScript's engine backtracks, and Go's RE2 and a database's own matcher do not behave the same way, so a pattern that finishes here can still hang somewhere else.
These are for the moment you are holding a value and want to know what is inside it — a payload, a timestamp, an encoded parameter, a suspect identifier. For validating a schema across a repository, or linting a megabyte of JSON in a pipeline, use the tool that already runs in your build; that is a different job and a browser tab is the wrong place for it.
Frequently asked questions about Developer Tools
Does decoding a JWT tell me it is valid?
No. Decoding reads the header and the payload, which are only Base64URL and were never hidden. Validity means a signature checked against the issuer's key, and that requires the key, which is not something to paste into a web page. Treat what you see here as a claim the token makes about itself, not as a fact.
Is it safe to paste a real token or a production record?
The processing is honest — nothing is uploaded, and there is no analytics or logging that could capture it — but the answer still depends on your own rules. A live session token in a browser tab is a live session token, whatever the page does with it, and some organisations forbid pasting customer data into any tool they did not deploy. Use a redacted sample when you can.
Why does the regex tester stop at two hundred matches?
Because the list stops being readable long before that, and rendering thousands of rows would freeze the tab for the same reason the worker exists. If you need every occurrence, you need a script rather than a page. The count of what was found is still reported so you know the list was cut.
Which UUID version does the generator produce?
Version 4, which is random. It is the right default and the wrong choice for a primary key at volume: random values scatter across a B-tree index and make every insert touch a different page. Version 7 puts a timestamp in the high bits so that new rows land together, and it is what to reach for when identifiers are going into a database rather than into a fixture.