Free Private Developer Tools

Developer utilities that run entirely in your browser. UUIDs, JWT decoding, hashing, formatters, mock data, subnet and permission calculators — no uploads, no accounts, no retention.

Nothing you paste is transmitted

Every tool here runs in the page. Your input is read into browser memory, processed by JavaScript or the Web Crypto API, and rendered back to you. There is no request to a server at any point, which you can confirm yourself by opening the network tab while you work.

That architecture is not a marketing position, it is the only defensible one for this category of tool. The strings developers most often need to inspect are the strings that should never be pasted into a stranger's web form: a production JWT with real session claims, a connection string, an API key you are hashing, a configuration file, or two revisions of a contract you are diffing. Every online tool that processes those server-side becomes a log entry, a database row, and eventually a breach disclosure.

The honest limit is that browser memory and a single main thread set the ceiling. Very large inputs are better handled by a local CLI, and the pages affected by that say so directly rather than failing silently.

Written for the failure cases

Each page explains what the tool actually does and, more usefully, where it goes wrong: why decoding a JWT tells you nothing about whether to trust it, why SHA-256 is the wrong function for a password, why cron combines day-of-month and day-of-week with OR, why execute permission on a directory means traverse rather than execute. Those are the details that turn a calculator into something worth reading.

Security & tokens

Tokens, hashes, and identifiers — Why a UUID is not a secret, a hash is not encryption, and a JWT you have not verified is just a base64 string.

• UUID / GUID Generator — A version 4 UUID is 122 bits of randomness formatted into the familiar 8-4-4-4-12 hex layout.
• JWT Payload Decoder — A JSON Web Token is three Base64url segments joined by dots, and the middle one is readable by anyone holding the token.
• SHA-256 Hash Generator — SHA-256 maps any input to a fixed 256-bit digest, deterministically and irreversibly.
• Password Generator — A password is only as strong as the process that produced it.

Formatters & encoders

Formatting and encoding — Pretty-printing catches bugs, Base64 costs 33 percent, and escaping applied in the wrong context prevents nothing.

• JSON Validator & Formatter — JSON is a deliberately small format, and almost every parse error comes from one of about six things it does not allow.
• SQL Query Formatter — SQL generated by an ORM or pasted out of a log arrives as one enormous line, and reading a five-way join in that state is genuinely difficult.
• HTML String Escaper — Escaping the five HTML special characters prevents user input from being read as markup.
• Base64 Encoder / Decoder — Base64 exists so binary data can travel through channels that only reliably carry text.
• URL Encode / Decode — Percent-encoding lets characters with structural meaning in a URL travel as data.
• Markdown Preview — Markdown has no single specification, so the same document renders differently on GitHub, in your editor, and in whatever static site generator you use.
• CSS Formatter & Minifier — Formatting and minifying CSS are the same transformation run in opposite directions, so they belong on one page.

Data & generators

• Mock JSON Data Generator — Building a UI against three hand-typed records produces a UI that works for three hand-typed records.
• QR Code Builder — A QR code is a fixed encoding of whatever text you put in it.

DevOps & system

Timestamps, permissions, subnets, and cron — Four operational primitives with unintuitive semantics, and the specific failures each one causes.

• Epoch / Unix Timestamp Converter — Unix time counts seconds since midnight UTC on 1 January 1970.
• CHMOD Permissions Calculator — Unix permissions are three sets of three bits, expressed as three octal digits.
• CIDR / Subnet Calculator — CIDR notation writes a network as an address followed by a prefix length, and the prefix length is simply how many leading bits are fixed.
• Cron Expression Parser — Cron syntax is five fields of terse punctuation, and misreading one of them means a job runs at the wrong time or not at all.

CSS & design

• Box Shadow Generator — The box-shadow property takes up to four lengths and a colour, and only two of them behave the way most people assume.
• CSS Gradient Generator — CSS gradients are generated images, which is why they scale without artefacts and cost no HTTP request.

Text & strings

Working with text — Diffs cannot see movement, regular expressions cannot count, and case conversion is not locale-independent.

• Text Diff Checker — Comparing two versions of anything by eye is unreliable past about ten lines.
• Regex Tester — Regular expressions are written once and debugged repeatedly, usually against inputs nobody anticipated.
• Case Converter — Naming conventions are arbitrary and non-negotiable: each language community picked one, and code that ignores it reads as foreign.