Free Online Developer Tools
Everyday utilities for developers. Format JSON, encode and decode Base64 or URLs, inspect JWTs, generate hashes, passwords and UUIDs, and convert colors. Everything runs locally in your browser, so it is safe to use with private data.
8 free tools
Which developer tool do I need?
Working with API data? The JSON formatter and validator beautifies, minifies and validates JSON with line and column numbers for errors.
Need to embed binary data in text or read an encoded string? The Base64 encoder and decoder converts text both ways with full UTF-8 support and a URL-safe mode.
Building a query string or debugging a redirect? The URL encoder and decoder percent-encodes reserved characters or turns an encoded URL back into readable text.
Debugging authentication? The JWT decoder shows a token's header and payload, with issued-at and expiry times in readable form.
Verifying a download or generating a checksum? The hash generator creates MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of any text.
Setting up a new account or service credential? The password generator creates strong random passwords with the length and character sets you choose.
Need unique IDs for database rows, test data or file names? The UUID generator produces random version 4 UUIDs, one at a time or in bulk.
Translating a design into CSS? The color converter switches between HEX, RGB and HSL with a live preview.
Private by design: how our developer tools work
Every tool here runs locally in your browser. Tokens, API responses and passwords you paste are never sent to a server.
Randomness comes from the browser's cryptographically secure generator (crypto.getRandomValues), not the predictable Math.random function, so passwords and UUIDs are suitable for real use. SHA hashes are computed with the built-in Web Crypto API.
Several of these tools deal with encodings that are often confused with security. Our guide what is Base64 encoding and when should you use it explains how Base64 works, why it adds about a third to the size of data and why it is not encryption.
Practical tips
Decoding a JWT does not verify it. Anyone can read a token's claims; only the server that holds the signing key can confirm it is genuine, so never trust a decoded payload on its own.
Avoid MD5 and SHA-1 for anything security-related. They are fine for quick checksums and cache keys, but known collision attacks mean SHA-256 or stronger should be used for integrity checks. Store passwords with bcrypt or Argon2, never a plain hash.
Use the text compare tool on two formatted JSON documents to spot exactly which fields changed between API responses or configuration files.
Frequently asked questions
Is it safe to paste tokens or passwords into these tools?
Yes. All processing happens in your browser and nothing is transmitted or stored. Rotate any credential you think may have been exposed elsewhere.
What is the difference between encoding, hashing and encryption?
Encoding, such as Base64 or URL encoding, changes the format of data and is fully reversible by anyone. Hashing produces a fixed-length fingerprint that cannot be reversed. Encryption scrambles data so that only someone with the key can read it.
Can two UUIDs ever be the same?
In theory, yes, but a version 4 UUID has 122 random bits, so the chance of a collision is vanishingly small. You would need to generate billions of UUIDs per second for many years before a duplicate became likely.
How long should a password be?
For accounts you log in to, at least 12 to 16 characters with mixed character types is a good minimum. Longer is better, and using a password manager lets you choose unique, random passwords without needing to remember them.