Developer tools

Start from what you are holding

Every tool here answers one question, and the fastest way to the right one is to describe what is on your clipboard rather than to guess a tool name. Before any update goes live, an automated check types into every tool and blocks the update if what it typed turns up in a request.

You have JSON and you cannot read it

That is the JSON formatter. It indents, it validates, and when the parse fails it tells you the line and the column and prints that line back to you. This formatter names the line and the column. A JavaScript engine throw is a byte offset into a document that might be forty thousand characters long. "Unexpected token at position 21847" is a puzzle. "Line 812, column 5" is an answer.

Formats and validates JSON, and sorts top-level keys. Two responses from the same API often serialize their keys in different orders, so a diff of them reads as a rewrite when one field changed.

You have a string of characters that is obviously not text

Base64 or percent-encoding, and it is usually obvious which. A run of letters and digits ending in one or two equals signs is base64. A string full of %20 and %2F is percent-encoded.

Both pages handle the details that usually send people to a second tool. The base64 page accepts the URL-safe alphabet a JWT uses, adds missing padding, and lets you pick the character encoding. The URL encoder shows all three encodings side by side, so a space that should be + rather than %20 is visible before it corrupts a value.

You have two versions of something and you need to know what moved

The diff checker. It compares two blocks of text side by side at line, word or character granularity. Unchanged stretches can collapse, Jump to next change walks the regions, and when the table would be longer than 200 rows it says so rather than quietly dropping the middle.

For JSON it can sort keys on both sides first so a reordered payload stops reading as a hundred changed lines. That saves you sorting both sides by hand.

You need an identifier or a checksum

The UUID generator makes version 4 or time-ordered version 7 UUIDs in bulk from the browser's cryptographic random source, and shows which bits of the result are actually random. Six of the 128 are fixed by the standard: the version and variant fields. Version 7 also encodes a millisecond timestamp in the first 48 bits. A generator that hands you thirty-two random hex characters with hyphens in the right places has given you something that passes most regular expressions and fails a strict parser.

The hash generator hashes text or a local file into MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, each with a sentence about what it is still fit for, and can create a keyed HMAC. Files stay in this tab; none of these is a password hash.

You need a password or a passphrase

The password generator prints the entropy of what it produced and what each restriction costs, with the arithmetic named. The passphrase generator publishes its wordlist size and the bits per word. The password strength checker estimates the other direction, for something you already have.

Generating a secret in a web page is a reasonable thing to be uneasy about, and the honest answer is that you should not take our word for it. Open a network tab, generate a password, and check that no request carries it. That is a thirty-second check and it is worth more than any assurance on this page. Is it safe to use an online password generator is that check written out, including what to do when the answer is no.

You need three of these in a row

That is the tool chain: several of these tools in sequence on a single paste, still in your browser. The real workflow is almost never one tool: it is decode this base64, then format the JSON that came out, then hash one field of it. Doing that as three separate pastes is slower and usually means three round trips through somebody's server.

Which of these will actually be the best tool you can find

Two of them, maybe three, and it is worth saying which so the rest of this page is worth reading.

The tool chain. Chaining is not new: GCHQ's CyberChef has chained operations in the browser for years, across a far larger set than this. What matters is that every step here runs in the tab. A chain that runs on a server has to upload the intermediate result at every stage, which is slower and shares far more of your data than any single tool would.

The JSON formatter, on the specific question of working once the page has loaded. Its error reporting is better than most, and the fact that what you paste never goes into a request is enforced rather than claimed, which is the part we can prove.

The entropy pages, on honesty rather than features. A strength meter that shows a colored bar is telling you nothing you can check. Printing the bits, the alphabet size and the guess rate that produced every figure is not clever, it is just a decision most of the category has declined to make.

Everything else here is a competent version of a tool that already has a good version somewhere. Use ours if it is closer to hand. That is a real reason, and it is the only one we will claim.

What "runs in your browser" means here, precisely

It means the page loads, and after that the tool does its work with the network off. No upload, no round trip, no queue. You can test that in about thirty seconds: open your browser's network tab, paste something in, use the tool, and check that no request carries what you pasted.

Every release is checked by an automated test. Before any update to these tools goes live, that check types into every box and presses every button, and blocks the update if what it typed turns up in a request. It also loads each page a second time at a URL that already carries tool state, the way a shared link arrives, and fails if anything reads that state and sends it onward. That second check exists because it is the failure an analytics script would introduce, silently, on a site where every other rule was still being obeyed.

This is not a novel idea and we did not invent it. Toolcroft publishes the same guarantee: their about page says continuous-integration tests verify the privacy promise on every change to the site, and that a change introducing an unexpected outbound request fails the build. It is the right bar and we would rather meet it than write a better sentence about privacy.

Two consequences worth knowing, because they are the cost of the design. Nothing is saved unless you explicitly turn saving on, so refreshing loses your work. And share links carry their payload in the part of the URL after the #, which browsers never transmit, so a link works for whoever you send it to without the contents ever passing through us. The full mechanism is written up in how we build tools.

Where the formulas and the standards come from

Every tool here that implements a specification names it, in the source and on the page: RFC 8259 for JSON, RFC 4648 for both base64 alphabets, RFC 3986 for percent-encoding, RFC 9562 for UUID versions 4 and 7, and FIPS 180-4 for the SHA family. Entropy is computed as the base-two logarithm of the search space, which is what entropy means for a secret drawn at random. That framing is ours to defend rather than a standard we can point at: NIST SP 800-63B-4 appendix A is informative rather than normative, and it argues against entropy as a measure of passwords a person invented. Which is why the strength checker reports two numbers instead of one.

That is not decoration. A tool that agrees with another tool is unremarkable; a tool that disagrees is only useful if you can find out why. Naming the rule means the disagreement is resolvable instead of being a matter of which site you trust.

What these tools do not do

Three tools can open a file from your computer, and they read it in the tab; nothing is uploaded. Nothing here is a linter, a schema validator or a formatter for anything other than JSON. If you need YAML, XML, SQL or a language formatter, this is the wrong page and there is no point sending you round the site to find that out.

None of these tools is a substitute for the ones in your editor, either. If you have a JSON file open in an editor that already formats it, use that. These exist for the moment when what you have is a blob in a chat message, a log line or a support ticket, and the alternative is pasting it into whichever site is first in the results.

Questions

Which developer tool do I need?

Start from what's on your clipboard. JSON you can't read goes in the JSON formatter. A string ending in = signs is probably base64, and one full of %20 is URL-encoded. Two versions of a file go in the diff checker. For a checksum, use the hash generator. For an ID, use the UUID generator.

Which password tool should I use?

For a password your manager will fill in, use the password generator. It draws every character at random and starts at 20 characters. For one you'll type or remember, the passphrase generator picks random words worth 11 bits each. To rate one you already have, try the password strength checker with a variation, not the real thing.

Do these tools work offline?

Yes, once the page has loaded. Open a tool, let it load, then switch off your network, and it keeps working, because the work happens in your browser tab. A page you haven't opened yet won't load without a connection. The site doesn't install anything for offline use. How we build tools has the details.

Is anything I paste uploaded?

No. Every tool here does its work in your browser tab. Files you open in the JSON formatter, hash generator or diff checker are read there too. Before any update to one of these tools goes live, an automated check types into every box and presses every button, and blocks the update if what it typed turns up in a request. Share links carry your input after the # in the address. Browsers don't send that part to any server.

Can I run several tools on one paste?

Yes, in the tool chain. Pick from thirteen steps, such as Base64 decode, Format JSON and SHA-256, and add them in the order you want. Each step's output shows in its own panel. If a step fails, the chain stops there and tells you which one.

Other tools you might want

Building the front end too? The color tools check every color pair in a palette against WCAG contrast, suggest the nearest passing shade for a color that fails, show which colors blur together under color blindness, and export a palette as CSS variables.