Developer tools

Start from what you are holding

Every tool in this cluster answers one question, and the fastest way to the right one is to describe what is on your clipboard rather than to guess a tool name.

You have JSON and you cannot read it

That is the JSON formatter. It indents, it validates, and when the parse fails it tells you the line and the column and prints that line back to you. Most formatters reprint whatever the JavaScript engine threw, which is a byte offset into a document that might be forty thousand characters long. "Unexpected token at position 21847" is a puzzle. "Line 812, column 5" is an answer.

It also sorts keys at every level, which turns out to matter more than it sounds. Two responses from the same API often serialize their keys in different orders, so a diff of them reads as a rewrite when one field changed.

You have a string of characters that is obviously not text

Base64 or percent-encoding, and it is usually obvious which. A run of letters and digits ending in one or two equals signs is base64. A string full of %20 and %2F is percent-encoded.

Both of those pages exist mostly to hold the cluster together, and we are not going to pretend otherwise: the search results for both queries are owned by domains that have had the exact-match name since before this site existed. What ours do is get three details right that free decoders routinely get wrong, and those three details are the reason people end up trying a second tool.

You have two versions of something and you need to know what moved

The diff checker. It compares two blocks of text side by side at line, word or character granularity. Unchanged stretches can collapse, Jump to next change walks the regions, and when the table would be longer than 200 rows it says so rather than quietly dropping the middle.

For JSON it can sort keys on both sides first so a reordered payload stops reading as a hundred changed lines. That is a convenience, not the differentiator.

You need an identifier or a checksum

The UUID generator makes version 4 or time-ordered version 7 UUIDs in bulk from the browser's cryptographic random source, and shows which bits of the result are actually random. Six of the 128 are fixed by the standard: the version and variant fields. Version 7 also encodes a millisecond timestamp in the first 48 bits. A generator that hands you thirty-two random hex characters with hyphens in the right places has given you something that passes most regular expressions and fails a strict parser.

The hash generator hashes text or a local file into MD5, SHA-1, SHA-256, SHA-384 and SHA-512 at once, each with a sentence about what it is still fit for, and can create a keyed HMAC. Files stay in this tab; none of these is a password hash.

You need a password or a passphrase

The password generator prints the entropy of what it produced and what each restriction costs, with the arithmetic named. The passphrase generator publishes its wordlist size and the bits per word. The password strength checker estimates the other direction, for something you already have.

Generating a secret in a web page is a reasonable thing to be uneasy about, and the honest answer is that you should not take our word for it. Open a network tab, generate a password, and watch nothing happen. That is a thirty-second check and it is worth more than any assurance on this page. Is it safe to use an online password generator is that check written out, including what to do when the answer is no.

You need three of these in a row

That is the tool chain: several of these tools in sequence on a single paste, still in your browser. The real workflow is almost never one tool: it is decode this base64, then format the JSON that came out, then hash one field of it. Doing that as three separate pastes is slower and usually means three round trips through somebody's server.

Which of these will actually be the best tool you can find

Two of them, maybe three, and it is worth saying which so the rest of this page is worth reading.

The tool chain, because a hosted tool site cannot copy it cheaply. Chaining is not hard. GCHQ's CyberChef has chained operations in the browser for years, across a far larger operation set than this. What is unusual is doing it at this size: chaining is only cheap when no step needs a server. A hosted tool chain means uploading the intermediate result at every stage, which is slower and a much larger disclosure than any single tool, so the companies best placed to build this have the worst reason to.

The JSON formatter, on the specific question of working once the page has loaded. Its error reporting is better than most, and the fact that it makes no requests is enforced rather than claimed, which is the part we can prove.

The entropy pages, on honesty rather than features. A strength meter that shows a colored bar is telling you nothing you can check. Printing the bits, the alphabet size and the guess rate that produced every figure is not clever, it is just a decision most of the category has declined to make.

Everything else here is a competent version of a tool that already has a good version somewhere. Use ours if it is closer to hand. That is a real reason, and it is the only one we will claim.

What "runs in your browser" means here, precisely

It means the page loads, and after that the tool does its work with the network off. No upload, no round trip, no queue. You can test that in about thirty seconds: open your browser's network tab, paste something in, use the tool, and watch the request list stay empty.

Every release is checked by an automated test that loads each page, types a distinctive string into every field, clicks every button, and fails the build if that string appears in any request. It also loads each page a second time at a URL that already carries tool state, the way a shared link arrives, and fails if anything reads that state and sends it onward. That second check exists because it is the failure an analytics script would introduce, silently, on a site where every other rule was still being obeyed.

This is not a novel idea and we did not invent it. Toolcroft publishes the same guarantee: their about page says continuous-integration tests verify the privacy promise on every change to the site, and that a change introducing an unexpected outbound request fails the build. It is the right bar and we would rather meet it than write a better sentence about privacy.

Two consequences worth knowing, because they are the cost of the design. Nothing is saved unless you explicitly turn saving on, so refreshing loses your work. And share links carry their payload in the part of the URL after the #, which browsers never transmit, so a link works for whoever you send it to without the contents ever passing through us. The full mechanism is written up in how we build tools.

Where the formulas and the standards come from

Every tool here that implements a specification names it, in the source and on the page: RFC 8259 for JSON, RFC 4648 for both base64 alphabets, RFC 3986 for percent-encoding, RFC 9562 for UUID versions 4 and 7, and FIPS 180-4 for the SHA family. Entropy is computed as the base-two logarithm of the search space, which is what entropy means for a secret drawn at random. That framing is ours to defend rather than a standard we can point at: NIST SP 800-63B-4 appendix A is informative rather than normative, and it argues against entropy as a measure of passwords a person invented. Which is why the strength checker reports two numbers instead of one.

That is not decoration. A tool that agrees with another tool is unremarkable; a tool that disagrees is only useful if you can find out why. Naming the rule means the disagreement is resolvable instead of being a matter of which site you trust.

What this cluster does not do

Nothing here touches a file on disk, and nothing here is a linter, a schema validator or a formatter for anything other than JSON. If you need YAML, XML, SQL or a language formatter, this is the wrong page and there is no point sending you round the cluster to find that out.

None of these tools is a substitute for the ones in your editor, either. If you have a JSON file open in an editor that already formats it, use that. These exist for the moment when what you have is a blob in a chat message, a log line or a support ticket, and the alternative is pasting it into whichever site is first in the results.

Other tools you might want

Color tools .