Chain developer tools together

What is different about chaining here

Every step happens in this tab, so a three-step pipeline sends nothing anywhere. Other hosted tool sites chain too - CyberChef made the pattern famous and does far more of it. What is different here is that there is nothing kept and nobody to sign up as.

The share link carries the chain and your input in the part of the URL after the #. Browsers never send a fragment, so opening that link does not put your paste on a server, including ours. A query string would.

Here the entire pipeline is a series of function calls on one string in one tab. The cost of adding a step is nothing, so the feature is free to run after the page has loaded.

The three chains worth knowing

Read a JWT payload

Take the middle segment of the token, add Base64 decode, then Format JSON. Two steps, and the claims are readable. Pasting a whole token into a decoder site is one of the more common ways a credential ends up in somebody else's logs, and it is worth doing this one locally on principle.

A caveat the tool cannot enforce: a JWT payload is base64url encoded and unpadded, so a strict decoder rejects it. Ours accepts it, which is described on the base64 page. Decoding a token does not verify it, either. Reading the claims tells you what it says, not whether the signature is genuine.

Compare a payload against a checksum

Format JSON, then Sort JSON keys, then SHA-256. Sorting first is what makes the hash stable: without it, two servers that serialize the same object in different key orders produce different digests for identical data. If parsing would rewrite a number or drop a duplicate key, that step still produces the rewritten document and says so beside the panel; SHA-256 then hashes those visible bytes, not the original paste.

Clean up a pasted list

Trim every line, then Sort lines, then Unique lines. Copying a column out of a spreadsheet or a terminal picks up trailing spaces that make otherwise identical entries look different, so trimming has to come first. The order of the steps is the whole trick.

When a step fails

The chain stops at the failing step and says which one and why. Everything above it already ran and its output is still shown; nothing below it ran at all. Downstream panels read upstream step failed rather than inventing an answer from the last good value.

That is usually the fastest way to find the real problem. A five-step pipeline that fails at step four tells you that steps one to three were fine, which narrows things considerably compared with a single error at the end.

The formula and standard behind each step

Eight of the thirteen steps name a specification beside the panel. Base64 follows RFC 4648, including the URL-safe alphabet in section 5 when - or _ is in the input. Percent-encoding follows the WHATWG URL Standard component set; a literal + on decode stays a plus, the RFC 3986 reading. JSON follows RFC 8259. SHA-256 comes from the browser's own SubtleCrypto implementation of FIPS 180-4, not from a copy of the algorithm shipped in this page. The other five steps name their behavior instead, in a different style, because no specification governs them.

This page is a composition of the cluster rather than a second implementation of it. If a step here ever disagreed with its own tool page, one of the two would be wrong, and there would be no way to tell which. They share one implementation so that cannot happen.

Questions

Related tools

Each step also has a page of its own, with the detail this one skips: base64, URL encoding, the JSON formatter and the hash generator. If what you actually want is to compare two results rather than transform one, use the diff checker.