Developer & data tools
Ten utilities for the small jobs that interrupt real work: reading a minified API response, finding out why a token is rejected, turning a spreadsheet export into JSON, testing a regular expression against real log lines.
Developer tools are where pasting into a website is riskiest, because the input is so often production data — access tokens, customer records, queries with real e-mail addresses in the WHERE clause. Every tool here processes what you paste inside the page. Two of them, the YAML converter and the SQL formatter, fetch an open-source library when the page opens; what you type is not part of that request.
All tools 10
JSON Formatter
Prettify, minify & validate JSON.
→CSV ⇄ JSON Converter
Convert CSV to JSON and back.
→YAML ⇄ JSON Converter
Convert YAML to JSON and back.
→SQL Formatter
Pretty-print and indent SQL.
→Regex Tester
Test regular expressions with live match highlighting.
→Base64 Encode/Decode
Text ⇄ Base64 in a click (UTF-8 safe).
→Number Base Converter
Binary ⇄ octal ⇄ decimal ⇄ hex.
→UUID Generator
Random v4 UUIDs, in bulk.
→JWT Decoder
Decode a JWT locally; verify HS256.
→Hash Generator
MD5, SHA-1, SHA-256 & SHA-512 of any text.
→Which tool for which job
- Read or validate a JSON responseThe JSON Formatter pretty-prints with 2 spaces, 4 spaces or tabs, minifies, and shows the parser's error when the input is not valid JSON.
- Turn a spreadsheet export into JSON, or backThe CSV ⇄ JSON Converter uses the header row as keys and handles quoted fields, embedded commas and line breaks.
- Convert a Kubernetes manifest or CI configThe YAML ⇄ JSON Converter resolves anchors, aliases and merge keys, so the JSON shows the values your config really produces.
- Make a one-line query readableThe SQL Formatter puts each clause on its own line, with dialects for PostgreSQL, MySQL, SQLite and SQL Server.
- Test a regular expressionThe Regex Tester highlights every match as you type and counts them, using the same engine as your JavaScript.
- Find out why a token is being rejectedThe JWT Decoder shows the header and claims, converts the expiry times to your local time, and verifies HS256 signatures.
- Encode or decode Base64The Base64 Encode/Decode tool handles emoji and accented text correctly by going through UTF-8.
- Fingerprint a stringThe Hash Generator computes MD5, SHA-1, SHA-256 and SHA-512 together, live.
- Generate unique IDsThe UUID Generator makes version 4 UUIDs, up to 500 at a time, with optional uppercase, braces or no hyphens.
- Convert between binary, octal, decimal and hexThe Number Base Converter shows all four at once and accepts the usual
0x,0band0oprefixes.
Limits worth knowing
- The JSON formatter is strict. Comments, trailing commas, single quotes and unquoted keys are rejected — a file that looks fine in your editor may be JSONC, which is a different format.
- Big integers get rounded. JavaScript stores numbers as 64-bit floats, so integers above 253 lose their last digits in the JSON formatter and the number base converter. Keep 64-bit IDs as strings.
- CSV means commas. Semicolon- and tab-separated files come out as one column, every value becomes a string, and nested JSON is not flattened.
- YAML comments do not survive a trip through JSON, and only one document can be converted at a time.
- The SQL formatter formats. It does not validate or run anything, so a tidy result is not proof that the query works.
- Decoding a JWT is not verifying it. The payload is shown even for a tampered token. Signature checks here cover HS256 only; RS256 and ES256 tokens are decoded but not verified.
- MD5 and SHA-1 are legacy. Use them to match values an older system already publishes, and SHA-256 for anything new. Hashing is not encryption.
- Regular expressions use the JavaScript flavour. Possessive quantifiers and atomic groups do not exist in it, and a badly nested pattern can still freeze the tab.
How these tools work
Wherever the browser already has the capability, the tools use it directly: JSON.parse and JSON.stringify for JSON, the built-in RegExp engine for regular expressions, and the Web Crypto API for SHA hashes, signature checks and random UUIDs. That is deliberate — the result you see is the result your own code would get. Where the browser has nothing built in, a well-known open-source library fills the gap: js-yaml for YAML, sql-formatter for SQL, and a small MD5 implementation.
Guides: JSON vs YAML vs CSV: choosing a data format · JWTs explained: what's inside a token and how to debug it · Checksums: how to verify a downloaded file is genuine · Why Toolkit runs entirely in your browser (and why that matters)
From the blog: Using AI to write code: what actually works · Prompt patterns that actually work for coding agents
More on Toolkit: Image, media & file tools · Text & writing tools · Security & privacy tools · Network & web tools · Calculators · Time & everyday tools · Games
Frequently asked questions
Is it safe to paste a production token or customer data?
The tools process what you paste inside the page and do not send it anywhere, so nothing reaches a server. It is still good practice to treat any token you have handled as sensitive, and to rotate it if it may have been exposed somewhere else.
Why does the JSON formatter reject my file?
It accepts strict JSON only. The usual causes are a trailing comma after the last item, comments, single quotes instead of double quotes, or keys without quotes. In most browsers the error message points to the position of the first problem.
Can the JWT decoder verify RS256 tokens?
No. It decodes them and tells you which algorithm they use, but signature verification is available for HS256 only, where you supply the shared secret. RS256 and ES256 tokens have to be verified against the issuer's public key by your own server.
Which hash algorithm should I use?
SHA-256 is the sensible default. MD5 and SHA-1 both have known collision attacks, so use them only when you need to match a value that an existing system already publishes in that format.
Do these tools work offline?
Most of them do once the page has loaded, because the work happens in your browser. The YAML converter and the SQL formatter fetch a library when the page opens, so they need a connection for that first load.