Are these developer tools free?

Yes. Every tool is free to use without an account or API key, and because the work runs in your browser there is no server-side rate limit to hit.

Do these tools send my code or tokens to a server?

Every tool runs as JavaScript inside your browser tab. JWTs, SQL, regex patterns, and any other input are processed there, and our servers are not involved at any point. The Content Security Policy on this site also sets connect-src 'none', so the browser blocks any fetch, XMLHttpRequest, or WebSocket call the page tries to make.

Are passwords generated by the password tool actually random?

Yes. Each character or word is picked with crypto.getRandomValues from the Web Crypto API, the browser's cryptographically secure random number generator, and draws that would favour some characters over others are rejected and redrawn, so every choice is equally likely.

Do the tools work offline?

Once a tool's page has finished loading, yes, in that tab. The SQL, YAML, cron, and markdown tools download their library as the page opens, and every tool here then does its work in the page, so you can disconnect and keep using it until you close or reload the tab or open another page. Opening or reloading a page needs a connection, because the site installs no service worker and the browser checks each page with the server as it opens.

Why don't these tools have history or saved snippets?

Storing your input would mean writing it to disk. Since the appeal of these tools is that nothing is persisted, no history is kept. If you want to save a snippet, copy it from the output panel.

How much input can the developer tools handle?

Each tool sets its own limit. The regex tester takes a test string of up to 5,000 characters and stops a pattern after 2 seconds, the SQL formatter takes up to 2,000,000 characters (with extra limits on very long lists and deep nesting) and stops after 10 seconds, and the Markdown previewer has no length cap but stops a conversion after 2 seconds. The JWT decoder and number base converter are limited only by browser memory.

Free developer tools

A collection of everyday developer utilities that run entirely in your browser. Decode and inspect JWTs, format SQL queries, test regular expressions against sample text as you type, explain cron schedules in plain English, calculate CIDR subnet ranges, convert number bases, and generate random passwords with the browser's Web Crypto API.

All processing runs in your browser. You can paste JWT tokens, SQL queries, or configuration values, and the page processes them in your browser tab.

Read the complete developer tools guide

JWT decoder

Decode JWT header and payload instantly. All inspection runs in your browser.

Number base converter

Convert numbers between binary, octal, decimal, and hex. All bases shown at once.

Regex tester

Test regular expressions with a live match list, replace, and split modes. Runs in your browser.

Cron expression explainer

Parse any cron schedule into plain English and see the next run times. Fully in-browser.

HTML entity encoder

Encode special characters to HTML entities and decode them back. Instant, in your browser.

Markdown previewer

Live Markdown-to-HTML preview with syntax support. All rendering runs in your browser.

SQL formatter

Beautify and format SQL queries. Supports MySQL, PostgreSQL, T-SQL and standard SQL.

CIDR / subnet calculator

Calculate network address, broadcast, host range and usable hosts from any CIDR block.

Chmod calculator

Click permission bits to get the numeric (755) and symbolic (rwxr-xr-x) notation instantly.

Password generator

Generate random, strong, or memorable passwords using your browser's crypto API.

YAML formatter

Format, validate, and convert YAML. Compatible with Kubernetes, CI configs, and OpenAPI files.

XML formatter

Pretty-print, minify, and validate XML. Uses the browser's native DOMParser.

Slug generator

Convert any text into a URL-safe slug. Handles diacritics, special characters, and custom separators.

Why developer tools should run in your browser

Most online developer tools have a hidden cost: every JWT you paste, every SQL query you format, every regex you test, gets POSTed to a server. The server formats the input, sends back the result, and (probably) keeps a log of what was sent. That log is now a piece of your company's intellectual property sitting on a third party's disk.

For a JWT decoder this matters more than it sounds. A JWT often contains a user ID, an email address, the issuer URL of an internal auth service, the audience, and a signing key ID. Even if the token has expired, the metadata gives an outsider a clean map of your backend. The same applies to SQL: a query string carries table names, column names, and sometimes literal data values from production.

An in-browser tool does the same work inside your tab: the JavaScript runs there and shows you the result. Our servers are not involved at any point.

How the developer tools work

Each tool is a small JavaScript module bundled into the page. The JWT decoder splits the token on dots and base64-decodes the header and payload using built-inatob. The SQL formatter uses the open-source sql-formatter library, loaded lazily the first time you open the page. The regex tester uses the browser's native RegExp engine. The cron parser usescronstrue. The password generator uses crypto.getRandomValues, the browser's cryptographically secure random number generator.

None of these libraries make network calls. They take input, produce output, and the browser displays the result. The Content Security Policy header served with every page sets connect-src 'none', which means the browser itself refuses any outbound fetch, XMLHttpRequest, or WebSocket attempt. That is a strong safety net against a future bug, though not an absolute guarantee: CSP does not block every channel, such as navigating the page to another site.

In-browser vs hosted developer tools

Approach	Privacy	Cost	Best for
In-browser (this site)	Processed locally	Free, no setup	Quick one-off checks while you work
Upload-based developer tools	Sent to the provider's server	Often free	Public sample data, demos
Command-line tools	Processed locally	Install and learn	Scripting, CI pipelines

The honest summary: hosted tools are convenient but send your data to a server. CLI tools process locally but require installation and setup. In-browser tools cover the middle ground: zero setup, processing runs locally. The limitation is that they don't integrate into a build pipeline. For a one-off check during local dev, they are the fastest option.

When to use these tools

Debugging an auth flow? Inspect a token with the JWT decoder, then test the claim-shape with live regex matching.
Writing infrastructure code? Format and validate Kubernetes manifests with the YAML formatter, pretty-print structured documents with the XML formatter, or beautify a long query using the SQL beautifier.
Configuring a server? Turn permission checkboxes into chmod numbers with the chmod calculator, plan IP ranges using the subnet calculator, and translate scheduled jobs into English with the cron explainer.
Need a random password or passphrase for a service account? Create one with the password generator.
Working with content for the web? Encode reserved characters via the HTML entity encoder, preview docs with the Markdown previewer, or produce URL-safe paths through the slug generator.
Reading low-level data? Flip between binary, octal, decimal, and hex with the number base converter.

Frequently asked questions

Are these developer tools free?: Yes. Every tool is free to use without an account or API key, and because the work runs in your browser there is no server-side rate limit to hit.
Do these tools send my code or tokens to a server?: Every tool runs as JavaScript inside your browser tab. JWTs, SQL, regex patterns, and any other input are processed there, and our servers are not involved at any point. The Content Security Policy on this site also sets connect-src 'none', so the browser blocks any fetch, XMLHttpRequest, or WebSocket call the page tries to make.
Are passwords generated by the password tool actually random?: Yes. Each character or word is picked with crypto.getRandomValues from the Web Crypto API, the browser's cryptographically secure random number generator, and draws that would favour some characters over others are rejected and redrawn, so every choice is equally likely.
Do the tools work offline?: Once a tool's page has finished loading, yes, in that tab. The SQL, YAML, cron, and markdown tools download their library as the page opens, and every tool here then does its work in the page, so you can disconnect and keep using it until you close or reload the tab or open another page. Opening or reloading a page needs a connection, because the site installs no service worker and the browser checks each page with the server as it opens.
Why don't these tools have history or saved snippets?: Storing your input would mean writing it to disk. Since the appeal of these tools is that nothing is persisted, no history is kept. If you want to save a snippet, copy it from the output panel.
How much input can the developer tools handle?: Each tool sets its own limit. The regex tester takes a test string of up to 5,000 characters and stops a pattern after 2 seconds, the SQL formatter takes up to 2,000,000 characters (with extra limits on very long lists and deep nesting) and stops after 10 seconds, and the Markdown previewer has no length cap but stops a conversion after 2 seconds. The JWT decoder and number base converter are limited only by browser memory.