Ten developer tools on one page
These are the small conversions that come up every day: tidying an API response, turning an export into a spreadsheet, checking a token, generating test IDs. Each tab works on its own and keeps its input while you switch, and every tab has its own address, such as #jwt or #regex, so you can bookmark the one you use most.
Nothing you paste is uploaded. The page has no server behind it and its security policy blocks every network connection, so tokens, keys and customer data stay in this browser tab.
JSON formatter and validator
Paste JSON to check it and pretty print it with 2 spaces, 4 spaces or tabs, or minify it to a single line. If the JSON is not valid, you get the line and column of the problem and a plain explanation, for example a trailing comma, a missing quote, single quotes or a comment, which JSON does not allow.
- Numbers stay exactly as written. Many formatters pass JSON through JavaScript, which rounds 12345678901234567890 to 12345678901234567000 and turns 1.50 into 1.5. This one keeps every number character for character.
- Key order is kept, including keys that look like numbers, unless you choose Sort keys.
- Duplicate keys are reported with their line numbers, because most programs silently keep only the last one.
- Tree view shows the structure as folders you can open and close, which helps with large responses.
JSON to CSV and CSV to JSON
JSON to CSV takes a list of objects and makes one row per object. Nested objects are flattened into columns with dot paths, so {"stock": {"web": 12}} becomes a column named stock.web. Lists become one column per item, or stay as JSON in a single cell, and empty lists and objects leave their cells empty. Cells that contain the separator, quotes or line breaks are quoted the standard way, with quotes doubled, so Excel, Google Sheets and Numbers read them correctly.
CSV to JSON detects whether cells are separated by commas, semicolons, tabs or pipes, handles quoted cells with line breaks inside, and turns dot path columns back into nested objects. Numbers, true, false and empty cells become real JSON values. Numbers with leading zeros, such as postcodes and phone numbers, stay as text, and so do whole numbers too large to store exactly.
JSON to YAML and YAML to JSON
The YAML output quotes every value that a YAML reader could take the wrong way: words such as yes, no, on and off, version numbers such as 1.10, numbers with leading zeros, dates, text that starts with a special character or contains a colon followed by a space. Multi-line text is written as a readable block with |.
The YAML reader follows YAML 1.2, the current version, and supports what real config files use: nested mappings and lists, inline [ ] and { } collections, quoted text with escapes, | and > blocks, comments, anchors and aliases, << merge keys and several documents separated by ---. It does not support complex keys that start with ?, and custom tags such as !Ref are dropped while their values are kept. Errors show the line and column.
Base64, URL and HTML encoding
- Base64 encodes text as UTF-8, so accents, emoji and other scripts survive the round trip. Decoding accepts standard and URL-safe Base64, with or without padding and line breaks. If the decoded bytes are not text, such as an image, you see what kind of file it is and can download it. A file of up to 10 MB can be turned into a data URL for HTML or CSS.
- URL encoding has two scopes. One part encodes everything that has a meaning in an address, which is right for a single query value. Whole address keeps characters such as
:,/,?and&and only encodes spaces and other unsafe characters. A full address is split into its parts, with every query parameter decoded. - HTML entities turn
<,>,&and quotes into safe text for HTML, and decoding understands all named entities, such asé, as well as numeric ones.
Unix timestamp converter
A Unix timestamp counts the seconds since 1 January 1970 at midnight UTC. Many systems, including JavaScript, count milliseconds instead, and some use microseconds or nanoseconds. Paste a number and its unit is detected from the number of digits, or set it yourself. You get the date in UTC and in any time zone, ISO 8601 with the offset, the HTTP and email date format, the day of the year, the ISO week and how long ago or how far ahead it is. It also works the other way: type a date and time to get the timestamp.
UUID generator
Make up to 1,000 UUIDs at once. Version 4 is fully random and is the safe default for most uses. Version 7, defined in RFC 9562, starts with a millisecond timestamp, so IDs made later sort after earlier ones, which suits database keys. UUIDs made in one batch keep their order even within the same millisecond. Paste any UUID into Inspect to see its version, its variant and, for versions 1, 6 and 7, when it was made.
Hash generator
Get the MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hash of any text or file at once. The SHA hashes use your browser's built-in Web Crypto, and MD5 is computed by this page. Paste a published checksum into Compare with to check that a download arrived intact: the matching hash is marked whichever algorithm it is. Text is hashed as UTF-8, the same as sha256sum or openssl on a file with that text and no final line break.
Password and passphrase generator
Passwords are built from your browser's cryptographic random number generator, with no bias between characters. Pick the length and the kinds of characters, and leave out characters that are easy to confuse when you read a password aloud or type it from paper. At least one character of every kind you choose is included.
A passphrase strings together random words from a list of about 1,400 short, common English words. Six random words are easier to type and remember than a jumble of symbols and still very hard to guess. The strength shown is the entropy in bits, which assumes an attacker knows exactly how the password was made, and the time is how long trying half of all possibilities would take at ten billion guesses a second.
JWT decoder
A JSON Web Token has three parts: a header, a payload of claims and a signature. Paste a token to read the header and payload, with the exp, nbf and iat times shown as dates and a clear note when the token has expired or is not valid yet.
Decoding is not verifying. Anyone can create a token with any payload, so never trust what a token says until its signature has been checked. For tokens signed with HS256, HS384 or HS512, enter the shared secret to check the signature here with Web Crypto. Tokens signed with RS256, ES256 and other public key methods need the issuer's public key, and this page does not check those.
Regex tester
Type a JavaScript regular expression and some text to see every match highlighted, with a table of positions, numbered groups and named groups, and a live preview of a replacement. Patterns run in a separate background worker with a time limit, so a pattern that would never finish, such as (a+)+$ on a long line of a's, is stopped after a second and a half and the page keeps working.
Privacy
There is no account, no analytics and no server behind this page, and the page is not allowed to make network requests at all. Your inputs and settings for the JSON, CSV, YAML, encoding and regex tabs are kept in this browser's storage so they are still here next time, apart from very long texts. JWTs, secrets, hash inputs and generated passwords are never stored. Press Clear on a tab to remove what it holds.
Questions
Is it safe to paste a production token or API response here?
Everything runs in this tab and nothing is sent anywhere, so the data does not leave your device. As with any secret, close the tab when you are done on a shared computer.
Why do my YAML booleans come out as text?
YAML 1.2 reads only true and false as booleans. Older YAML 1.1 tools also read yes, no, on and off that way, so when one of those appears, you see a note. Quote the value in your YAML to make the intent clear to every tool.
Can I check RS256 tokens?
Not yet. The decoder reads them, but checking needs the issuer's public key, which this page does not take.
Which regex syntax is used?
JavaScript's, as built into your browser, including lookbehind, named groups and Unicode property escapes with the u flag. Most patterns behave the same in other languages, but some features differ, such as possessive quantifiers, which JavaScript lacks.