Web Toolkit

Developer tools

Format, decode and inspect the data formats you work with every day — plus the generators that go with them.

JSON FormatterFormat, validate and minify JSON with precise error positions.JWT DecoderDecode a JSON Web Token and read its header, payload and expiry.QR Code GeneratorCreate QR codes for links, text, Wi-Fi and contact cards.Regex TesterTest regular expressions live with highlighted matches and capture groups.Base64 Encoder / DecoderConvert text to Base64 and back, with correct UTF-8 handling.Cron Expression ParserExplain a cron expression in plain English and preview the next runs.SQL FormatterBeautify SQL queries with dialect-aware keyword casing and indentation.YAML FormatterValidate and reformat YAML, or convert it to JSON.Hash GeneratorCompute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text.URL Encoder / DecoderPercent-encode and decode URLs, with component and full-URL modes.UUID GeneratorGenerate cryptographically random UUID v4 identifiers in bulk.

These tools are needed at the worst possible moment: a webhook payload arrives on one unreadable line, a token has to be checked before a deploy goes out, a config file will not parse and the error message points at "line 1".

Which one to reach for is mostly about what you are trying to learn. Use the JSON and YAML formatters when you need to read a structure, and watch their error output when you need to know why a parser rejected it — the position of the first invalid character is usually the whole answer. Base64 and URL encoding look interchangeable and are not: one is a transport alphabet for binary data, the other escapes characters that would otherwise break a query string, and swapping them corrupts data silently. Reach for the regex tester before you paste a pattern into code, and the cron parser before you trust a schedule expression that runs at 3am.

The generators cover the other half of the job: producing an artefact rather than reading one. UUIDs come from the Web Crypto API, so they are random in the sense that matters. The QR code generator renders a static image pointing directly at whatever you entered — no shortener, no redirect through a tracking domain, no expiry. That distinction matters more than it sounds: most free QR services quietly route scans through their own server, which means the code stops working when they change their pricing, and every scan is logged by someone you did not choose. A code generated here has no owner but you.

Anything touching a credential — JWTs, hashes — is decoded here in your browser and never transmitted. That still is not a licence to paste live secrets into web pages: a token you have pasted anywhere is a token worth rotating. The same holds for what you encode: Wi-Fi credentials, a private URL, contact details inside a QR code — none of it is transmitted, so generating a code for something that is not meant to be public is safe.

Guides

How to read and fix broken JSONAlmost every JSON parse error comes from one of five mistakes. Here is how to find which one, from the error message alone.MD5, SHA-1 or SHA-256: choosing a hash functionMD5 is broken and still useful. SHA-256 is the default and still not a password hash. The distinction is what the hash is protecting against.Sizing and compressing images for the webMost slow pages are slow because of one image. Fixing it is two decisions — dimensions, then format — taken in that order.Cron expressions that run when you expectCron is five numbers and a pile of assumptions. Almost every schedule that misfires breaks on one of four of them.Regular expressions that do not surprise youA pattern that works on your three test strings and fails in production usually fails for one of six reasons.Base64, percent-encoding and which one you needBase64 makes binary survive a text channel. Percent-encoding makes text survive a URL. Swapping them corrupts data quietly.

Other categories