Developer Tools
Small jobs that interrupt real work: pretty-print a minified API response, find the trailing comma that breaks a config file, read the claims inside a token from a failing login, see when a cron line will really fire, or convert CSS units. Developers, sysadmins and QA engineers can paste real payloads here, because almost every tool processes them locally in the browser.
Runs in your browser
Formatters, encoders, hashing, JWT decoding, regex, cron and converter tools process what you paste on your own device. Nothing you paste into them is uploaded to our servers.
Two tools make network requests
The HTTP Status Checker sends the URL you enter to our server, which fetches it. The API Tester sends your request from your browser straight to the API you name.
Errors that point to the spot
The JSON, JavaScript, CSS, XML and YAML tools report the line and column of the first syntax error, and the JSON tools add a plain-English hint for common mistakes.
Built on real standards
Contrast follows the WCAG formula, JSON checking follows RFC 8259, SHA hashes use your browser's Web Crypto API and UUIDs come from its secure random generator.
The tools most visitors start with, and what each one is for.
Format, beautify, and validate JSON data with proper indentation.
Beautify a minified API response or config file, or minify it again, with a choice of indentation and optional key sorting.
Validate JSON syntax and check for errors.
Find the exact line and column of the trailing comma, single quote or missing bracket that makes a JSON file fail to parse.
Decode and inspect JSON Web Tokens (JWT) in your browser.
Read the header and claims of a JSON Web Token and see whether it has expired, without sending the token anywhere.
Encode and decode Base64 strings instantly.
Encode text or files to Base64, or decode a string, including URL-safe, line-wrapped and unpadded variants.
Test and debug regular expressions in real-time.
Try a JavaScript regular expression against sample text and see every match, its position and its capture groups highlighted.
Generate MD5, SHA1, SHA256, SHA512 hashes from any text.
Compute MD5, SHA-1, SHA-256, SHA-384 or SHA-512 checksums and HMACs for typed text or a file of up to 200 MB.
Parse and understand cron expressions with human-readable descriptions.
Translate a cron expression into plain English and list its next run times in the time zone you choose.
Compare two JSON objects side by side.
Compare two JSON documents and list every added, removed and changed value by path, ignoring key order and whitespace.
Encode and decode URLs for web development.
Percent-encode a query value or a full URL, or decode one to read what it really contains.
Format and beautify SQL queries with proper indentation.
Reformat a long SQL query with consistent indentation and keyword case for MySQL, PostgreSQL, SQL Server and other dialects.
Short explainers that show how the maths or the file format works, and which tool to reach for next.
Developer Guides
Why JSON that looks fine still fails to parse: trailing commas, single quotes, comments, NaN and oversized numbers, and how to validate, format and compare it fast.
Try it: JSON Validator
Developer Guides
Base64 is not encryption and a hash cannot be reversed. See what each does, where JWTs and URL encoding fit, and how to pick MD5, SHA-256 or a password hash.
Try it: Base64 Encoder Decoder
Each group explains what its tools are for, so you can find the right one without scrolling a long list.
Turn minified or messy code into readable, consistently indented text. JavaScript, CSS, HTML, JSON, SQL, XML and YAML are covered, and each formatter reports syntax errors instead of quietly guessing.
Check that something is correct before it ships: strict JSON syntax, the differences between two JSON documents, a regular expression against sample text, and a cron schedule against its upcoming run times.
Encode and decode Base64, Base32 and percent-escaped text, compute MD5 and SHA checksums and HMACs, read the claims inside a JWT, and generate random version 4 UUIDs. All of it runs in your browser.
Move content between formats: Markdown and HTML in both directions with a live preview, XML to JSON, CSS into inline style attributes for HTML email, and a regular expression into a string for JSON or another language.
Inspect the pieces of a web request: split a URL into parts and query parameters, identify a browser from its user agent string, read pasted response headers for security gaps, check a live status code, or send a test API call.
Work out sizes and readability for the front end: convert px, rem, em and vw values, check text and background colors against WCAG contrast thresholds, and make placeholder images for mockups.
Formatters, decoders, hashing and converters run locally, so you can paste real payloads and config files without uploading them. Only two tools make network requests: the HTTP Status Checker and the API Tester.
The JSON, JavaScript, CSS, XML and YAML tools report the line and column of the first syntax error, and the JSON tools explain trailing commas, single quotes, comments and unquoted keys.
Format a response, validate it, diff it against the previous version, decode the token that came with it, then test the regex or cron rule that handles it, all without switching sites.
Open a tool, paste, copy the result. That works on a locked-down work laptop, a colleague's machine or a phone during an incident, where installing a formatter or a plugin is not an option.
The JWT decoder does not verify signatures, the regex tester uses the JavaScript flavor, the cron parser follows Vixie rules, and the hash generator notes that MD5 and SHA-1 are not safe for security use.
Each tool uses an established library or standard where correctness matters. JavaScript, TypeScript, CSS, SCSS, Less, HTML, YAML and Markdown formatting use Prettier; SQL formatting uses the sql-formatter library; Markdown conversion uses marked and Turndown, and the Markdown preview is sanitized with DOMPurify. JSON checking uses a strict RFC 8259 scanner written to give exact line and column positions. Hashes come from the Web Crypto API, plus a separate MD5 implementation because Web Crypto leaves MD5 out, and cron parsing uses the cron-parser and cronstrue libraries. Where a tool has known limits, such as unverified JWT signatures or Vixie-only cron syntax, its page says so.
The JWT Decoder here decodes in your browser and the token is not sent anywhere, but safety also depends on the token. A live token is a credential: anyone who holds it can use it until it expires. Prefer expired or test tokens, rotate a token you pasted into a site you do not control, and remember that the decoder checks structure and claims but does not verify the signature.
No. Base64 is an encoding that turns bytes into 64 printable characters. Anyone can reverse it, and it makes data about a third larger. It exists to carry binary data through text-only channels such as JSON, email and data URLs. To keep something secret you need encryption, and to store a password you need a slow, salted hash. Base64 provides neither.
Strict JSON rejects several things that JavaScript accepts: trailing commas, single quotes, unquoted keys, comments, NaN and Infinity values, leading zeros in numbers and raw line breaks inside strings. An invisible byte order mark at the start of a file fails too. The JSON Validator shows the line and column of the first error and explains the usual causes.
Use SHA-256 or SHA-512 and compare the result with the checksum the publisher lists. MD5 and SHA-1 still catch accidental corruption but are broken against deliberate tampering. The Hash Generator reads files up to 200 MB in your browser. Plain hashes are not a way to store passwords, which need a salted, deliberately slow algorithm such as bcrypt or Argon2.
It uses your browser's JavaScript regular expression engine, so patterns written for other flavors may behave differently or fail. Possessive quantifiers and atomic groups, for example, do not exist in JavaScript. Test JavaScript patterns directly, and use Regex to String to get a pattern as a JSON string, a JavaScript constructor call or a Python raw string.
It follows common Vixie cron rules: five fields, an optional leading seconds field, names such as MON and JAN, and shortcuts like @daily. Quartz extras such as L, W and # are not supported. It lists upcoming runs in the time zone you pick, which helps because cron normally uses the server's time zone, often UTC.
Two. The HTTP Status Checker sends the URL you enter to our server, which requests it and reports status, redirects, timing and SSL details; it only checks public addresses and is rate limited. The API Tester sends requests from your browser directly to the API you enter, so that API must allow cross-origin requests (CORS) for the call to succeed. Every other tool stays in the page.
Includes JavaScript Minifier, CSS Minifier, HTML Minifier and more.
13 tools →
Includes HTML Validator, JSON Schema Validator, CSS Validator and more.
15 tools →
Includes Server Status Checker, DNS Lookup, Redirect Checker and more.
6 tools →
Includes Password Generator, QR Code Generator, Invoice Generator and more.
46 tools →
Looking for something that is not here? Tell us which tool you need, or browse all tools.