DevToolChain
Developer utilities that keep your data on your device. Every tool runs in your browser, so what you paste is not sent anywhere.
Tools
- JSON formatterFormat, validate and repair JSON in your browser: errors by line and column, every fix listed, sorted keys, a collapsible tree and string escaping.
- JSON diffCompare two JSON documents in your browser. Key order is ignored, array order optionally, and every change is listed by JSON Pointer and as a JSON Patch.
- YAML to JSONConvert YAML to JSON and JSON to YAML in your browser, with exact error positions and warnings where YAML 1.1 and 1.2 read a value differently.
- Base64Encode text or files to Base64 or a data URI and decode Base64 in your browser; images and PDFs are recognized, previewed and saved with the right extension.
- URL encoderPercent-encode and decode text for URLs and split a URL into its parts and query parameters, locally in your browser.
- HTML entitiesEncode text as HTML entities or decode named, decimal and hexadecimal character references such as &, © and 😀. Runs in your browser.
- JWT decoderDecode, verify and create JSON Web Tokens in your browser: HS, RS, PS, ES and EdDSA signatures with a secret, PEM key, JWK or JWK Set. Nothing is sent.
- Unix timestampConvert Unix timestamps in seconds, milliseconds, microseconds or nanoseconds to dates in any time zone, and dates back to timestamps.
- Cron expressionExplain a cron expression in plain English and list its next run times in any time zone: Unix crontab, 6-field with seconds, Quartz and AWS EventBridge.
- UUID generatorGenerate random v4 or time-ordered v7 UUIDs and ULIDs in your browser, or decode a UUID or ULID: version, variant, embedded time and conversion.
- Lorem ipsum generatorGenerate Lorem ipsum placeholder text by paragraphs, sentences or words, with or without the classic opening and HTML paragraph tags. Runs in your browser.
- Hash generatorCalculate MD5, SHA-1, SHA-256, SHA-512, SHA-3 and CRC32 checksums of text, hex, Base64 or files in your browser and compare them with an expected hash.
- HMAC generatorCalculate HMAC-SHA256, SHA-384 or SHA-512 in hex or Base64, and verify GitHub, Stripe and Slack webhook signatures in your browser. Secrets are not stored.
- Self-signed certificateCreate a self-signed X.509 certificate and private key for testing: ECDSA P-256 or RSA 2048, host names and IP addresses, PEM download, all in your browser.
- CSR generatorGenerate a certificate signing request and its private key in your browser: ECDSA or RSA, host names, organization fields and the matching OpenSSL command.
- Certificate decoderDecode PEM or DER X.509 certificates, chains and CSRs in your browser: names, SANs, expiry, key size, fingerprints, extensions and chain order.
- Regex testerTest JavaScript regular expressions against your own text: matches, positions and capture groups, with protection against runaway patterns.
- Text diffCompare two texts in your browser: changed lines with the changed words or characters marked, side by side or unified, exported as a diff. Nothing is uploaded.
- Color converterConvert colors between HEX, RGB and HSL and check the WCAG contrast ratio of a text color on a background.
What you can do here
Each page holds one tool and the reference you usually need next to it: the rules of the format, a worked example and the mistakes that cause most problems.
- Check, convert, repair and compare data: JSON formatter, JSON diff, YAML to JSON, text diff.
- Encode and decode: Base64, URL encoding, HTML entities, color notations.
- Inspect values that are hard to read by eye: JSON Web Tokens (with signature verification), X.509 certificates and CSRs, cron expressions, Unix timestamps, UUIDs and ULIDs.
- Create test data and keys: UUIDs and ULIDs, Lorem ipsum placeholder text, signed test JWTs, CSRs and self-signed certificates.
- Check values: MD5, SHA-2, SHA-3 and CRC32 checksums, HMACs and webhook signatures, regular expressions.
Why the tools run locally
Text that developers paste into a tool often contains things that should not leave the company: access tokens, customer records, internal addresses. A tool that sends its input to a server asks you to trust that server.
The tools on this site are JavaScript programs that run inside the page. The input is read, processed and shown by your browser. No tool sends what you enter to us or to anyone else, and no part of the site accepts it.
You can check this yourself. Open the network panel of the developer tools of your browser, use a tool, and watch the list of requests: using a tool adds no request that carries your input.
What is stored on your device
Nothing you enter is stored unless you ask for it. Every tool with text fields has the option “Remember my input on this device”, which is off at first. When you turn it on, the fields of that tool are kept in the local storage of your browser until you turn the option off again.
The only other stored value is your choice of appearance: light, dark or system.
Working with the keyboard
All tools share the same shortcuts, which work while the focus is inside the tool.
| Keys | Action |
|---|---|
| Ctrl + Enter or ⌘ + Enter | Run the tool |
| Alt + Shift + C | Copy the result |
| Alt + Shift + X | Clear all fields |
Most tools also show the result while you type. Every action has a button as well, so the tools work the same way with a touch screen.
Limits you should know
- The tools need JavaScript. Without it you can still read every page.
- Very large input is not processed while you type; you start the run with the button. Long results are shown in part and copied or downloaded in full.
- Pages where you enter secrets, create private keys or decode certificates (JWT, HMAC, CSR, certificate generator and certificate decoder) show no ads. Still, prefer test keys, and create production keys on your own machine, for example with OpenSSL.
- Certificates from the certificate generator are self-signed and meant for testing. Nobody trusts them until you install them yourself.
- Results depend on your browser for some details, for example the list of time zones and the dialect of regular expressions.
Frequently asked questions
- Is my input sent to a server?
- No. The tools process your input in the browser. Pages, styles and scripts are loaded from the site, but nothing you type, paste or choose as a file is transmitted.
- Do I need an account?
- No. The site has no accounts and no sign-up.
- Do the tools work offline?
- A page that is already open keeps working without a connection, because the processing happens in your browser. The exception is the regular expression tester, which loads its background worker when you run the first test. The site does not install anything for offline use, so opening a new page needs a connection.
- Can I paste production secrets?
- The tools do not transmit or store what you paste, unless you turn on the option to remember input. Whether pasting a secret into any web page is acceptable is still a decision for you and the rules of your organization. Browser extensions, for example, can read the pages you open.
- Where are the tools of the earlier DevToolChain site?
- The Base64, JWT and Lorem ipsum tools of the earlier version of this site are here, and their old addresses forward to the new pages. The Chinese interface of the earlier site is not available.
- How is the site paid for?
- The site is free to use. It is planned to show advertisements, placed below the tools and clearly labeled. Advertisements are provided by third parties and are described in the privacy policy.