About the Utility Tools
Thirty-nine small utilities that each solve one problem in a few seconds: decode a JWT to see why it is being rejected, generate a UUID, work out what a cron expression actually means, check whether a colour pair passes contrast requirements, convert a Unix timestamp into something human.
They are grouped on one page so you can search rather than remember where each one lives, and every one of them runs in your browser. That last point matters more than it sounds: pasting a JWT, a password hash, or a TOTP secret into a random online tool means handing a credential to a stranger, and these tools are structured so there is nothing to hand over.
When you'd use it
- Decoding a JWT to inspect its claims and check whether it has expired.
- Converting a Unix timestamp from a log line into a readable date in your timezone.
- Working out what "0 2 * * 1-5" means before deploying a cron job.
- Checking a foreground and background colour pair against WCAG contrast ratios.
- Generating UUIDs, secure passwords, or realistic fake data for tests.
- Testing a regular expression against sample input with live match highlighting.
Encoding and text
Base64, URL encoding, HTML entities, number base conversion, case conversion, and text statistics. These convert between representations and are the most-used tools on the page.
The distinction worth remembering: encoding is not encryption. Base64 is a way of representing binary data as text so it survives channels that only handle text. It provides no confidentiality whatsoever — anyone can decode it instantly. A Base64 blob in a config file is not a secret that has been protected, it is a secret that has been made slightly less obvious.
Security and crypto
JWT decoding, bcrypt hashing, TOTP code generation, RSA and HMAC signatures, AES encryption, and general-purpose hashing.
The JWT tool decodes and displays claims but does not verify signatures against a secret you type in, which is deliberate. Two things follow from how JWTs work: the payload is Base64URL, not encrypted, so anyone holding the token can read every claim in it — never put anything sensitive in one. And the algorithm field in the header is attacker-controlled, which is the source of the classic vulnerability where a server is tricked into accepting alg: none. Always pin the expected algorithm server-side rather than reading it from the token.
Hashing is one-directional by design. There is no "decrypt this hash" tool here or anywhere else — a site claiming otherwise is looking the value up in a table of precomputed common inputs, which is exactly why password hashes need a per-password salt, and why bcrypt has a tunable cost factor.
Web, SEO, and design
Meta and Open Graph tag builders, a favicon generator, robots.txt and sitemap builders, a .gitignore generator, a gradient and shadow builder, a CSS clamp calculator, and a contrast checker.
The contrast checker is the one worth using habitually. WCAG requires a ratio of at least 4.5:1 for normal text and 3:1 for large text at AA level, and the ratio is not something you can judge by eye — a mid-grey on white looks fine to someone with good vision on a good screen and fails badly for everyone else.
Data, schema, and generators
JSON Schema tooling, an OpenAPI viewer, a GraphQL formatter, a SQL formatter, a CSV viewer, an environment-file converter, and generators for UUIDs, passwords, Lorem Ipsum, QR codes, and fake test data.
The generators are for test data, not production secrets. Values generated here come from your browser's cryptographic random source where randomness matters, but a password you generate in a web page and then paste through a clipboard has passed through more places than one generated by a password manager.
Frequently asked questions
- Do any of these send data to a server?
- No. All thirty-nine run in your browser, which is why they work offline once the page has loaded and why pasting a real token or hash into them does not disclose it.
- Why does the JWT tool not verify my signature?
- Verification needs the signing key. Pasting a production signing secret into a web page is precisely the thing you should not do, so the tool decodes and inspects rather than asking for it.
- Are generated UUIDs and passwords actually random?
- They use the Web Crypto API's cryptographically secure random number generator, not Math.random. That is the right source. For credentials you will actually rely on, a password manager that generates and stores in one step is still better practice.
- Can I link to a specific tool?
- Yes. Each has a URL of the form /tools?tool=<id> — for example /tools?tool=jwt — which opens the page scrolled to that tool.
- Why is everything on one page?
- Searching one page is faster than navigating thirty-nine. Tools load as you scroll to them, so the initial page load only fetches what is visible.