About Developer Tools

Seventeen small utilities for the two-minute jobs that break your concentration — and nothing else.

Every one of these pages started as a browser tab someone opened while debugging: what is inside this token, what does this cron line mean, is this payload even valid JSON. The usual answer is whichever result a search engine puts first, which is normally a page that posts your text to somebody's server and shows you the reply. Most of these tools do the same job with the same code your browser already runs, so the text stays where you pasted it. Responsive Preview is the exception: scripts and remote resources in pasted HTML can send preview content elsewhere, and URL mode sends the address to the destination site.

The seventeen tools

• JSON formatter — re-indents JSON at two spaces, four spaces or a tab, minifies it back to one line, and reports the line and column when it will not parse.
• YAML to JSON — converts as you type, returns multi-document files as an array, and points at the exact line of a parse error.
• JSON to YAML — the other direction, keeping your key order and quoting the strings older YAML parsers would read as booleans.
• Base64 encode — encodes UTF-8 properly, so accented letters and emoji survive instead of throwing the error a bare btoa call gives you. URL-safe alphabet optional.
• Base64 decode — tolerates line breaks, whitespace, the URL-safe alphabet and missing padding, and names the offending character when a string is not valid.
• URL encoder and decoder — switches between whole-URL and single-component escaping, and splits a query string into its named values.
• UUID generator — up to a hundred version-4 UUIDs at a time from crypto.randomUUID, in lowercase, uppercase or brace-wrapped form.
• Unix timestamp converter — epoch to date and back, guessing seconds, milliseconds or microseconds from the magnitude and telling you which it assumed.
• JWT decoder — splits a token into header and payload, turns exp, iat and nbf into readable dates, and says whether it has expired.
• Cron expression parser — one plain-English sentence per expression, every field expanded, and the next five fire times in your time zone and UTC.
• JSON and YAML validator — the line, column and byte offset of a syntax error, the offending line reprinted with a caret under it, and the usual cause named: a trailing comma, a single quote, a tab used for YAML indentation.
• CSV cleaner — a proper RFC 4180 parser with delimiter detection, then trimming, empty and duplicate row removal, header normalisation, and per-column keep or rename.
• Diff checker — a line diff with the usual whitespace and case options, or a structural JSON diff that names every changed path rather than every changed line.
• Time zone converter — one instant shown in as many zones as you add, with UTC offsets, zone abbreviations and whether daylight saving applies at that moment.
• JWT security checker — the same decode as above, followed by an audit of what the token's own header and claims give away, ranked by severity.
• Batch filename renamer — find and replace, case rules, numbering and web-safe cleanup over a list of names, with collision warnings and a correctly quoted rename script.
• Responsive viewport preview — pasted HTML or a URL rendered at phone, tablet and laptop viewport sizes, with the true pixel size and scale stated.

What they deliberately do not do

The JWT decoder does not verify signatures. Checking one means holding the signing key, and a browser page has no business asking you for that — the moment you paste an HMAC secret into a web form you have leaked it, whatever the page promises. Decoding is a Base64 split and a JSON parse; verification belongs in your service, your test suite or a command line with the key already on disk. The tool says as much on its own page rather than showing a reassuring green tick it cannot honestly earn.

The JSON pages validate syntax, not shape. There is no JSON Schema support, so a document that parses will be reported as good even if it is missing every field your API requires. Nor is there a query language: no JSONPath, no jq expression box, no filtering a large response down to one branch. Those are genuinely useful, and they are also where a small tool turns into a product with its own bugs and its own documentation. If you need them, your editor and jq already have them and run closer to your data.

The diff checker compares text and JSON only — it does not merge, it does not produce a patch you can apply, and it has no three-way mode. Also absent: converting between more exotic formats, generating example data, and any kind of saved history. Nothing you type is remembered between visits, which means a shared machine cannot betray the last person who used it.

Why there is no sign-in

An account would have to be worth its own risk. It would mean an email address on file, a password reset path, a session cookie and a database that records which tool each person opened and when — a set of records that would need protecting, disclosing in a policy and eventually deleting on request. In exchange you would get nothing, because none of these tools produce anything worth carrying between sessions: a formatted document belongs in your repository, not in someone else's storage. Removing the account removes the breach.

How the pages are built

Each tool is one HTML file, one shared stylesheet and one script of a few kilobytes, written in plain JavaScript with no framework and no build step. Two pages — the YAML converters — also load a copy of the js-yaml parser, served from this domain rather than a CDN, because parsing YAML correctly by hand is a bad idea. There are no web fonts, no images and no third-party scripts. Most tools load their code from this domain and then stop talking to the network; Responsive Preview can load remote resources in pasted HTML and URL mode sends the address to the destination site.

The logic in each script is written as ordinary functions and exercised by a small test file that runs under Node, covering the awkward inputs: leap years in cron ranges, timestamps before 1970, Base64 without padding, tokens with a missing segment. That is why the error messages are specific — the failure modes were written down before the interface was.

Who made it

One developer, maintaining the site in spare hours. It is free, and the advertising slots you can see marked out on the tool pages are planned to help pay for hosting if they go live. If a tool gets something wrong, or refuses input it ought to accept, tell me about it — a redacted example is usually enough to reproduce the problem.