About Developer Tools

Ten small utilities for the two-minute jobs that break your concentration — and nothing else.

Every one of these pages started as a browser tab someone opened while debugging: what is inside this token, what does this cron line mean, is this payload even valid JSON. The usual answer is whichever result a search engine puts first, which is normally a page that posts your text to somebody's server and shows you the reply. These do the same job with the same code your browser already runs, so the text stays where you pasted it.

The ten tools

• JSON formatter — re-indents JSON at two spaces, four spaces or a tab, minifies it back to one line, and reports the line and column when it will not parse.
• YAML to JSON — converts as you type, returns multi-document files as an array, and points at the exact line of a parse error.
• JSON to YAML — the other direction, keeping your key order and quoting the strings older YAML parsers would read as booleans.
• Base64 encode — encodes UTF-8 properly, so accented letters and emoji survive instead of throwing the error a bare btoa call gives you. URL-safe alphabet optional.
• Base64 decode — tolerates line breaks, whitespace, the URL-safe alphabet and missing padding, and names the offending character when a string is not valid.
• URL encoder and decoder — switches between whole-URL and single-component escaping, and splits a query string into its named values.
• UUID generator — up to a hundred version-4 UUIDs at a time from crypto.randomUUID, in lowercase, uppercase or brace-wrapped form.
• Unix timestamp converter — epoch to date and back, guessing seconds, milliseconds or microseconds from the magnitude and telling you which it assumed.
• JWT decoder — splits a token into header and payload, turns exp, iat and nbf into readable dates, and says whether it has expired.
• Cron expression parser — one plain-English sentence per expression, every field expanded, and the next five fire times in your time zone and UTC.

What they deliberately do not do

The JWT decoder does not verify signatures. Checking one means holding the signing key, and a browser page has no business asking you for that — the moment you paste an HMAC secret into a web form you have leaked it, whatever the page promises. Decoding is a Base64 split and a JSON parse; verification belongs in your service, your test suite or a command line with the key already on disk. The tool says as much on its own page rather than showing a reassuring green tick it cannot honestly earn.

The JSON pages validate syntax, not shape. There is no JSON Schema support, so a document that parses will be reported as good even if it is missing every field your API requires. Nor is there a query language: no JSONPath, no jq expression box, no filtering a large response down to one branch. Those are genuinely useful, and they are also where a small tool turns into a product with its own bugs and its own documentation. If you need them, your editor and jq already have them and run closer to your data.

Also absent: diffing two documents, converting between more exotic formats, generating example data, and any kind of saved history. Nothing you type is remembered between visits, which means a shared machine cannot betray the last person who used it.

Why there is no sign-in

An account would have to be worth its own risk. It would mean an email address on file, a password reset path, a session cookie and a database that records which tool each person opened and when — a set of records that would need protecting, disclosing in a policy and eventually deleting on request. In exchange you would get nothing, because none of these tools produce anything worth carrying between sessions: a formatted document belongs in your repository, not in someone else's storage. Removing the account removes the breach.

How the pages are built

Each tool is one HTML file, one shared stylesheet and one script of a few kilobytes, written in plain JavaScript with no framework and no build step. Two pages — the YAML converters — also load a copy of the js-yaml parser, served from this domain rather than a CDN, because parsing YAML correctly by hand is a bad idea. There are no web fonts, no images and no third-party scripts, so a tool loads in one round trip and then stops talking to the network entirely.

The logic in each script is written as ordinary functions and exercised by a small test file that runs under Node, covering the awkward inputs: leap years in cron ranges, timestamps before 1970, Base64 without padding, tokens with a missing segment. That is why the error messages are specific — the failure modes were written down before the interface was.

Who made it

One developer, maintaining the site in spare hours. It is free and paid for by the advertising slots you can see marked out on the tool pages; those slots know nothing about you beyond the page they sit on. If a tool gets something wrong, or refuses input it ought to accept, tell me about it — a redacted example is usually enough to reproduce the problem.