// 143 developer & data tools — paste, transform, copy
Paste. Transform. Copy. The dev console for the utilities you reach for mid-task.
120+ encoders, JSON tools, hashers, regex testers, formatters, Mermaid renderers and payment-data decoders — all client-side. Your keys, tokens and payloads never leave the tab.
Six families, one keystroke away
Grouped the way you think about them, not by file type.
Every tool here exists because a developer hit a wall mid-task: a token that wouldn't decode, JSON that wouldn't parse, a regex that matched everything except the one case that mattered. The catalog is organized into the families you actually search for — encoders, structured-data tooling, cryptographic primitives, pattern matching, code formatters, and payment-data decoders. Pick a family, land on a tool, paste your input, read the output. There is no project to create, no API key to provision, and no rate limit waiting to bite you on the tenth request. Each transform is a pure function of what you paste: same input, same output, no hidden server state, no session cookie deciding what you're allowed to see. Treat the whole catalog like a local bin/ directory you didn't have to install.
Encoders & decoders
Base64, Base32, URL, HTML entities, hex and binary — round-trip any of them. Paste a Base64 blob and read it back, or encode a string for a query param. Each codec is its own page, so you can deep-link the exact transform from a ticket or a script comment.
JSON & structured data
Format, validate, diff, flatten, and generate types from a sample payload. Turn an API response into a TypeScript interface, a Go struct, or a JSON Schema without leaving the browser. Validation reports the line and column of the first syntax error instead of a vague 'unexpected token'.
Hashing & crypto
SHA-256, SHA-1, MD5, HMAC signatures and bcrypt hashes computed in-page. Verify a release checksum, sign a webhook body to match what your server expects, or hash a candidate string to confirm a stored digest. The Web Crypto API does the heavy lifting natively.
Regex & pattern matching
Test a pattern against live input with match highlighting and named capture groups before you paste it into code. Tweak a character class and watch the matches repaint — no more print-debugging your quantifiers one console.log at a time.
Formatters & beautifiers
SQL, XML, YAML, CSS, JS and HTML — pretty-print minified output or normalize a messy query into something diff-able and reviewable. Paste the one-line blob your build emitted and get back indentation a reviewer can actually read in a pull request.
Payment-data utilities
Decode EMV TLV chip data into named tags, look up BINs and MCCs, validate IBANs and Luhn-check PANs. Niche tooling that's hard to find anywhere else, built for the engineer staring at a hex dump from a terminal log at 2am.
The loop, with zero ceremony
Paste → transform → copy. Three steps, no account, no upload.
The whole interaction is a read-eval-print loop you already know from the shell. You paste, the page evaluates locally, you read the result, you copy it back into whatever you were doing. No build step, no npm install, no auth handshake standing between you and the answer. Because every step runs against the JavaScript engine in the tab you already have open, there's nothing to wait on — the transform is bound by your CPU, not a round-trip to someone else's server. Keep the tab pinned and it behaves like a scratchpad that's always one keystroke from whatever encode/decode/hash you need next.
- 1
1 · Paste your input
Drop a token, a JSON blob, a string, a raw query or a Mermaid definition straight into the input field. No request fires on paste — the data lands directly in the in-browser engine's scope and goes nowhere else. Your clipboard is the only thing that touched it.
- 2
2 · Transform in the browser
Encoding, hashing, formatting and parsing run as JavaScript or WebAssembly on your own machine. Output updates as you type, so you can flip a flag, fix a regex, or reshape a payload and watch the result recompute live without re-submitting anything.
- 3
3 · Copy and move on
One click copies the result to your clipboard. No watermark, no 'sign up to export,' no truncated free-tier output. Close the tab and the in-memory data is gone with it — nothing was persisted because nothing was ever sent.
Spotlight: JWT Decoder
The one you'll bookmark first.
A JSON Web Token looks like three Base64url chunks joined by dots: header.payload.signature. The decoder splits on the dots, Base64url-decodes the header and payload, and pretty-prints the claims so you can read exp, iat, iss, aud and your custom fields at a glance — exactly what you want when an auth flow returns a 401 and you need to know whether the token is malformed, expired, or scoped wrong before you start blaming the gateway.
The important part: decoding is not verifying. Anyone can read a JWT's payload because Base64url is encoding, not encryption — the signature is what proves the token wasn't tampered with, and verifying it requires the issuer's secret (HS256) or public key (RS256). So treat the payload as readable-but-untrusted, never put secrets in it, and always verify the signature server-side before you act on a claim. Because the decoder is pure client-side JavaScript, pasting a production token to inspect it doesn't ship it to a third-party API — no request fires, and the token never leaves the tab. You can confirm that yourself: open DevTools, watch the Network panel stay silent while the claims render. Pair it with the HMAC generator when you're debugging an HS256 signature mismatch, or the Base64 tools when a single chunk refuses to decode and you want to inspect the raw bytes by hand.
Decode JWT
Split the token on its dots and read the header and payload claims. Spot an expired `exp` or a wrong `aud` in seconds instead of pasting it into yet another tab.
Open tool →Check an HS256 signature
Recompute the HMAC over `header.payload` with your shared secret and compare it byte-for-byte against the token's third segment to confirm it validates.
Open tool →Inspect a stubborn chunk
Base64url-decode a single segment by hand when the whole token won't parse — usually it's missing padding or a `+`/`-` alphabet mismatch you can spot instantly.
Open tool →Encoding vs. hashing vs. encryption
The distinction that trips up more code reviews than it should.
These three get used interchangeably in bug reports and Slack threads, and they are not the same operation. Encoding is a reversible format change with no secret — Base64 exists to move binary safely through text channels, and anyone can decode it. Hashing is a one-way fingerprint — you can't recover the input, which is exactly why it's right for password storage (bcrypt) and integrity checks (SHA-256), and exactly why it's wrong for anything you need to read back. Encryption is reversible but only with a key — it's the one of the three that actually provides confidentiality. Reach for the wrong one and you either leak data you assumed was protected or permanently lock yourself out of data you needed back. The table below is the cheat sheet to paste into your next design review when someone says 'just Base64 it' about a password.
| Operation | Reversible? | Needs a key? | Use it for | Tool |
|---|---|---|---|---|
| Base64 encode | Yes — anyone | No | Transport-safe text, data URIs, token segments | base64-encode |
| URL encode | Yes — anyone | No | Query strings, path segments, form bodies | url-encode |
| SHA-256 hash | No | No | Integrity checks, content fingerprints | hash-text |
| HMAC | No | Yes (shared secret) | Signing webhooks & API requests | hmac-generator |
| bcrypt | No (verify only) | No (salt embedded) | Password storage & verification | bcrypt-hash |
Browse by category
Four lanes covering the full catalog.
If you'd rather scan than search, the 120+ tools sort into four lanes. Text and encoding is the deepest — it's where the day-to-day codecs and crypto primitives live. Developer utilities covers the formatters and network-math helpers you reach for during a debugging session. Diagrams turns a Mermaid definition into a file you can attach to a README. Payment data is the specialist corner most generic tool sites skip entirely. Every lane links straight to a working tool, so browsing the category is one click from actually running the transform.
Text & Encoding
Encode, decode, format and transform text.
Dev
Code formatters, minifiers, beautifiers — HTML, CSS, JS, SQL, XML, YAML.
Diagram
Render diagrams from code — Mermaid → SVG, PNG, JPG, PDF.
Payment & cards
Card-industry utilities — Luhn checks, BIN lookup, EMV TLV decoding, PIN blocks, KCV, ISO 4217 / 3166 / MCC codes.
What you're working with
120+
developer & data tools across four categories
0
uploads — every transform runs in your browser
No sign-up
no account, no API key, no rate limit
10
in-depth field guides on the concepts behind the tools
Field guides
The why behind the tools — read these once and stop second-guessing.
Short, practical write-ups for the questions that come up at the keyboard: what Base64 actually does to your bytes, why a JWT payload is readable by anyone holding the string, when to reach for a UUID versus a ULID, and how bcrypt's work factor protects a password database. No filler, no SEO padding — each guide is the explanation you'd want from the senior engineer who already debugged this once. Every one links straight to the matching tool, so you can run the transform in one tab while you read about it in the other.
Cron Expressions Explained, with Real Examples
A practical guide diving into cron expressions, with specific examples to aid in scheduling tasks effectively.
Read guide →How to Hash Passwords Correctly with Bcrypt
A developer's guide to implementing bcrypt for secure password hashing. This guide covers best practices and pitfalls to avoid.
Read guide →URL Encoding Explained: Percent-Encoding and When You Need It
Understand URL encoding, its significance in web communication, and when to utilize percent-encoding in your applications.
Read guide →UUID vs ULID: Choosing Identifiers for Your Database
A detailed comparison of UUID and ULID as database identifiers, highlighting pros, cons, and practical examples.
Read guide →How to Test and Debug Regular Expressions
A precise guide on how to effectively test and debug regular expressions using in-browser tools and best practices for regular expression development.
Read guide →Hashing vs Encryption: MD5, SHA-256 and When to Use Each
Understanding the differences between hashing and encryption is crucial for developers. This guide explores MD5 and SHA-256, their use cases, and when to implement each.
Read guide →Why client-side matters here
Most of what you'll paste into these tools is sensitive: a production JWT, an API key you're HMAC-signing, a customer's PAN, a JSON payload thick with PII. On the typical 'online tool' site, that input is POSTed to a server you don't control, parsed by code you can't read, and logged somewhere you'll never audit. For a developer toolbox that handles credentials, that's an unacceptable default — it turns a quick decode into a data-egress event.
So the transforms here are wired the other way around: they run against the JavaScript engine in your tab. Encoding, decoding, hashing, JSON formatting, regex matching and Mermaid rendering all execute locally — no request fires, and the key never leaves the tab. You don't have to take that on faith. Open DevTools, switch to the Network panel, and run any text transform: you'll watch the request list stay empty while the output updates. It's the same reason these tools keep working with your wifi off once the page has loaded, and the same reason there's no account to create — there's no server-side session to attach you to in the first place.
The honest caveat: a few file-output tools (rendering a Mermaid diagram to PDF, for instance) do heavier lifting and are labeled accordingly. The rule of thumb stays simple — the paste-and-transform text utilities are pure client-side, and your tokens, keys and payloads stay in the tab where you typed them.
Open a tab, paste, ship
Bookmark the three you'll use daily.
JSON FormatterThe full toolbox
Every encoder, formatter, hash and decoder — search or browse.
qr-code-reader
Text & EncodingScan a QR code from any image and decode it to text — free, online, runs entirely in your browser.
mermaid-to-svg
DiagramRender a Mermaid diagram as a scalable SVG — paste the code or upload an .mmd file.
mermaid-to-png
DiagramRender a Mermaid diagram as a high-resolution PNG — paste the code or upload an .mmd file.
mermaid-to-jpg
DiagramRender a Mermaid diagram as a JPG image — paste the code or upload an .mmd file.
mermaid-to-pdf
DiagramRender a Mermaid diagram as a single-page PDF — paste the code or upload an .mmd file.
qr-code-generator
Text & EncodingGenerate a QR code from any text, URL or contact data — pick error correction and scale, get a PNG.
file-to-hex
Text & EncodingConvert any file's bytes to a hex dump (with ASCII sidecar), plain hex, C array or comma-separated bytes.
hex-to-file
Text & EncodingParse a hex dump or hex string back into a binary file — strips offsets, ASCII columns, prefixes and separators automatically.
wifi-qr-code-generator
Text & EncodingGenerate a Wi-Fi QR code as a PNG — scanning it auto-joins the network. Supports WPA / WEP / open networks and hidden SSIDs.
vcard-qr-code-generator
Text & EncodingGenerate a QR code that contains a digital business card (vCard) — scanning it lets the phone save the contact in one tap.
barcode-generator
Text & EncodingGenerate a 1D barcode (CODE128, EAN-13, UPC-A, CODE39, ITF-14, MSI, codabar, pharmacode) as a downloadable PNG.
base64-encode
Text & EncodingEncode any text to Base64 (and URL-safe Base64) — runs locally in your browser, free and online.
base64-decode
Text & EncodingDecode Base64 or URL-safe Base64 strings back to UTF-8 text — runs locally in your browser.
url-encode
Text & EncodingPercent-encode text for safe use in URLs — supports both encodeURIComponent and encodeURI.
url-decode
Text & EncodingDecode percent-encoded URL text back to its readable form — supports decodeURIComponent and decodeURI.
jwt-decoder
Text & EncodingDecode a JSON Web Token to inspect its header and payload — runs locally, your token never leaves the browser.
hash-text
Text & EncodingCompute MD5, SHA-1, SHA-256, SHA-384 or SHA-512 of any text — runs locally in your browser.
uuid-generator
Text & EncodingGenerate cryptographically random UUIDs (v4) or time-ordered UUIDs (v7) — runs locally in your browser.
json-formatter
Text & EncodingPretty-print or minify any JSON document — validates structure and reports parse errors with position.
text-case-converter
Text & EncodingConvert any string to lowercase, UPPERCASE, Title Case, camelCase, snake_case, kebab-case and more — all at once.
lorem-ipsum
Text & EncodingGenerate placeholder lorem ipsum text — by paragraph, sentence or word count.
prompt-master
Text & EncodingTurn a rough idea or draft into a copyable prompt for ChatGPT, Claude, Cursor, Midjourney, Sora, Zapier, and more.
html-encode
Text & EncodingEncode text to HTML entities — escape <, >, &, " and ' (and optionally everything non-ASCII).
html-decode
Text & EncodingDecode HTML entities back to plain text — handles numeric (&#NNN; / &#xNNN;) and the common named entities.
hex-to-text
Text & EncodingDecode a hex string back to UTF-8 text — accepts 0x prefixes, spaces, and any case.
text-to-hex
Text & EncodingEncode UTF-8 text as a hex string — lowercase, uppercase, space-separated or 0x-prefixed.
binary-to-text
Text & EncodingDecode 8-bit binary (groups of 0/1) back to UTF-8 text — space- or comma-separated.
text-to-binary
Text & EncodingEncode UTF-8 text as 8-bit binary groups — choose space, comma or no separator.
rot13
Text & EncodingApply the ROT13 substitution cipher — letters shift by 13, applying twice returns the original.
caesar-cipher
Text & EncodingEncrypt or decrypt text with the classic Caesar shift cipher — choose any shift from -25 to 25.
text-reverse
Text & EncodingReverse text by character or by word — Unicode-aware so emoji and combining marks stay intact.
text-sort-lines
Text & EncodingSort lines alphabetically or numerically, ascending or descending, case-sensitive or not.
text-dedupe-lines
Text & EncodingRemove duplicate lines from a list — case-sensitive or not, preserve original order or not.
text-counter
Text & EncodingCount characters, words, lines, sentences, paragraphs and estimate reading time.
slugify
Text & EncodingConvert any text to a clean, URL-safe slug — strips diacritics and replaces non-alphanumerics.
password-generator
Text & EncodingGenerate cryptographically random passwords — choose length, character classes, and exclude lookalikes.
password-strength-checker
Text & EncodingEstimate password entropy and crack time — checked entirely locally, nothing uploaded.
random-string-generator
Text & EncodingGenerate batches of random strings — pick charset, length and count, all sourced from crypto.getRandomValues.
random-number-generator
Text & EncodingGenerate uniform random integers in a range — uses crypto.getRandomValues for true uniformity.
json-to-typescript
Text & EncodingInfer TypeScript interfaces from any JSON payload — nested objects get their own named interface.
regex-tester
Text & EncodingTest a JavaScript regular expression against sample text — see matches, groups, and a replacement preview.
unix-timestamp-converter
Text & EncodingConvert between Unix timestamps and human-readable dates — auto-detects seconds vs milliseconds.
crontab-explainer
Text & EncodingExplain a cron expression in plain English and show the next firing times.
hex-to-decimal
Text & EncodingConvert a hexadecimal number to decimal — also shows binary and octal. Handles arbitrary-size integers via BigInt.
decimal-to-hex
Text & EncodingConvert a decimal integer to hexadecimal — also shows binary and octal. Uppercase output with optional 0x prefix.
binary-to-decimal
Text & EncodingConvert a binary number to decimal — also shows hex and octal. Spaces and underscores ignored.
decimal-to-binary
Text & EncodingConvert a decimal integer to binary — also shows hex and octal. Group bits by 4 or 8 for readability.
hex-to-binary
Text & EncodingConvert a hexadecimal number to binary — each hex digit becomes 4 bits, padded. Also shows decimal.
binary-to-hex
Text & EncodingConvert a binary number to hexadecimal — input is padded to a multiple of 4 bits. Also shows decimal.
base-converter
Text & EncodingConvert a number between any two bases from 2 to 36 — also shows the value in binary, octal, decimal and hex.
text-to-decimal
Text & EncodingEncode each character as its Unicode code point in decimal — space-, comma- or newline-separated output.
decimal-to-text
Text & EncodingDecode a list of decimal Unicode code points back to text — any separator (space, comma, newline) accepted.
text-to-unicode
Text & EncodingConvert text into Unicode escape sequences — U+XXXX, \uXXXX, &#XXXX; or %uXXXX. Hex digits are uppercase.
unicode-to-text
Text & EncodingDecode mixed Unicode escapes (U+XXXX, \uXXXX, \u{XXXXX}, \xHH, &#XXXX;, %uXXXX) back to plain text.
base32-encode
Text & EncodingEncode UTF-8 text to RFC 4648 Base32 — alphabet A-Z and 2-7, with = padding. Useful for TOTP secrets and DNS-safe identifiers.
base32-decode
Text & EncodingDecode RFC 4648 Base32 (A-Z, 2-7) back to UTF-8 text — case-insensitive, padding optional.
quoted-printable-encode
Text & EncodingEncode text to Quoted-Printable (RFC 2045) — for email bodies. Non-ASCII bytes become =XX, lines soft-wrap at 76 columns.
quoted-printable-decode
Text & EncodingDecode Quoted-Printable (RFC 2045) text back to UTF-8 — handles =XX escapes and soft line breaks (=\r\n).
text-to-morse
Text & EncodingEncode text into international Morse code (ITU-R M.1677-1) — letters, digits and common punctuation supported.
morse-to-text
Text & EncodingDecode international Morse code (ITU) back to plain text — letters separated by spaces, words by /.
leet-speak
Text & EncodingConvert text into l33t sp34k — three intensity levels: mild (a→4, e→3, i→1, o→0, s→5, t→7), strong, and maximum.
vigenere-cipher
Text & EncodingEncrypt or decrypt text with the classic Vigenère cipher using a keyword — runs entirely in your browser.
hmac-generator
Text & EncodingCompute HMAC-SHA1, HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512 of a message under a secret key — output in hex and base64.
bcrypt-hash
Text & EncodingGenerate a bcrypt hash from a password, or verify a password against an existing bcrypt hash — adjustable cost factor.
rsa-keypair-generator
Text & EncodingGenerate an RSA private/public key pair as PEM (2048, 3072 or 4096-bit) and a SHA-256 fingerprint of the public key.
bip39-mnemonic
Text & EncodingGenerate a BIP39 mnemonic seed phrase (12/15/18/21/24 words) and the corresponding entropy + seed — or convert an existing mnemonic to its seed.
ulid-generator
Text & EncodingGenerate ULIDs — Universally Unique Lexicographically Sortable Identifiers — that double as a sortable timestamp prefix.
cron-generator
Text & EncodingBuild a cron expression from fields or pick a preset — get the expression plus a human-readable description.
placeholder-image-url
Text & EncodingBuild URLs for placeholder images — picsum.photos, placeholder.com, dummyimage.com and ui-avatars — with the matching HTML/Markdown/BBCode snippets.
fake-data-generator
Text & EncodingGenerate realistic-looking fake people data — names, emails, phones, addresses — for seeding databases, designing UIs and writing tests.
json-diff
Text & EncodingCompare two JSON documents and show added, removed and changed fields as a path-based tree.
json-merge
Text & EncodingDeep-merge two JSON documents — choose how to handle conflicting keys and arrays.
json-patch-generator
Text & EncodingGenerate an RFC 6902 JSON Patch describing the changes needed to turn one JSON document into another.
json-patch-apply
Text & EncodingApply an RFC 6902 JSON Patch to a JSON document — supports add, remove, replace, move, copy and test.
json-schema-generator
Text & EncodingInfer a JSON Schema (Draft-07) from any JSON document — nested objects and array element types are inferred recursively.
json-flatten
Text & EncodingFlatten a nested JSON document to a single-level object with dot, underscore or bracket paths.
json-unflatten
Text & EncodingExpand a flat dot/bracket-keyed object back into nested JSON — numeric keys become array indices.
json-sort-keys
Text & EncodingSort the keys of a JSON object alphabetically — recursively, case-insensitively, or with numeric awareness.
json-path-finder
Text & EncodingQuery a JSON document with a JSONPath expression — supports $, ., [n], [*], ..key and [?(@.field op value)] filters.
json-to-go-struct
Text & EncodingGenerate Go structs with json tags from any JSON payload — nested objects become separate named types.
json-to-python-class
Text & EncodingGenerate Python @dataclass, pydantic BaseModel or TypedDict definitions from any JSON payload.
json-to-rust-struct
Text & EncodingGenerate Rust structs with serde derives from any JSON payload — fields auto-renamed to snake_case.
json-to-csharp-class
Text & EncodingGenerate C# classes from JSON with typed properties for nested objects and arrays.
json-to-kotlin-data-class
Text & EncodingGenerate Kotlin data classes from JSON for Android, Ktor and API clients.
word-counter
Text & EncodingCount the words in any text — plus characters, lines, paragraphs and estimated reading time. Free, online, no signup.
character-counter
Text & EncodingCount characters in any text — with and without spaces — plus words, lines and paragraphs. Free, online, runs in your browser.
text-diff
Text & EncodingCompare two texts side by side and highlight added, removed and unchanged lines, words or characters.
markdown-table-builder
Text & EncodingPaste tab-separated values and get a clean GitHub-flavored Markdown table — instantly.
nato-phonetic-alphabet
Text & EncodingConvert text to NATO phonetic alphabet (Alpha, Bravo, Charlie…) and back — free, in your browser.
ip-address-lookup
Text & EncodingAnalyze an IP address — validate format, identify type (private/public/loopback), class, and binary representation.
email-validator
Text & EncodingValidate email addresses instantly — check format, detect typos, spot disposable providers. Free online tool, no signup.
markdown-to-slack
Text & EncodingConvert standard Markdown to Slack mrkdwn format — bold, italic, links, code blocks, lists. Free, instant, in-browser.
crc32-checksum
Text & EncodingCalculate the CRC32 checksum of any text — hex and decimal output. Free, instant, runs in your browser.
html-to-text
Text & EncodingStrip HTML tags and convert to clean plain text — handles entities, scripts, styles, links. Free, instant, in-browser.
text-to-ascii-art
Text & EncodingConvert text to ASCII art block letters — A-Z, 0-9, punctuation. Free, instant, in-browser.
utm-url-builder
Text & EncodingBuild campaign URLs with UTM source, medium, campaign, term and content parameters.
url-parser
DevBreak a URL into its components — protocol, host, port, path, query parameters, hash — with each query param listed individually.
user-agent-parser
DevParse a browser User-Agent string into structured browser/engine/OS/device fields.
http-status-code
DevLook up any HTTP status code — title, category, RFC explanation, and the situations it's actually used for.
mime-type-lookup
DevLook up the MIME type for a file extension, or the canonical extensions for a MIME type — covering 100+ common types.
subnet-calculator
DevCalculate network/broadcast addresses, host range, mask, wildcard mask, host counts, and IP class from a CIDR.
css-minifier
DevMinify CSS — strip whitespace, comments and unused syntax to ship smaller stylesheets.
css-beautifier
DevPretty-print CSS — choose 2-space, 4-space or tab indentation for readable stylesheets.
html-minifier
DevMinify HTML — collapse whitespace, drop comments and optionally compress inline JS and CSS.
html-beautifier
DevPretty-print HTML — readable indentation with nested tags on their own lines.
js-minifier
DevMinify JavaScript with Terser — compress, mangle and ship the smallest possible bundle.
js-beautifier
DevPretty-print JavaScript — consistent indentation and one statement per line for readable code.
sql-formatter
DevFormat SQL queries for every major dialect — Postgres, MySQL, SQLite, BigQuery, Snowflake and more.
xml-formatter
DevPretty-print XML documents — indent nested tags with 2 or 4 spaces for readable markup.
yaml-formatter
DevReformat YAML — normalize indentation, line wrapping and quoting for tidy config files.
csv-validator
DevValidate CSV data — check column consistency, count rows and surface parse errors.
px-to-rem
DevConvert between px, rem and em based on a root font size — instant CSS-ready values, in-browser.
type-scale-generator
DevBuild a modular typographic scale from a base size and ratio — px, rem and CSS variables, in-browser.
line-height-calculator
DevResolve any CSS line-height (unitless, px or %) to its computed pixel height and ratio — in-browser.
svg-minifier
DevMinify SVG markup — strip comments, declarations and whitespace to shrink file size, all in your browser.
htaccess-to-nginx
DevConvert Apache .htaccess rewrite rules and directives to nginx configuration — free, in your browser.
regex-cheat-sheet
DevInteractive regex reference — anchors, quantifiers, groups, character classes, lookaround, and flags with examples.
json-validator
DevValidate JSON and see errors with line numbers — plus auto-format/beautify. Free, instant, in-browser.
chmod-calculator
DevConvert between numeric (755) and symbolic (rwxr-xr-x) Unix file permissions. Free, instant, in-browser.
meta-tag-generator
DevGenerate HTML meta tags for SEO, Open Graph, and Twitter Cards. Free, instant, copy-paste ready.
csp-header-builder
DevBuild a Content-Security-Policy header interactively — select policies for each directive and get the full header string.
robots-txt-tester
DevTest whether a URL path is allowed or blocked by robots.txt rules for a specific crawler.
hreflang-tag-generator
DevGenerate hreflang alternate link tags from language codes and localized URLs.
instagram-id-finder
DevFind the numeric Instagram user ID for a public profile URL or username.
facebook-id-finder
DevFind the numeric Facebook profile or page ID from a public URL, username, or ID link.
luhn-check
Payment & cardsValidate a card number with the Luhn (mod-10) algorithm — runs locally in your browser.
card-number-generator
Payment & cardsGenerate Luhn-valid test card numbers (Visa, Mastercard, Amex, Discover, JCB, Diners) — for development only.
card-brand-identifier
Payment & cardsIdentify the card scheme (Visa, Mastercard, Amex, Discover, JCB, Diners, UnionPay) from a PAN.
bin-lookup
Payment & cardsLook up a card BIN (Bank Identification Number) to identify scheme, issuer, country and type.
emv-tlv-decoder
Payment & cardsDecode EMV / ISO 7816 BER-TLV hex into a labelled tree of tags, lengths and values.
emv-tag-lookup
Payment & cardsSearch the EMV / ISO 7816 tag dictionary by hex tag or by name fragment.
track1-decoder
Payment & cardsDecode an ISO 7813 Track 1 magstripe string into PAN, cardholder name, expiry and service code.
track2-decoder
Payment & cardsDecode an ISO 7813 Track 2 magstripe string into PAN, expiry, service code and discretionary data.
pin-block
Payment & cardsGenerate an ISO 9564 PIN block (formats 0, 1 and 3) from a PIN and PAN — runs locally in your browser.
kcv-calculator
Payment & cardsCompute the Key Check Value (KCV) of a single, double or triple length DES key by encrypting 8 bytes of zeros.
iso4217-currency
Payment & cardsLook up a currency by ISO 4217 code (alpha or numeric) or by name fragment.
iso3166-country
Payment & cardsLook up a country by ISO 3166-1 alpha-2, alpha-3, numeric code, or by name fragment.
mcc-lookup
Payment & cardsLook up an ISO 18245 Merchant Category Code by 4-digit code or by name fragment.
iban-validator
Payment & cardsValidate an IBAN — checks the country format, length and ISO 13616 MOD-97 checksum.
swift-bic-validator
Payment & cardsValidate a SWIFT/BIC code format and break it down into bank, country, location and branch fields.
iso639-language-lookup
Payment & cardsLook up a language by ISO 639-1 alpha-2, ISO 639-2/3 alpha-3, or by name fragment.
card-pan-formatter
Payment & cardsFormat a card number for display — brand-aware grouping plus a masked version safe to show in receipts.
dukpt-pin-block-calculator
Payment & cardsCompute the ISO 8583 field 52 encrypted PIN block from a PIN, PAN, BDK and KSN — full TDES DUKPT key derivation.
Frequently asked
Do my tokens, keys and payloads get uploaded anywhere?
No. The paste-and-transform text utilities — encoding, decoding, hashing, HMAC, JSON formatting, regex testing — run entirely in your browser as JavaScript or WebAssembly, so no request fires and the input never leaves the tab. You can verify it directly: open DevTools, switch to the Network panel, and run a transform — the request list stays empty while the output updates. A few file-output tools do heavier work and are labeled as such.
What's the difference between decoding a JWT and verifying it?
Decoding just Base64url-decodes the header and payload so you can read the claims — anyone can do this, because a JWT's payload is encoded, not encrypted. Verifying recomputes the signature using the issuer's secret (HS256) or public key (RS256) and confirms the token wasn't tampered with. The decoder here reads claims; always verify the signature server-side before trusting any claim, and never put secrets in the payload.
Is Base64 a form of encryption?
No — it's encoding, fully reversible by anyone with no key. Base64 exists to represent binary data safely as text (for data URIs, email attachments, token segments), not to hide it. If you need confidentiality, use encryption; if you need a one-way fingerprint for integrity or password storage, use a hash like SHA-256 or bcrypt.
When should I use HMAC versus a plain hash?
Use a plain hash (SHA-256, or MD5 for legacy checksums) when you just need a fingerprint of public data — file integrity, content addressing. Use HMAC when you need to prove the data came from someone holding a shared secret, such as signing a webhook body or an API request so the receiver can confirm it wasn't forged. HMAC is a keyed hash; a plain hash has no key and anyone can recompute it.
Why is bcrypt slow, and is that a bug?
It's the whole point. bcrypt has a tunable work factor (cost) that makes each hash deliberately expensive to compute, so an attacker who steals your password database can only test a few thousand guesses per second instead of billions. Raise the cost as hardware gets faster. To verify a password you don't recompute and compare strings — you feed the candidate and the stored hash to bcrypt's verify, which extracts the embedded salt and cost automatically.
Can I decode EMV chip data and other payment fields here?
Yes — this site carries payment-data utilities that are genuinely hard to find elsewhere: an EMV TLV decoder that parses tag-length-value chip data into named EMV tags, plus EMV tag lookup, BIN and MCC lookups, IBAN and SWIFT/BIC validation, Luhn (mod-10) checks and card-brand identification. They run in the browser like the rest of the toolbox.
Do these tools work offline?
Largely, yes. Because the text transforms execute client-side, once a tool's page has loaded you can keep encoding, hashing, formatting and testing regex with no network connection. There's no server round-trip and no session, which is also why there's nothing to sign up for.
Should I use a UUID or a ULID for my IDs?
Use a UUID v4 when you want a purely random, collision-resistant identifier and ordering doesn't matter. Reach for a ULID when you want IDs that sort lexicographically by creation time — they embed a millisecond timestamp prefix, which makes them friendlier for database indexes and cursor pagination. The UUID generator covers the random case; the field guide walks through the trade-off.