Skip to content

Free developer tools online

Format and validate JSON, beautify code, decode Base64 and JWTs, and test regular expressions. Code you paste stays in your browser; only the HTTP header checker contacts a server.

JSON and data

JSON FormatterBeautify, validate and minify JSON.JSON CompareFind what changed between two JSON files.JSON to CSVTurn JSON arrays into spreadsheet rows.JSON to YAMLSwitch config data between JSON and YAML.XML FormatterIndent, check and minify XML.

Format, compare and test code

HTML FormatterIndent and clean up messy HTML.CSS BeautifierFormat, unminify and validate CSS or SCSS.JS BeautifierFormat and validate JavaScript or JSON.Diff CheckerSpot every changed line between two texts.Regex TesterTest regex patterns with live highlighting.

Encode and decode

Base64 DecodeDecode Base64 to text or files.URL DecodeDecode and encode percent-encoded URLs.JWT DecoderDecode, verify and compare JWT tokens.HTML EntitiesEscape and decode HTML entities.Image to Base64Embed images in code as data URIs.

Colors and markup

RGB to HEXConvert color codes between HEX and RGB.CSS GradientBuild linear and radial CSS gradients.HTML Table GeneratorTurn CSV or JSON into HTML tables.

Security, hashes and IDs

Password GeneratorCreate random, secure passwords.Hash GeneratorGet MD5, SHA-1 and SHA-256 hashes of text.UUID GeneratorGenerate random v4 UUIDs in bulk.Text EncryptionEncrypt and decrypt text with a password.HTTP Header CheckerCheck response and security headers.

JSON tools: format, compare and convert

The JSON formatter parses your JSON with the browser's own parser, so if it fails you get the exact line and column of the error. It can also minify, sort keys and show a tree view. JSON Compare goes further than a text diff: it walks both documents and lists each change by path, such as users[0].role, with the old and new value.

For moving data between formats, JSON to CSV flattens nested objects into columns like address.city that open in Excel, and JSON to YAML converts config files in both directions.

Encoding is not encryption

Base64, URL encoding and HTML entities only change how data is written. Anyone can reverse them, so they don't hide anything. The same goes for a JWT: the header and payload are Base64url text that the JWT decoder reads without any key. Decoding doesn't prove a token is genuine; the Verify tab checks the signature with your secret or public key.

To keep text private, Text Encryption uses AES-256-GCM with a key derived from your password. Hashes are a third thing: they're one-way fingerprints. MD5 and SHA-1 from the hash generator are fine for checksums, but they shouldn't be used to store passwords.

Code formatter and diff tools

The HTML, CSS and JavaScript beautifiers re-indent minified or messy code with 2 spaces, 4 spaces or tabs. The JavaScript beautifier checks the syntax with the Acorn parser first and points to the line of any error. Diff Checker compares two versions side by side and can ignore whitespace or case.

The regex tester runs your pattern with the browser's JavaScript RegExp engine, so results match what your JS code will do. Python, PHP and other languages use different engines and can differ on features like lookbehind and named groups.

Frequently asked questions

Is the code I paste sent to a server?

No. The formatters, decoders and generators run in your browser. The HTTP header checker is the one exception, because our server has to request the URL you enter.

Which regex flavor does the regex tester use?

JavaScript. It uses your browser's built-in RegExp engine with the flags g, i, m, s, u, y and d.

Can the JWT decoder verify a signature?

Yes. Use the Verify tab with a secret, PEM or JWK key. It supports HS, RS, PS and ES algorithms and warns about tokens that use alg none or have expired.

Are the generated UUIDs and passwords secure?

Both use crypto.getRandomValues(), the browser's cryptographic random number generator. The UUID generator makes version 4 UUIDs by default, up to 1,000 at a time.

What does the HTTP header checker do?

It requests a URL from our server, follows up to 5 redirects and lists every response header. It also grades the security headers from A to F and shows the SSL certificate's expiry date.