Developer Tools

Six utilities that come up constantly in day-to-day development: regex testing, UUIDs, passwords, hashes, JWT decoding and text diffs. All of them run client-side — which matters most when the thing you are inspecting is a production token.

Test patterns, compare text, generate values

The Regex Tester runs JavaScript regular expressions against sample text with live match highlighting, so you watch a pattern’s behavior change as you edit it — much faster than the write, run, squint cycle. The Text Diff Checker compares two blocks of text line by line and highlights every difference, covering the everyday cases version control does not: two config files pulled from different servers, two API responses, or two drafts of the same paragraph that have quietly diverged.

Three generators handle randomness and hashing. The UUID Generator produces v4 identifiers one at a time or hundreds at once, drawn from the browser’s cryptographic random source. The Password Generator builds strong random passwords with custom length and character sets — and because generation happens on your device, the password has never existed anywhere else. The SHA Hash Generator computes SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text using the Web Crypto API, for checking a value against a published checksum or producing a stable cache key.

Decode JWTs without handing them to a server

The JWT Decoder splits a JSON Web Token into its header and payload, pretty-prints both, and checks the expiry claim — the first question in most authentication debugging sessions. This is the one tool in the category where client-side execution is not just convenient but necessary: a real access token grants access to something, and pasting it into a site that ships it to a server is handing that access away. Here the token is decoded by JavaScript in your browser and never transmitted, so inspecting a production JWT does not mean disclosing it.

Frequently asked questions

Is it safe to paste a real JWT or generate a real password here?

Yes — decoding, generation and hashing all happen in your browser, and nothing you paste or generate is transmitted or stored. The JWT Decoder in particular exists because pasting live tokens into upload-based sites is genuinely risky; here the token never leaves the page.

Are the generated UUIDs and passwords actually random?

Yes. Both the UUID Generator and the Password Generator use the browser’s crypto.getRandomValues, a cryptographically secure random source — not Math.random. And since values are generated on your device, no server ever sees them, logs them or could replay them.

Which SHA algorithm should I use?

SHA-256 is the sensible default: fast, universally supported and collision-resistant. SHA-1 is broken for security purposes and belongs only where a legacy system demands it, while SHA-384 and SHA-512 are for contexts that specifically require longer digests.

Looking for something else? Browse all 67 tools, or jump to JSON Tools, CSV & Data Tools and Encoders & Converters.