Format, encode and minify
Paste messy data into the JSON Formatter to validate it and see exactly where it breaks. The Base64 Encoder and URL Encoder handle the encoding that APIs, data URIs and query strings need. When code is ready to ship, the HTML, CSS and JS Minifier shrinks it, and the CSS Formatter does the reverse for minified files you need to read.
Debug: patterns, tokens, time and schedules
The Regex Tester highlights matches and groups as you type and explains each part of the pattern in plain English. The JWT Decoder shows a token's header, claims and expiry and can verify signatures. The Epoch Timestamp Converter turns Unix seconds or milliseconds into readable dates in any time zone, and the Cron Expression Builder writes and explains schedules so a job runs when you think it will.
Secrets, hashes and 2FA
Generate strong passwords, API keys and UUIDs with the Password & Key Generator, which uses your browser's cryptographic random generator. The Hash Generator computes SHA-256, SHA-512, SHA-1, MD5 and HMAC values, and the Auth Key (TOTP) Generator creates 2FA secrets with a scannable QR code and live codes for testing. To hand a secret to a client, use a one-time Secret Share link instead of email.
Frequently asked questions
Is it safe to paste tokens or keys into these tools?
These utilities run entirely in your browser, so what you paste is not sent to a server. Even so, treat production secrets carefully: use test tokens where you can and rotate any key that has been exposed.
What is a Unix timestamp?
A Unix (epoch) timestamp is the number of seconds since midnight UTC on January 1, 1970. JavaScript and many APIs use milliseconds instead, which is the same value times 1,000.
What does a JWT decoder show?
It splits the token into its header and payload, shows the claims such as subject, issuer and expiry in readable form, and can check the signature when you provide the secret or public key.