Is the data I paste here logged or sent anywhere?

No. These tools are JavaScript running in your tab; the text you paste stays in the page's memory and is discarded when you close it. There is no request carrying it, which you can confirm in your browser's network panel while using any tool on this site.

Can the JWT decoder tell me if a token is valid?

It shows you the header, the payload and the claims, including expiry: enough to answer "why is this request being rejected" most of the time. It does not verify the signature, because that requires the signing key, and pasting a signing key into a web page is the thing you should never do.

Which hash should I use?

For checking that a download arrived intact, SHA-256 is the standard answer. MD5 and SHA-1 are still fine for detecting accidental corruption and are broken for anything adversarial. For storing passwords, none of these are appropriate: that needs a deliberately slow function such as bcrypt or Argon2, on a server.

Do these tools work offline?

Once the page has loaded, yes. Nothing in a formatter, encoder or generator needs the network, so they continue to work on a plane or behind a firewall that blocks everything interesting.

20 tools · runs in your browser

Developer

Formatters, encoders, decoders and inspectors for the data developers paste all day.

Most used

Files never leave your device
No sign-up
Free, no watermarks

All Developer tools

Grouped by what you want to get done. Star a tool to find it again on the homepage.

Format and validate · Pretty-print, minify and check code and data.

JSON Formatter

Format, minify, validate, repair and explore JSON with tree inspector

YAML Formatter

Format, validate and convert YAML to JSON or JSON to YAML

SQL Formatter

Beautify and format SQL queries with configurable dialect and indentation

XML Formatter

Format, minify and validate XML documents with syntax highlighting

HTML Formatter / Minifier

Prettify or minify HTML markup with configurable indent size

CSS Formatter / Minifier

Format or minify CSS stylesheets and SCSS/LESS snippets

JS Formatter / Minifier

Prettify or minify JavaScript and TypeScript code in browser

Encode and decode · URL encoding, Base64 and JWTs.

Base64 Encoder / Decoder

Encode text or files to Base64 and decode Base64 strings back to data

URL Encoder / Decoder

Encode or decode URI components and full URLs

JWT Token Inspector

Decode JWT header, payload, verify expiry and inspect claims

Generate · IDs, hashes, TypeScript types and mock data.

UUID / GUID Generator

Generate RFC4122 v4 UUIDs in bulk with casing and separator options

Hash Generator

Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of any text

JSON to TypeScript

Generate TypeScript interfaces, Zod schemas, Go structs or Python dataclasses from JSON

Mock JSON Generator

Generate realistic fake JSON, CSV or SQL test data from custom field definitions

Test and preview · Diff text, query JSON, read cron schedules, preview Markdown.

Diff Checker

Compare two code files or text blocks and show a colour-coded diff

JSONPath Tester

Query a JSON document with JSONPath expressions and see matching values live

Cron Expression Parser

Explain any cron expression in plain English and preview its next run times

Markdown Preview

Write Markdown in a live editor and see the rendered HTML side by side

Convert and look up · HTML to Markdown and HTTP status codes.

HTML ↔ Markdown

Convert HTML to Markdown or Markdown to HTML

HTTP Status Codes

Search every HTTP status code with a plain-English explanation of what it means

Often used alongside these, from other categories.

About these Developer tools

The strings a developer pastes into an online tool are disproportionately production data: an API response, a signed URL, a JWT from a real session, a config file with credentials in it. That is the argument for these tools running in the tab rather than on a server, not convenience, but the fact that a formatter has no business seeing your bearer token. Everything here is parsing and printing, which is exactly the class of work a browser does well.

Choosing between these Developer tools

A formatter that reformats is also a validator

JSON, XML, YAML and SQL formatters have to parse the input before they can print it. If the output looks right, the syntax is valid; if it errors, the message points at the first thing the parser could not reconcile. Reaching for the formatter is often the fastest way to find a missing comma.

Decoding is not decrypting

Base64 and URL encoding are reversible transformations with no key and no secret. A JWT's payload is Base64, which means anyone holding the token can read every claim in it. The signature is what makes a JWT trustworthy, and verifying it needs the key: decoding it does not.

Generated values differ in what they guarantee

A UUID v4 is random and effectively unique; a password generator is aiming at entropy against guessing; a hash is deterministic and will give the same output for the same input forever. Picking the wrong one, a hash where you wanted a random token, is a real and common bug.

Diff on structure when structure is what changed

Comparing two formatted JSON documents line by line reports noise whenever key order differs. Format both sides first so the comparison is between contents rather than between styles of writing the same content.

Questions people ask

Is the data I paste here logged or sent anywhere?: No. These tools are JavaScript running in your tab; the text you paste stays in the page's memory and is discarded when you close it. There is no request carrying it, which you can confirm in your browser's network panel while using any tool on this site.
Can the JWT decoder tell me if a token is valid?: It shows you the header, the payload and the claims, including expiry: enough to answer "why is this request being rejected" most of the time. It does not verify the signature, because that requires the signing key, and pasting a signing key into a web page is the thing you should never do.
Which hash should I use?: For checking that a download arrived intact, SHA-256 is the standard answer. MD5 and SHA-1 are still fine for detecting accidental corruption and are broken for anything adversarial. For storing passwords, none of these are appropriate: that needs a deliberately slow function such as bcrypt or Argon2, on a server.
Do these tools work offline?: Once the page has loaded, yes. Nothing in a formatter, encoder or generator needs the network, so they continue to work on a plane or behind a firewall that blocks everything interesting.

Guides on this topic

YAML, JSON and TSV: picking a format for config and interchangeYAML turns the country code NO into the boolean false. That is not a bug report, it is in the specification, and it is why config formats need choosing carefully.The JSON errors everyone hits, and what the spec actually saysJSON is a deliberately tiny format. Most parse errors come from writing JavaScript object syntax and expecting a JSON parser to accept it.Converting CSV to JSON without losing your dataEvery CSV value is a string. Turning them into JSON means deciding which strings become numbers, and getting that wrong destroys IDs and postcodes.Prettify or minify: what formatters actually do to your codeA formatter throws your whitespace away and prints the syntax tree again. Everything surprising about formatters follows from that.