DevOps tools
17 tools that run in your browser. Nothing to install, nothing uploaded.
Developer utilities — JSON formatting, JWT decoding, and the everyday parsing tools — that work entirely in your browser. The JSON formatter pins a syntax error to a line and column instead of leaving you to hunt; the JWT decoder reads a token’s claims but is emphatic that decoding is not verifying, and never asks for your signing key. Nothing you paste is uploaded, which is the point for anyone pasting a token or a config.
- API Rate Limit CalculatorSize a request rate that fits inside a quota, retries included.
- X.509 Certificate DecoderDecode a PEM certificate and read every field it carries.
- CSV to JSON ConverterConvert CSV to JSON without destroying your identifiers.
- cURL Command BuilderAssemble a curl command with the shell quoting done properly.
- cURL Command ParserRead a curl command back in plain terms, and convert it to fetch or Python.
- Diff / Text CompareCompare two blocks of text and see exactly what changed.
- Docker Run to ComposeTurn a docker run command into a compose service.
- HAR File AnalyserFind where a page load actually spent its time, not just which request was slowest.
- JSON Formatter / ValidatorFormat and validate JSON — with the error pinned to a line and column.
- JSON to YAML ConverterConvert JSON to YAML with ambiguous values quoted properly.
- JWT DecoderDecode a JWT to read its header and claims — safely, in your browser.
- Log Timestamp ConverterRead any log timestamp and convert it across formats and zones.
- Regex TesterTest patterns with live matches and groups — and a guard against the one that hangs.
- Nginx / Apache Config ExplainerRead an nginx or Apache block and see what each line really does.
- SSL Expiry CheckerCheck a pasted certificate chain for expiry, order and gaps.
- User-Agent String ParserBreak a user-agent string into browser, engine, OS and device.
- XML Formatter / ValidatorFormat XML and find out whether it is actually well-formed.
Tools for the middle of a debugging session
These are the utilities you reach for while something is already broken, which shapes what they optimise for. A JSON formatter is only useful if it pins a syntax error to a line and column instead of reporting that the document is invalid — the whole reason you opened it is that you cannot see the problem. A HAR analyser has to show where a page load actually spent its time, which is usually queueing, DNS or a blocking chain rather than the single slowest request everyone points at. A regex tester needs live match highlighting and a guard against the catastrophic backtracking that hangs the tab.
Decoding a token is not verifying it
A JWT is three Base64url segments, and reading the header and payload requires no key whatsoever — anyone holding the token can see every claim in it. That is why the decoder here never asks for your signing secret: it cannot check a signature without one, and a page that collects signing keys from developers debugging production would be an obvious thing to regret. Two consequences follow for anyone using tokens. Never put anything confidential in a payload, because it is readable by every party that handles the token; and never trust a decoded claim server-side without verifying the signature first.
Why pasting into a browser tool is the safer option here
The things developers paste into online formatters are, routinely, production API responses, bearer tokens, connection strings and customer records. On a conventional web tool every one of those has been sent to a third-party server and may sit in its logs indefinitely. Everything in this category runs in the page: the parse, the format, the decode and the conversion all happen in your browser, with no request carrying the input anywhere. It is a claim you can verify in the network panel in about five seconds, which is a reasonable thing to do before pasting anything from production into any tool.
Frequently asked questions
Is it safe to paste a production API response or a token here?
Safer than on a conventional web tool, because nothing is transmitted — the parse, format, decode and conversion all run in the page, and you can confirm it in the network panel in a few seconds. That said, the general advice stands: check any tool before pasting production data into it, and prefer tokens from a staging environment when you have the option. The verification here is that there is no request to check, not that you should stop checking.
Can the JWT decoder verify my token’s signature?
No, and deliberately not. Verifying a signature requires the signing key, and a public page that collects signing secrets from developers debugging production would be an obvious thing to regret building. Decoding needs no key at all — the header and payload are Base64url, readable by anyone holding the token. That is worth internalising in both directions: never put confidential data in a payload, and never trust a decoded claim on the server without verifying properly there.
Why does my regex hang the browser on some inputs?
Catastrophic backtracking. Patterns with nested quantifiers over overlapping character classes — the classic shape is (a+)+ — can take exponentially longer as the input grows, so a pattern that is instant on twenty characters takes minutes on forty. The tester guards against this rather than freezing the tab, and the fix is normally to make the inner quantifier possessive or atomic where supported, or to restructure the pattern so the alternatives cannot match the same text.