Developer tools
Encodings, digests, tokens, timestamps and colour notations — the small conversions that sit between one system's idea of a string and another's — together with the generators that make a new one: a password, a gradient, a QR code.
10 tools · nothing uploaded · no sign-up
- Password Generator Strong random passwords, generated on your device with real randomness.
- JSON Formatter Format, minify and validate JSON — with the error line.
- Base64 Encode / Decode Text and files to Base64, and back again.
- URL Encode / Decode Percent-encode and decode URLs and query strings.
- Hash Generator MD5, SHA-1, SHA-256 and SHA-512 of text or a file.
- CSS Gradient Generator Build a gradient visually, copy the CSS.
- QR Code Generator Text or a link to a QR code you can download.
- JWT Decoder Decode a JSON Web Token’s header and payload — in your browser, never uploaded.
- Colour Converter Convert a colour between HEX, RGB and HSL — live swatch, one-click copy.
- Unix Timestamp Converter Unix epoch ⇄ human date, both ways — local, UTC and ISO 8601.
SubtleCrypto, getRandomValues and one import
Digests come from SubtleCrypto, a generated password's characters from crypto.getRandomValues, and an epoch is rendered by the browser's own locale rules. The exception is QR encoding, an imported library: Reed–Solomon correction, masking and version selection are a specification worth importing rather than retyping.
A 32-bit draw reduced modulo an alphabet size is uniform only when that size is a power of two, so draws in the uneven tail are discarded and redrawn. One algorithm is written out longhand: SubtleCrypto declines MD5 as broken, yet published checksums are still often MD5 — RFC 1321 by hand, for verifying a download and nothing else.
Where text stops being bytes
btoa maps one character to one byte and throws on anything above Latin-1 — a Cyrillic letter, a curly quote. atob fails more quietly: each byte becomes one character again, so UTF-8 returns as mojibake, with nothing thrown. Both directions therefore route through TextEncoder and TextDecoder. Files are walked in 32 KB slices, because spreading a byte array into String.fromCharCode exceeds the argument limit.
Base64 has two alphabets — the standard one ends in plus and slash, the URL-safe one in hyphen and underscore. A JSON Web Token uses the second with its padding stripped, so the token decoder, not the Base64 tool, puts the padding back before decoding. Percent-encoding divides elsewhere: one function escapes the delimiters that give an address its structure, the other leaves them alone. Offering only one would corrupt the other case silently.
What the output actually says
A decoder is not a validator. A pasted token shows its header, its payload and its exp, iat and nbf claims as dates, then stops: confirming the signature needs the signing key. A checksum match proves your bytes are the bytes whose digest you were handed, not who produced that digest.
JSON is checked for syntax alone: a document can parse cleanly and still be the wrong shape. A gradient preview is the copied CSS itself rather than a redrawing of it, and stops are sorted because CSS clamps out-of-order ones. Hex and RGB are one value in two bases; HSL is written in whole degrees and percent, so a round trip can shift a channel by one. On a grey the hue is undefined; 0 comes back, which is a choice rather than a measurement. All three notations are sRGB.