Developer Tools

About Developer Tools

There is a specific reason a developer utility should run client-side, and it isn't speed. It is that the things you paste into these tools are frequently things you should not paste into a stranger's server: a JWT from a staging environment, an API response with customer records in it, a config blob with a connection string, a minified bundle from a private repository. The convenient online formatter is a data exfiltration route that people use dozens of times a week without registering it as one.

Everything in this category runs in your browser. The JSON formatter parses with the native JSON engine, the encoders use the platform's built-in Base64 and URI functions, the hash tools use the Web Crypto API. No request carries your input anywhere, which means pasting production data into them is a defensible thing to do rather than something to feel uneasy about.

The JSON formatter is the workhorse, and it reports parse errors with position information rather than just refusing — which is usually what you need, since malformed JSON is almost always one trailing comma, one unquoted key, or one smart quote that a word processor introduced on its way through an email.

Developer Tools — Frequently Asked Questions

Is it safe to paste production data into these tools?

Into these ones, yes — they run entirely in your browser and transmit nothing. That is precisely why they are built this way. Into online formatters generally, no: assume anything pasted into a server-side tool has been received, and possibly logged, by whoever runs it.

Does the JSON formatter validate as well as prettify?

Yes. It parses with the browser's native JSON parser, so anything it accepts is valid JSON by definition, and anything it rejects comes back with the parser's own error message and character position. Trailing commas, single-quoted strings and unquoted keys are the three failures that account for most of what people paste in.

Is the minifier safe for production code?

It performs conservative minification — whitespace, comments and redundant characters — without renaming variables or restructuring code, so behaviour is preserved. It is not a replacement for Terser or esbuild in a real build pipeline; it is for the times you need a one-off file compressed without setting one up.

Which hash algorithms are available, and can I use them for passwords?

SHA-1, SHA-256, SHA-384 and SHA-512 via the Web Crypto API, plus MD5. Use them for checksums and integrity verification. Do not use any of them to store passwords: fast general-purpose hashes are the wrong tool for that, and bcrypt, scrypt or Argon2 are what you want. MD5 and SHA-1 are additionally broken for any security purpose and are included only for verifying legacy checksums.