Free Developer Tools

Which one do you actually need?

Most of these answer a question you hit in the middle of something else, which is why they are worth having in a tab rather than installing. Reading something unreadable is the biggest group: the JSON formatter for a minified payload, the JWT decoder for a token whose claims you need to see, base64 and URL encoding for strings that arrived escaped, and the timestamp converter for a number that is supposed to be a date.

Converting between formats is the next group: CSV to JSON, JSON to CSV and YAML to JSON. The regex tester is the one that saves the most time, because a pattern that is wrong in a subtle way is faster to find against sample text than against production data.

The rest generate rather than read: a UUID, a value in another base, an image as a data URI, or text with its HTML entities escaped.

What this category will not do for you

A decoder is not a verifier. The JWT decoder shows you what a token claims, and it does not check the signature, because checking a signature requires the key and the key does not belong in a browser tab. Anyone can write a JWT that says anything; only the signature makes it meaningful, and that check belongs on your server.

Base64 is the other common misunderstanding. It is an encoding, not encryption. Anything encoded with it can be decoded by anyone, instantly, with no secret, which makes it useful for moving binary data through a text channel and useless for hiding it.

Frequently asked questions

Is it safe to paste a JWT into a decoder?

Treat it like a password, because that is what it is. A valid token usually grants access to whatever issued it. This decoder runs entirely in your browser and sends nothing anywhere, which is the only way it should be done, but a token you pasted somewhere you were unsure about should be treated as exposed and rotated.

Does base64 encoding protect my data?

No. Base64 is a way of representing binary data using text characters so it can travel through systems that only handle text. It uses no key and keeps no secret, so anyone who sees the encoded string can decode it in a moment. For protection you need encryption.

Why does my timestamp come out in 1970?

Almost always a seconds-and-milliseconds mix-up. Unix time counts seconds from 1 January 1970, but JavaScript and many APIs report milliseconds. Feeding a seconds value to something expecting milliseconds lands you a fraction of a second after the epoch, so dividing or multiplying by 1000 fixes it.