Developer & data

Encode, format and generate the values developers pass between systems.

Written for: Developers and designers · People moving text between systems

What this family is for

The formats a program exchanges are not the formats a person reads. A JSON document arrives as one unreadable line, a token is Base64, a URL is percent-encoded, and an identifier has to be unique. These tools convert and inspect those values in the browser, so a secret token or payload is never sent over the network, and each page states the standard it follows.

Encoding, hashing, encrypting or formatting a value

The most expensive mistake in this family is using one of these verbs when another was meant. Encoding (Base64, percent-encoding, hex) is a reversible representation change with no key: anyone can undo it, so it is for transport, never for hiding. Hashing (SHA-1/256/384/512) is one-way and fixed-length: it proves two byte sequences are identical, which is why it is the right answer for a checksum and the wrong answer for “encrypt this message”. Encryption (AES-256-GCM here) is reversible with a key and protects confidentiality — it is the only one of the three that should be used when the content must stay secret.

The second split is between inspecting a value and generating one. Decoding a JWT shows you the claims but proves nothing about who issued it: the signature is verified with a key you do not have here, so a token that decodes cleanly can still be forged, expired or for a different audience. Likewise, decoding Base64 of an image tells you the bytes, not that the image is safe. Read the warning on the page before acting on a decoded value.

Formatting is a third, separate job: pretty-printing JSON, indenting SQL, converting between JSON, YAML, TOML and XML, or turning a CSV into a table. These preserve meaning but not always bytes — key order, comments and number formatting can change — so never use a round-trip converter as a way to “clean up” a file you then diff against the original.

If you have…	Use	Because
Carry binary or arbitrary text through a text-only channel	Base64 encoder / decoder	Reversible, no key; UTF-8 aware, so emoji survive
Put a value safely inside a URL	URL encoder / decoder	Percent-encoding per RFC 3986, with component and full-URL modes
Prove a download matches a published checksum	File hash calculator	Streams the file locally; SHA-256 or SHA-512
Keep a message secret with a passphrase	Encrypt text (AES-256-GCM)	The only reversible-with-key tool here; authenticated, so tampering is detected
Read what is inside a token	JWT decoder	Shows the claims; explicitly does not verify the signature
Two-factor codes from a secret	TOTP generator	RFC 6238, computed locally — the secret is never transmitted
An identifier that will not collide	UUID generator	Version 4, random, RFC 4122 format
A strong password or passphrase	Password generator	CSPRNG with rejection sampling, and the real entropy shown
Find the syntax error in a JSON or SQL document	JSON formatter / SQL formatter	Reports the failing position instead of reformatting garbage
Compare two versions of a text	Text diff	Line diff for code, word diff for prose; bounded on huge inputs

24 tools in Developer & data

Common mistakes with these tools

• Treating Base64 as encryption — It is a representation, not a secret. Anyone who intercepts the string can decode it in one step; if the content must stay private, it has to be encrypted first.
• Assuming a decoded JWT is a valid JWT — Decoding only Base64-decodes the header and payload. A token with a valid-looking payload can be forged, expired or signed with an algorithm the verifier should reject — the signature is what decides, and this tool does not check it.
• Hashing a password with SHA-256 — General-purpose hashes are fast by design, which is exactly wrong for passwords. Use bcrypt, scrypt or Argon2 in your application; this family is for checksums and integrity checks.
• Verifying a checksum against the wrong algorithm — A SHA-1 and a SHA-256 digest of the same file look equally plausible and never match each other. Check which one the publisher listed before concluding the download is corrupt.
• Round-tripping a config file through a converter and diffing it — YAML, TOML and XML carry comments and ordering that JSON cannot represent. The conversion is lossy in ways the data still “works” through, so a diff will show changes you did not intend.
• Generating test data with a real-looking seed — A fixed seed gives repeatable records, which is the point — but it also means the “fake” names and emails are reproducible. Keep them out of anything that treats them as real data.

Frequently asked questions

Other tool families

• Scripts & numerals — Digits, writing systems and transliteration, converted losslessly. (7 tools)
• Encoding & Unicode — What the bytes and code points of your text actually are. (7 tools)
• Accents & diacritics — Strip the marks that break search, matching and filenames. (1 tools)
• Phonetic & symbol writing — Spell text in other symbolic systems: Morse, Braille, radio alphabet. (3 tools)
• Text utilities — Everyday clean-up: counting, case, whitespace, slugs and lines. (15 tools)
• Time & date — Timestamps and dates, converted without a timezone surprise. (4 tools)
• Converters & calculators — Unit, money and grade calculators that show the method, not just the answer. (14 tools)
• Colour — Move a colour between HEX, RGB and HSL without a design tool. (3 tools)
• Images — Resize, convert, compress, crop and inspect images without uploading them. (15 tools)
• Documents — Business paperwork — invoices, receipts — generated in the browser. (2 tools)
• CSS & design — Generate gradients, shadows, radii and shapes as copy-ready CSS. (4 tools)
• QR & codes — Machine-readable codes: QR, barcodes, and the subtitle formats players read. (3 tools)