These run in your browser and nowhere else. That matters most for the JWT decoder: developers paste production tokens into tools like this one, and the only honest version of that tool is one where the token never leaves the device.
Nobody opens a tab thinking “I need a base64url decoder”. They think “what is this blob in the header”. Pick the thing on your screen.
Something came back wrong and the first job is working out what it even is.
Written by someone who left, and the comment above it is wrong.
Two files, two environments, or a download you were told to verify.
A request that works in a terminal, and a model for what comes back.
The small conversions that break a build when they are one character out.
The files that should never be committed, and the versions you are agreeing to.
The utilities you open every day. The ones people open most are first; everything else is here in full, including what is still being built.
There is a decade-old bookmark for most of these and we are not pretending otherwise. Three things this set does that are worth switching for, all of them checkable.
Every one of these runs as JavaScript on your device and makes no request while working - open the network tab and paste a production JWT into the decoder if you want to check. It is not a promise either: a build-failing test denies every network primitive and drives each engine across its input space, and a second one reads the source for any import that could reach the network at all.
“Invalid JSON” is not a message, it is a shrug. Every parser here reports a line and a column, prints the offending line, and puts a caret under the character it choked on. On a 2,000-line payload that is the difference between a fix and a search.
The diff is a hand-written Myers implementation, the cron parser and the hashes are ours, and the whole category is capped at a source budget a test enforces. No chart library, no animation library, no parser package - which is why these pages open instantly on a bad connection and keep working once it drops.
The ones that come up before somebody picks a tool. Each tool answers its own on its own page.
Yes, and it is the easiest claim on this page to check: load any of them, turn off your network, and keep using it. Nothing here calls an API, and there is no analytics event carrying what you paste. Two tests enforce it rather than describing it - one denies every network primitive and drives every engine, the other reads the source for any import that could reach the network at all. The only tools in this category that will ever talk to a server are the two marked as costing credits, and they are not built yet.
No rate limit and no account, ever. There are per-tool size caps - a megabyte a side on the diff, 128 KB on the JWT decoder - and they exist because the work happens on your device: a browser tab that tries to diff two 50 MB files does not fail politely, it locks up. Each tool prints its cap next to the input and counts against it as you type, so you find out before you paste rather than after.
For most of them, mostly you should not, and we would rather say so. The two reasons to switch are specific: it matters where the paste goes - a JWT is a bearer credential and most hosted decoders do not tell you which kind they are - and the errors here name a line, a column and the character. If neither applies, your bookmark is fine.
No. Every tool in this category is free with no account and no cap, and that is a published commitment rather than a launch price. The two AI-backed tools listed as coming soon will cost credits when they ship, because they call a model that costs money to run - but they are additions beside these ten, not a gate in front of them.
Yes, and one detail is worth knowing because it is where most tools fail: every input here switches off autocapitalise, autocorrect and spellcheck. A mobile keyboard turning a JSON key into a capitalised word or rewriting an identifier is not hypothetical, it is the default behaviour, and it silently corrupts the thing you pasted before the parser ever sees it.
The code explainer and the error explainer are listed and not built. Both call a language model, so both need the credit-metered run pipeline the paid tools use, which is a different piece of infrastructure from the ten client-side tools here. They have real pages saying exactly that, and an email capture, because we would rather publish the roadmap than quietly ship two tools that pretend to be free.
These save you a browser tab. If what you are actually stuck on is a design decision, a stack choice or a round two weeks out, an hour with a senior engineer is a better use of the same afternoon.
