Every debugging session eventually needs one of these. This page collects our free developer tools — the small utilities you reach for mid-task: hashing a string, peeking inside a JWT, generating a UUID, translating a Unix timestamp into a human date, or converting a color between HEX, RGB and HSL. Each one runs client-side in your browser, which matters more here than anywhere: tokens, hashes and identifiers are exactly the kind of data you should never paste into a random website’s server.
Hashing and tokens
The Hash Generator computes MD5, SHA-1, SHA-256 and SHA-512 digests of any text — for checksums, cache keys, and verifying that two configs really are identical. The JWT Decoder splits a JSON Web Token into its header and payload and pretty-prints the claims, so you can see at a glance why an API call returns 401: expired exp, wrong aud, missing scope. Decoding happens locally — the token never leaves your machine, which is the only safe way to inspect a production credential.
Identifiers and time
The UUID Generator produces version-4 UUIDs singly or in bulk, ready to paste into fixtures, database seeds and API tests. The Timestamp Converter translates both ways between Unix epoch seconds/milliseconds and readable dates in your timezone or UTC — the fastest answer to “what moment is 1767225600?” (it’s New Year 2026, UTC).
Front-end helpers
The Color Converter moves any color between HEX, RGB and HSL with a live swatch — paste #f97316, read off hsl(25 97% 53%), and build a hover shade by nudging the lightness. The CSS Unit Converter translates px ⇄ rem ⇄ em ⇄ % against a configurable base font size, which ends the “is 18px 1.125rem or 1.25rem?” arithmetic for good.
Worked example: debugging a rejected API token
An API suddenly answers 401. Paste the bearer token into the JWT Decoder: the payload shows "exp": 1756425600. Drop that number into the Timestamp Converter — it resolves to yesterday morning. Diagnosis in thirty seconds: the token simply expired, and nothing about your request was wrong. Refresh the token and move on.
Client-side by design: the only safe way to handle credentials
Security teams have a standing rule: never paste production tokens, secrets or hashes into random websites. The rule exists because most online developer tools are server-backed — the JWT you “just decoded” was transmitted to, and possibly logged by, someone else’s infrastructure. Every tool on this page is deliberately client-side: the decoding, hashing and generation run as JavaScript on your machine, and you can verify in your browser’s network tab that no request carries your input anywhere. That design is why it is safe to inspect a live production JWT here, and why the Hash Generator can be used on strings you would never send over the wire.
Common developer jobs, mapped to the right tool
“Why is this request unauthorized?” — decode the token in the JWT Decoder and check exp, aud and scopes. “Did the file transfer correctly?” — compare SHA-256 digests from the Hash Generator. “I need 50 unique IDs for seed data” — bulk mode in the UUID Generator. “What date is this epoch value?” — the Timestamp Converter, in both directions, with millisecond detection. “Design handed me HSL, the codebase uses HEX” — the Color Converter. “Is 18px 1.125rem?” — the CSS Unit Converter (yes, at a 16px base).
Bookmark the two you hit most. They load in under a second, work offline once loaded, and never rate-limit you.
Adjacent jobs live one page over: the text & string tools handle Base64, URL encoding and JSON formatting, and the full tools index lists every utility on the site.