Core answer: developer tools routinely touch sensitive data — JWTs, keys, user payloads — so local in-browser computation is the baseline requirement. The recommended set: JSON formatter (with line/column errors), Base64 (URL-safe), regex tester (groups + flags), timestamp converter (s/ms auto-detect), hash (SHA family in parallel), JWT decoder. Verify Base64 with 5L2g5aW9 → 你好.
Selection principles
| Principle | Why | Test |
|---|---|---|
| Local computation | tokens/keys must not leak | disable network — still works |
| Standards-exact | Base64 URL-safe, UTF-8 handling | 你好 encodes to 5L2g5aW9 |
| Precise errors | debugging speed | JSON error gives line+column |
| No signup | tools should be instant | open and use |
The recommended toolkit
| Tool | Core job | Killer feature |
|---|---|---|
| JSON formatter | format/minify/escape | error line-column pinpointing |
| Base64 | encode/decode | URL-safe variant + UTF-8 |
| Regex tester | live matching | group capture table + flags |
| Timestamp | s/ms/μs/ns ↔ date | auto unit detection + timezones |
| Hash | SHA-1/256/384/512 | parallel multi-algorithm output |
| JWT decoder | header/payload decode | expiry check with countdown |
Sanity-check table
| Tool | Input | Must return |
|---|---|---|
| Base64 | 你好 | 5L2g5aW9 |
| Hash | abc → SHA-256 | ba7816bf8f01cfea…6a09e667f3bef (prefix ba7816bf) |
| Timestamp | 1700000000 | 2023-11-14 22:13:20 UTC |
| JSON | {"a":1,} | error at the trailing comma, position shown |
| Regex | \d{3}-\d{4} on “call 555-1234” | one match, 555-1234 |
Example: debugging a JWT login
Login returns 401 intermittently. Paste the token into a JWT decoder: payload decodes locally (signature unchecked — fine for inspection), exp reads 1735689600 — the token expired 3 hours ago. Root cause: the client cached a stale token. The whole inspection happens in-browser, so the credential never touches a third-party server.
Example: cleaning a JSON config
A 2,000-line config fails to parse with only “Unexpected token”. Paste it into a formatter with error positioning: “line 847, column 23 — trailing comma”. Fix, re-format with 2-space indent, sort keys, done in a minute. Without line/column reporting, finding that comma is an afternoon of bisection.
Common mistakes
- Pasting JWTs into random sites: server-side decoders can log credentials — only use tools that decode locally (or verify the network panel stays silent).
- Base64 ≠ encryption: it is an encoding, trivially reversible; never treat it as protection for secrets.
- Hash ≠ encryption either: SHA-256 is one-way but crackable for weak inputs via rainbow tables — passwords need salted KDFs (bcrypt/argon2).
- Timestamp unit confusion: JavaScript ms vs Unix s differ by 1,000×; a “year-51387” date means you fed ms into an s parser.