Free online developer tools
ToolzYard offers 50+ free online developer tools that run in your browser. Format and convert data, encode and decode text, generate hashes and tokens, build CSS, and run network lookups. Most tools process your input locally on your device; network tools query public data sources to return live results.
Format and beautify JSON instantly.
Validate JSON structure and fix errors.
Convert JSON data to CSV format.
Convert CSV files to JSON data.
Convert JSON data into XML.
Convert XML into JSON format.
Convert JSON to YAML format.
Convert YAML to JSON instantly.
Flatten nested JSON structures.
Escape JSON strings safely.
Query JSON data using JSONPath.
Clean and format CSV data.
Beautify and format XML.
Convert markdown into HTML.
Generate MD5 and SHA256 hashes.
Create SHA256 hashes instantly.
Create HMAC signatures.
Encrypt and decrypt text.
Decode JWT tokens.
Create JWT tokens.
Create secure passwords.
Generate UUID values.
Generate multiple UUIDs.
Count words and characters.
Reverse text instantly.
Compare text differences.
Convert text case formats.
Create SEO-friendly slugs.
Generate placeholder text.
Generate random strings.
Create random numbers.
Test regular expressions with live matches.
Create CSS gradients.
Create CSS shadows.
Generate border radius CSS.
Create flexbox layouts.
Generate CSS grid layouts.
Pick and convert HEX, RGB, and HSL colors.
Format or minify CSS code.
Compress HTML to reduce file size.
This is the distinction worth knowing before you paste anything sensitive. The overwhelming majority of these tools are pure JavaScript: the JSON, CSV, XML, YAML, Markdown, encoding, text, CSS and crypto tools all run in your browser, and your input is never transmitted anywhere. You can confirm it by opening the network tab and watching nothing happen.
Exactly five tools break that rule, because they answer questions only a remote server can
answer. DNS Lookup asks Google Public DNS.
IP Lookup asks ipapi.co.
WHOIS Lookup asks rdap.org.
SSL Checker reads Certificate Transparency logs. And
HTTP Header Checker falls back to a CORS proxy when a
site blocks a direct read — which means the URL you type is handed to that proxy, so do not run
it on links containing session tokens. Every one of those pages says so, and the
Privacy Policy names each endpoint.
A few of these look interchangeable and are not. Hashing is not encryption: the Hash Generator and SHA-256 Generator produce one-way fingerprints you cannot reverse, while AES Encryption is reversible with a key. Neither is Base64, which is encoding and offers no secrecy at all.
Decoding a JWT is not verifying it.
JWT Decode reads the claims, which anyone holding the token can
do. It proves nothing about authenticity. And randomness has grades: the
Password Generator,
UUID Generator and
Random String Generator draw from your browser's
cryptographic random source, while the
Random Number Generator and
Lorem Ipsum Generator use
Math.random() — perfectly good for test data, useless for secrets.
All but five, no. The JSON, CSV, XML, YAML, encoding, text, CSS and crypto tools run entirely as JavaScript in your browser. The exceptions are DNS Lookup, IP Lookup, WHOIS Lookup, SSL Checker and HTTP Header Checker, each of which must query a remote service to produce an answer, and each of which names the service it contacts.
Any of the browser-only ones — formatting a JSON payload containing customer records never sends it anywhere. Be careful with the HTTP Header Checker, whose proxy fallback receives the full URL. And do not use the AES tool to protect real secrets: it derives its key with a single MD5 pass and uses an unauthenticated cipher mode, which its own page explains.
The Password Generator, UUID Generator, UUID Bulk Generator and Random String Generator all use crypto.getRandomValues(), and the string generator applies rejection sampling so no character is more likely than another. The Random Number and Lorem Ipsum generators use Math.random(), which is not a cryptographically secure source and should never be used for anything that must be unguessable.
Because the tool is the easy part. Knowing that UUID v7 beats v4 as a primary key in InnoDB, that a gradient interpolated in sRGB goes muddy in the middle, or that alg:none is a real JWT attack is what actually saves you time. The guides are written by the person who builds the tools, and corrections are welcome.