What you paste stays on your machine
The things people paste into developer utilities are rarely harmless: a production JWT, an API response with customer records in it, an API key that has not been rotated yet. So the premise comes first. Everything here runs in your browser, so tokens and secrets never leave your machine. If you would rather check than trust, open the Network tab in DevTools and paste again. Nothing should go out. That is worth doing on any online tool before you hand it something real.
The risk with this kind of page was never that the maths is wrong. It is the act of pasting a live credential into somebody else's server. If you have already done that somewhere today, rotate the credential rather than hoping.
Encoding is not encryption
Three of the tools here produce output that looks scrambled and is not. Base64, percent encoding and the readable parts of a JWT are all reversible by anyone, with no key involved. Treating any of them as protection is the single most common mistake in this category.
- Base64 turns every 3 bytes into 4 characters, so the output is about a third longer than the input. It exists so that bytes survive channels that only carry text: mail attachments, the
Authorization: Basicheader, data URLs. It hides nothing, and it never compresses. - Percent encoding replaces characters a URL cannot carry with
%XXescapes. The unreadable string in your server log is usually not corruption, just an encoded parameter waiting to be decoded. - JWT header and payload are base64url, which means anyone holding the token can read the claims inside it. The signature proves the token was not altered, not that nobody read it, so email addresses, roles and internal identifiers in a payload are effectively public. Keep secrets out of it.
One more distinction worth keeping straight: the JWT page decodes only. Verifying a signature needs the shared secret or the public key, and that belongs on your server, not in a browser tab.
Which tool for which debugging job
The six tools split cleanly into reading something you were handed and producing something you need.
- A wall of single line JSON from an API, a log or a config file: the JSON formatter. It pretty prints and minifies, flags the line number when the syntax is broken, and has a tree view where clicking a key copies its JSONPath.
- Login works, then stops working: paste the token into the JWT decoder and read
expas a human readable time before you start blaming the auth library. - A string that will not round trip: the Base64 encoder and decoder handles the UTF-8 cases where
btoa()throws, and the URL encoder offers bothencodeURIandencodeURIComponent, which is the distinction that breaks most query strings. - You need identifiers: the UUID generator produces v4 for pure randomness and v7 when you want the value to sort by creation time, in batches.
- You need a credential: the password generator uses
crypto.getRandomValues(), lets you set length and character classes, can exclude lookalike characters, and shows an entropy estimate so the choice is not a guess.
The full list, including the tools that are currently Chinese only, is on the developer tools page.
Common questions
Is it safe to paste a production token into these pages?
Everything here runs in your browser, so tokens and secrets never leave your machine. You can confirm it yourself by opening the Network tab in DevTools and pasting again. That said, if a credential has been exposed anywhere else, rotate it rather than relying on any single tool. JWT decoder
Is Base64 a form of encryption?
No. Base64 is an encoding with no key, so anyone who sees the string can decode it, and the result is about a third longer than the input. If you need secrecy, encrypt the data first and Base64 the ciphertext only if it has to pass through a text-only channel. Base64 encoder
Does the JWT decoder verify the signature?
No. It decodes the header and payload and converts the expiry claim into a readable time. Verifying a signature requires the shared secret or the public key, which belongs on your server. A page that told you a token was valid without the key would be lying. JWT decoder
Should I use UUID v4 or v7?
Use v4 when you want pure randomness and nothing should be inferable from the value. Use v7 when the identifier is a database key and you want inserts to stay roughly in order, which is kinder to a B-tree index. The tradeoff is that v7 reveals roughly when the value was created. UUID generator
What is the difference between encodeURI and encodeURIComponent?
encodeURI leaves the characters that give a URL its structure alone, so it suits a whole address. encodeURIComponent escapes those too, so it suits one query parameter or path segment. Using the first where you needed the second is why an ampersand or a slash inside a value breaks the request. URL encoder
How long should a generated password be?
Length buys more strength than exotic characters do, so prefer a longer random string over a short one with substitutions. The generator shows an entropy estimate in bits as you change the length and character classes, which is a better guide than any rule of thumb. Password generator
Do these tools need an account or an install?
No. Open the page and use it. There is no sign-up, no usage limit, and nothing you typed survives closing the tab.