Developer tools
The utilities you keep in a browser tab all day — JSON, Base64, regex, JWT, hashes, YAML, XML, SQL and colour — without the ad walls or the sign-up.
23 free tools · no sign-up · nothing uploaded
Beautify, minify and validate JSON with error positions.
Check whether JSON is valid and see exactly what broke.
Encode or decode Base64 text and files, Unicode-safe.
Percent-encode text so it is safe inside a URL.
Turn percent-encoded escapes back into readable text.
Generate v4 UUIDs in bulk with a cryptographic source.
Read the header and payload of a JSON Web Token.
Convert between Unix timestamps and human dates.
Test regular expressions with live matches and groups.
Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes.
Strip whitespace from JSON to shrink payloads.
Make text safe inside a JSON string, or turn it back.
Beautify or minify XML with proper indentation.
Convert XML documents into JSON.
Turn JSON into well-formed XML.
Convert YAML configuration into JSON.
Convert JSON into readable YAML.
Escape characters so markup displays as text.
Turn HTML entities back into readable characters.
Minify or beautify CSS.
Shrink HTML by collapsing whitespace and comments.
Format SQL into readable clauses, or minify it.
Convert between HEX, RGB, HSL and CMYK — with contrast checks.
Why these run locally, and why that matters
Developer tools handle the most sensitive text most people ever paste into a website: production JSON payloads, JWTs from a live session, database queries with real table names, API responses full of customer records.
Pasting any of that into a server-side tool means handing it to a third party. Every developer tool on DO101 runs in your browser on the platform’s own APIs — JSON.parse for JSON, TextEncoder for Base64, Web Crypto for hashing, the browser’s own engine for regular expressions.
That is not a promise about a retention policy. There is simply no endpoint to send it to.
Honest about limits
The JWT Decoder states plainly that decoding a token does not verify its signature — a distinction that matters enormously and that many tools blur.
The Hash Generator offers SHA-1 through SHA-512 but not MD5, because browsers do not ship MD5 in Web Crypto and it is cryptographically broken. It also says outright that a plain SHA hash is the wrong tool for passwords.
The SQL Formatter reformats text and never claims to validate your query. The minifiers touch whitespace and comments only, never renaming or reordering anything, because those transformations can quietly change behaviour.
The daily set
JSON: format, validate, minify, escape, and convert to CSV, YAML or XML.
Encoding: Base64 with full Unicode support, URL encoding and HTML entities.
Inspecting: JWT Decoder, Regex Tester with a catastrophic-backtracking guard, Unix timestamps and hashes.
Generating: UUID v4 in bulk from the browser’s cryptographic random source.
Frequently asked questions
Is it safe to paste a production JWT here?
The decoding happens entirely in your browser and nothing is transmitted. Even so, treat live tokens like passwords — the safest habit is never to paste production credentials into any website, including this one.
Why is MD5 not available?
Browsers do not include MD5 in the Web Crypto API, and it has been cryptographically broken for years. Offering it would mean shipping a third-party implementation of an algorithm nobody should choose today.
Do these tools work offline?
Yes. Once a tool page has loaded, its code is cached and the tool keeps working with no connection at all.
Why are there no ads covering the tool?
Because the tool is the point. DO101 places advertising between content sections below the working area, and the whole site is fully usable with advertising disabled.