I keep a browser window open on my second monitor that is nothing but utility tabs. JSON formatter, timestamp converter, regex tester, hash generator. It has been there for years, through WP Adminify releases, through Laravel side projects, through every late-night debugging session where a webhook payload arrives minified and I need to see what's actually in it.
For a long time those tabs pointed at seven different websites. Some were fine. Some were ad farms that uploaded my payload to a server I'd never heard of. One of them — I'm not going to name it — I pasted a staging JWT into before the thought caught up with me: that token just went over the wire to someone else's box. It was a staging token, nothing burned, but the feeling stuck. I built toolz.dev partly because I wanted my own tab strip, and partly because I never wanted to make that particular mistake again.
So this isn't a list of 500 tools scraped from a directory. It's the set that's actually live on toolz.dev right now — 40-odd of them — organized the way I use them: by the moment in the workday when I reach for one. Every one runs in your browser. Nothing uploads. There is no account.
TL;DR: The five I open most, by a mile: JSON Formatter for unreadable API responses, Timestamp Converter for log forensics, Regex Tester for pattern work, Base64 Converter for JWTs and data URIs, and UUID Generator for seeding test data. Everything below runs client-side — your payload never leaves the tab. If you only bookmark one thing, bookmark the JSON formatter.
Why Not Just Use the CLI?
Fair question, and I do use the CLI. jq is better than any web tool for scripting. base64 -d is two keystrokes. If a task is going into a shell script, it belongs in a shell script.
But there are three situations where a browser tab genuinely wins, and after about a decade of doing this I've stopped feeling guilty about them:
- Visual feedback loops. Regex is the obvious one. Seeing 14 matches light up in a sample of real text as you type is a different activity from running
grep -Pand getting a yes/no. Same for gradients and colors — you cannot eyeball a hex code. - The machine isn't yours. Client laptop, locked-down work machine, someone else's desk during a pairing session. No
jq, no install rights, no time. - The task is genuinely one-off. I am not writing a Python script to convert one CSV to JSON. I'm going to paste it, click, and get on with my life.
Here's the honest comparison I'd give a junior dev asking which to use:
| Browser tool | CLI (jq, sed, openssl) |
IDE plugin | Desktop app | |
|---|---|---|---|---|
| Setup cost | Zero | Install + learn syntax | Install per editor | Install, often paid |
| Good at | One-off, visual, exploratory | Scripting, pipelines, bulk | Inline edits in a file | Heavy media, offline batch |
| Visual preview | Yes | No | Partial | Yes |
| Works on a locked-down machine | Yes | Usually not | No | No |
| Data leaves your device | Only if the tool is server-side | No | No | Usually no |
| Reproducible in CI | No | Yes | No | No |
| Where I'd draw the line | Under ~30 seconds of work | Anything repeated | Anything in the file already | Anything over 50 MB |
That last row is the actual rule I follow. If I'm going to do a thing more than twice, it goes in a script. Everything else gets a tab.
Which Tools Do I Open During a Bad API Day?
This is the cluster that earns its keep. A third-party API is misbehaving, you have a payload, and you need to understand it before you can fix anything.
JSON Formatter — the one I'd keep if I could keep only one
Minified JSON is unreadable, and worse, when it's invalid the browser error tells you "Unexpected token" and a character offset that means nothing to a human. The JSON Formatter pretty-prints it with real indentation and points at the actual line that's broken. Ninety percent of the time the culprit is a trailing comma, which is legal in JavaScript object literals and illegal in JSON — a distinction that has cost me more hours than I want to add up. Deeper dive: How to Format JSON Online.
Base64 Converter — for JWTs and data URIs
A JWT is three Base64url segments separated by dots. Paste the middle one into the Base64 Converter and you can read the claims — issuer, expiry, scopes — without shipping the token to a third-party decoder. (I use the JWT Decoder when I want all three segments parsed at once, but I still reach for raw Base64 when a payload looks weird and I want to see the bytes.) The Unicode gotcha, and why btoa() throws on an emoji, is in the Base64 Encoding guide.
Timestamp Converter — log forensics
1752278400. Is that yesterday or 2029? The Timestamp Converter turns Unix seconds, milliseconds, and ISO 8601 into something a human can reason about, in the timezone you care about. Two-thirds of my incident debugging is lining up timestamps from three services that each logged in a different format, and one of them is in UTC while the others aren't.
YAML Validator — because indentation is load-bearing
Kubernetes manifests, GitHub Actions, docker-compose. YAML is whitespace-significant and it will silently reinterpret your intent rather than error out. The YAML Validator catches the tab-vs-space and the unquoted no that YAML 1.1 helpfully parses as boolean false. (Yes, really. The Norway problem is real: the country code NO becomes false unless you quote it.)
JSON Diff — what actually changed?
Two API responses, one working and one not. Staring at them side by side in a text editor is a losing game. JSON Diff shows you the three keys that differ and ignores the 200 that don't.
The rest of the debugging shelf
- SQL Formatter — for the 90-line query with four joins that someone wrote on one line.
- Hash Generator — MD5/SHA-1/SHA-256/SHA-512, mostly for verifying a download or a cache key.
- Cron Parser — because
0 */2 * * *and*/2 * * * *differ by one character and about sixty times the load. - Unserialize — PHP
serialize()output out of awp_optionsrow. If you've ever debugged a WordPress plugin's stored settings, you know exactly why this exists.
What Do I Use When I'm Writing Code, Not Debugging It?
Regex, without the guessing
I write regex in the Regex Tester before it ever touches a codebase. Paste a realistic sample, write the pattern, watch the matches highlight. The Regex Builder is the other half of this — it's for when you know what you want in English and can't remember whether it's \b or \B. The full pattern cheat sheet, plus the catastrophic-backtracking trap that can freeze a server with one nested quantifier, is in the Regex Builder guide.
UUIDs for seeding
Twenty test rows, twenty unique IDs, right now. UUID Generator does v1, v4, and v7 in bulk. Use v7 for new primary keys — it's time-ordered, so your B-tree index doesn't get shredded by random inserts. I learned that the expensive way and wrote it up in the UUID Generator guide.
Encoding, both flavors
URL Encoder for query strings that contain & and = and a space. HTML Entities for the moment you need to display <script> on a page as text rather than as an incident report. These two are boring and I use them constantly.
Format wrangling
Data arrives in the wrong shape roughly always. The conversion set covers the moves I actually make:
- JSON to CSV — when a stakeholder asks for "the data" and means a spreadsheet. Nested objects get flattened into dot-notation columns. Details in the JSON to CSV guide.
- CSV to JSON — the reverse, for seeding.
- JSON to YAML — for turning a config blob into something a human will edit.
- XML to JSON — every legacy SOAP integration, forever.
- Binary Translator — text ↔ binary/hex/decimal/octal. Mostly for teaching and for the odd protocol byte.
The whole coding shelf, with the reasoning behind each, is in the Coding Tools guide.
Which Ones Do I Use for Text and Content?
I write a lot — plugin docs, changelogs, this blog. These are the tools between draft and publish.
- Word Counter — words, characters, reading time. Also the fastest way to check a meta description against the 160-character budget before Google truncates it. More in the Word Counter guide.
- Case Converter — camelCase, snake_case, kebab-case, PascalCase. I rename variables in bulk this way more often than I use my editor's refactor tool, which is faintly embarrassing but true. Case Converter guide.
- Slug Generator — title to URL, with diacritics handled properly.
Café Décorshould becomecafe-decor, notcaf-dcor. - Text Diff — two config files, or two versions of a paragraph, side by side.
- Lorem Ipsum — placeholder copy for a layout that has no content yet.
- String Reverse — niche, but it shows up in interview prep and in palindrome checks more than you'd think.
The full text set is covered in the Text Tools guide.
What About Design and Frontend Work?
I am a developer who has to make things look acceptable, not a designer. That's a specific job, and these three do it.
- Color Picker — HEX ↔ RGB ↔ HSL, with contrast checking so you don't ship 3:1 body text. HSL is the format that makes hover states a subtraction instead of a guess. Full treatment: Color Picker & Converter guide.
- Gradient Generator — linear, radial, conic, with a live preview and copyable CSS. Writing
conic-gradient()blind is a special kind of misery. CSS Gradient Generator guide. - CSS Minifier and HTML Minifier — for the moment you need to inline something into a
<style>tag and want it small. - Meta Tag Generator — title, description, Open Graph, Twitter cards, and JSON-LD in one pass. I built this because I was hand-writing the same fourteen tags on every project.
What Do I Use for Files — Images, PDFs, Everything Else?
The image tools all run through the browser's Canvas API, which means a 4 MB PNG never leaves your machine. That's not marketing; it's just what happens when the processing is a <canvas> and not a POST request.
- Image Compress — quality slider, live size readout. Most screenshots I ship drop 70–85% with no visible difference. See the Image Compression guide.
- Image Resize — exact dimensions or a percentage, aspect ratio locked.
- Format Converter — PNG/JPEG/WebP/AVIF. WebP is the default I ship now.
- Background Remover — runs the segmentation model in the browser. It's the one tool where I notice the first load.
- QR Generator — URLs, WiFi credentials, vCards. I wrote the ISO/IEC 18004 encoder for this one by hand, error correction and all, which was either a great use of a weekend or a terrible one.
- Password Generator — uses
crypto.getRandomValues(), notMath.random(). That distinction matters more than the length slider does.
And a few odds and ends I built because I needed them once and then kept needing them: Unit Converter, Percentage Calculator, Date Difference, Text to Handwriting.
The broader image set is in the Image Tools guide, and PDFs get their own treatment in the PDF Tools guide.
How Do These Chain Together in Real Work?
Individually each tool saves a minute. The compounding happens when you chain them. Here's an actual sequence from a week ago, debugging an integration that was returning 401s intermittently:
- Copy the failing request's
Authorizationheader. Split on the dots, paste segment two into the Base64 Converter. Readexp. expis a Unix timestamp. Into the Timestamp Converter. It expired 41 seconds before the request fired.- That's a clock skew problem, not an auth problem. Check the refresh cron with the Cron Parser — it was refreshing the token every 60 minutes for a token with a 60-minute TTL. No margin. Race condition.
- Change the cron to 50 minutes. Done.
Four tools, maybe three minutes, and the answer was a one-character change to a cron expression. The alternative — adding logging, redeploying, waiting for it to recur — was a half-day.
The other chain I run constantly is the content one: draft → Word Counter → Slug Generator → Image Compress for the header image → Meta Tag Generator → publish.
Why Does "Client-Side" Actually Matter?
Because of the staging-token story at the top of this post, mostly. But let me be precise about the claim rather than hand-wavy, since "privacy-first" is a phrase that's been drained of all meaning.
When a tool is client-side, the file or the string you paste is handled by JavaScript running in your tab. It goes into a variable in your browser's memory and comes back out as a result. There is no fetch(), no FormData, no upload. You can verify this yourself in about ten seconds: open DevTools, go to the Network tab, paste something into any tool on toolz.dev, and watch nothing happen. That's the whole proof. If a network request fires when you click "convert," your data is on someone's server.
What that buys you concretely:
- You can paste secrets. Staging tokens, internal API responses, a client's customer CSV. It's not going anywhere.
- It's fast. No round trip. A 5 MB JSON file formats in the time it takes the browser to parse it.
- No file size ceiling beyond your own RAM.
- No rate limit, because there's no server to rate-limit you.
The tradeoff is real and I'll name it: heavy work (a 200 MB video, an OCR pass over 500 pages) is genuinely slower in a browser than on a server with a GPU. Client-side is the right default, not a universal answer.
Frequently Asked Questions
Are these developer productivity tools actually free?
Yes — no account, no usage cap, no trial that expires. The tools run on your machine, which means they cost me effectively nothing per use, which means there's nothing to meter.
Do I need an account to use them?
No. Open a tool, use it, close the tab. There is no signup wall, and because processing is client-side there's no session to attach your data to in the first place.
Is it safe to paste sensitive data like API keys or tokens?
For the client-side tools, yes — and you can confirm it rather than trust me. Open your browser's DevTools Network tab, paste, and watch for outbound requests. There aren't any. The one thing I'd still avoid anywhere, including here, is pasting a production secret you can't rotate — not because of the tool, but because clipboards, screen shares, and browser extensions are all real attack surfaces.
Do these tools work offline?
The page has to load once. After that, most tools keep working if your connection drops, because the JavaScript that does the work is already in your tab. Reload the page while offline and you'll get nothing.
How do these compare to CLI tools like jq or openssl?
Different jobs. CLI wins for anything scripted, repeated, or in CI — it's composable and reproducible. Browser tools win for one-off tasks, anything that benefits from a visual preview (regex, gradients, colors, image quality), and machines where you can't install software. I use both daily and don't think it's a competition.
Which tools should I bookmark first?
If you write code: JSON Formatter, Timestamp Converter, Regex Tester, Base64 Converter. If you write content: Word Counter, Slug Generator, Image Compress. If you do frontend: Color Picker, Gradient Generator, Meta Tag Generator. Bookmark them as a folder and middle-click the folder to open them all at once.
Do the tools work on mobile?
They're responsive and they function, but I'll be honest — I designed them for a keyboard and a wide viewport. Paste-and-copy tasks are fine on a phone. Anything involving a color spectrum or a regex sample is going to be a fight.
Is there an API for these tools?
Not currently. Everything is client-side by design, which is fundamentally at odds with a server-side API. For programmatic use, the underlying operations are all one library call away in whatever language you're already writing — json_encode, base64_decode, preg_match, and so on.
What are the best free online tools for developers?
It depends on your work, but a solid core covers formatting and inspection (JSON Formatter, Base64 Converter), time and text (Timestamp Converter, Word Counter, Slug Generator), pattern work (Regex Tester), and media (Image Compress, Color Picker). toolz.dev keeps 600+ of them in one place, all free and client-side. The best tool is usually the one already open in a tab when you hit the friction.
Can I use these developer tools without installing anything?
Yes — there is nothing to install and no extension to add. Each tool is a web page that runs its logic in your browser, so you open a URL and start working on any operating system. Once the page has loaded it keeps working even if your connection drops.
The Short Version
Developer productivity isn't one big unlock. It's the removal of a hundred small frictions: the payload you can't read, the timestamp you can't parse, the regex you're guessing at, the screenshot that's 4 MB when it should be 400 KB. None of those individually is worth a blog post. Collectively they're most of the difference between a day where you shipped something and a day where you were busy.
Everything here is at toolz.dev, free, in your browser, with your data staying on your machine. Start with the JSON Formatter — if you only take one tab from this post, that's the one that pays for itself by lunchtime.
