Welcome

Online Dev Tools is a browser-based developer toolkit built for practical engineering work, fast troubleshooting, and technical exploration. Every utility runs locally in your browser, so you can inspect data quickly without creating an account or uploading files to a third-party server.

Teams use these tools during incident response, debugging sessions, API integration checks, and security reviews because they are simple, direct, and consistent. The goal is to reduce friction: open a tool, paste data, get useful output, and move on with your build.

Core tools include JSON Formatter, JSON Editor, JSON to TypeScript converter, JWT Decoder, Regex Tester, URL Parser, Base64 Encoder/Decoder, YAML Validator, UNIX Timestamp Converter, Diff Checker, CIDR/IP Converter, WHOIS Lookup, IP Lookup, CSP Analyzer, Hash Generator, UUID Generator, and Log Explorer.

Online Dev Tools is designed for web developers, full-stack engineers, security engineers, platform teams, and curious builders who want reliable utilities without noise. If you need quick diagnostics, secure local processing, and readable output, this toolbox is built for that exact workflow.

Who uses these tools

The platform is used by engineers who are in the middle of something — debugging an API integration, reviewing a security configuration before it ships, investigating an incident, or converting data between formats during a build. These are not learning tools in the traditional sense. They are working tools. You come here when you have a specific task, not when you are exploring a new concept for the first time.

That said, the blog and Learn hub do cover concepts in depth — not as prerequisites to using the tools, but as reference material for understanding what the tools are doing and when to use each one. If you want to understand the difference between hashing and HMAC, how Content Security Policy directives interact, or how to read a WHOIS record for threat intelligence, that content is there.

Example workflows

Debugging an API response: Paste the raw response body into the JSON Formatter to validate and pretty-print it. If the schema is unexpected, convert a sample to TypeScript types to document the shape. Use the Diff Checker to compare two response versions side by side when tracking down a regression.

Investigating a JWT: Paste the token into the JWT Decoder. It splits the header and payload, decodes both, and surfaces expiration (exp), issued-at (iat), and not-before (nbf) claims in readable format. You can immediately see whether a token is expired, what algorithm it was signed with, and what claims are present without writing a single line of code.

Reviewing a Content Security Policy: Paste the header value into the CSP Analyzer. It evaluates each directive, flags unsafe values like unsafe-inline and unsafe-eval, identifies missing directives, and assigns severity levels to each finding. Download the report as a text or JSON file to share with your team. Read the CSP hardening guide for the full workflow from report-only mode to enforcement.

Incident response: Open the Log Explorer and paste in raw log output. Filter by level, search for specific strings, and isolate the first error in a chain to find the root cause. Use the Regex Tester to validate the pattern you are searching for before applying it to a larger log volume. The log triage checklist walks through this workflow step by step.

Security and cryptography: Generate a SHA-256, SHA-512, or MD5 hash of any input using the Hash Generator — useful for integrity verification, password hashing research, or validating that a downloaded file matches its published checksum. Generate a UUID for test data or distributed system identifiers. Use Secure Paste to create a client-side encrypted, self-destructing snippet when you need to share sensitive data once and only once.

Network and domain investigation: Use the CIDR/IP Converter to calculate subnet ranges, broadcast addresses, and host counts without writing any code. Run a WHOIS lookup to check domain registration, registrar, nameservers, and expiration dates — useful for incident response, threat investigation, or evaluating a vendor domain before integrating with it. Use IP Lookup to check the geolocation and ASN of an IP address. The WHOIS domain intelligence guide covers how to build investigation workflows around this data.

How tools stay trustworthy

Every tool on this platform runs in the browser using client-side JavaScript. When you paste a JWT, a JSON payload, a CSP header, a hash input, or a log file into any tool here, it stays in your browser tab. Nothing is transmitted to a server for processing. Nothing is logged. There is no account, no session, and no history stored anywhere outside your own browser.

This is not a privacy policy — it is an architectural fact. The tools are static HTML files served from Cloudflare Pages. There is no application server processing your inputs. When you use the JSON Formatter, your JSON is parsed by your browser's JavaScript engine, formatted, and displayed back to you. The same is true for the JWT Decoder, the CSP Analyzer, the Hash Generator, and every other core tool on the platform. See the Privacy Policy for the full breakdown of what is and is not collected.

This matters most when the data you are working with is sensitive: a JWT from a production system, an internal API response with customer data, a log file from a live service, a hash of a production credential. With client-side tools, you do not have to make a judgment call about whether a third-party server is trustworthy. The code runs on your machine. You can inspect it, audit it, and verify it yourself.

Latest updates

JWT Decoder: header/payload decoding + exp/iat/nbf checks + export
CSP Analyzer: severity findings + report download (.txt/.json)
Blog publishing now updates the local blog index, RSS feed, and sitemap together

What is coming next

Launched: Secure Paste (client-side encrypted sharing)
Planned: DNS lookup suite + HTTP header checker

Related project

Additional experiments and lab work live at BigHomieCed's Labs.

Also built for incident response and troubleshooting workflows:

ErrorLookup.com

Common Use Cases

Formatting and validating malformed JSON payloads
Inspecting JWT headers, payload claims, and expiration values
Reviewing and debugging Content Security Policy headers
Generating cryptographic hashes for integrity checks
Creating UUIDs for distributed systems and test data
Exploring structured logs during debugging or incident response

Security Model

No backend data persistence
No cross-user data access
Stateless request model
No account authentication surface
Minimal attack surface due to static delivery

Why Local-First

Lower latency — no round-trip to a processing server
Reduced risk of sensitive data exposure
No backend infrastructure dependency for core functionality
Transparent, inspectable browser execution
Predictable behavior without hidden processing layers

Latest articles

The editorial side of the site is now maintained from local source files so the content feed stays aligned with the static site.

Why this site is trusted

Core formatting, parsing, hashing, and validation tools run in the browser
About, Contact, Privacy, and Terms pages are linked globally
Guides, tool pages, and blog posts cross-link so workflows are documented instead of left as thin utilities
Advertising supports hosting but does not gate core tool functionality

Take a Break

Two lightweight browser games built in-house.

Galactica Roguelike