Developer tools that run in your browser

What these tools are for

Most of this is the small, dull work between writing code and shipping it. You paste a wall of minified JSON into the JSON Formatter & Validator to find the missing brace. You need a fresh id, so you open the UUID Generator. You are looking at a permission string on a server and reach for the chmod Calculator. None of it is hard, but all of it is quicker in one box.

The rest lean towards the front end. The Colour Converter & Contrast tool moves a value between the common colour formats and shows how readable one colour is on another. Escape & Unescape shifts text between plain and escaped forms. Regex Tester, the CSS Selector Tester and the Flexbox Playground let you try a thing and watch it react. JSON to Code and the SVG Shape Generator write boilerplate for you.

Why the browser suits this subject

There is a real fit here that other subjects do not get. The browser is already a JavaScript engine, a CSS engine and an HTML parser. The CSS Selector Tester matches with the same code that will match on your page. The Flexbox Playground lays out real boxes, not a drawing of boxes. The User Agent Parser reads a string the browser handles every day. You are testing the thing itself.

The same fact sets the limits. Regex Tester runs JavaScript's flavour of regular expressions, so a pattern bound for Python, Go or grep still needs a check there. Tools that describe a system beyond the page can only do the rules. The chmod Calculator works out the number; it cannot see your server. Conventional Commits helps you word a message; it never touches your repository. The HTML Accessibility Checker reads the markup you paste, and no automated check can say whether your wording is clear.

Choosing between them

Several tools overlap, so pick the one named after what you want out, not what you have in. JSON to Code when you need something to paste into a source file; the JSON Formatter & Validator when you need to read a payload or find the fault in it. It also helps to know which half you want. A formatter makes a good file readable. A validator tells you a bad file is bad, and roughly where.

Paste the real thing, not a sample you trimmed by hand. Trimmed samples tend to be the ones that already work. Long strings, odd characters and deep nesting are what break a parser, and they are what is worth testing. Nothing you paste leaves the page, so there is no reason to hold back. Once a tool has loaded, it keeps working with the network off.

The HTTP tools here never make an HTTP request

A fair number of these tools are named after something that happens on a network, and not one of them opens a connection. The DNS Record Builder writes zone file lines but looks nothing up, so it will produce a well formed record for a domain that has never existed, and it can never tell you what is published right now. The API Spec Viewer reads an OpenAPI 3 or Swagger 2 file as browsable documentation and never calls the API it describes. The curl Converter rewrites a curl command as fetch, axios or Python requests; it does not run it. The Raw HTTP Message Inspector and the Access Log Analyser both work on text you already hold, captured by a proxy or written down by your own server.

For some of them that is the whole reason to use them. A HAR file is your browser's own record of a page load, and it carries every cookie, auth header and form post from that session, so handing one to a stranger's website is a poor trade. The HAR File Viewer draws the waterfall in your own tab instead. The JWT Decoder stops at the same line: it reads the header, the payload and the expiry, and explains the registered claims, but it does not check the signature. Verifying needs your secret or your public key, and a page that asks you to paste a signing secret is asking for the keys to your auth system.

Two id generators, five schemes, one argument about sorting

The UUID Generator makes version 4, version 7 and the nil UUID. The ULID & NanoID Generator makes ULIDs, NanoIDs, Snowflakes and version 4 again. Five schemes sounds like three too many until you know what they disagree about. A v4 is pure randomness, so consecutive rows land in unrelated places in a database index, and a run of inserts touches the whole tree rather than the hot end of it. Every other scheme on the list is an answer to that one problem.

v7 and ULID both open with the same 48-bit millisecond timestamp, so they sort by creation time. v7 then spends the next 12 bits on a counter, which keeps ids made inside a single millisecond in the order they were made, up to 4,096 of them before it borrows from the millisecond after. ULID writes its 26 characters in Crockford base32, an alphabet with no I, L, O or U, the first three being easy to confuse with 1 and 0. Snowflake packs 41 bits of time, a 10-bit machine id and a 12-bit sequence into 64 bits so it fits a bigint column; those 10 bits are also the ceiling, at 1,024 generators. NanoID argues the other way. Stay random, just be shorter: 21 characters carrying 126 bits, against the 122 random bits of a v4, in 15 fewer characters.

Both generators draw from crypto.getRandomValues and never from Math.random, and both read ids back as well as make them. Paste a UUID and you get its version and variant, plus the moment it was created if it is a v7. Paste a ULID or a Snowflake and you get the time, with a note that the Snowflake reading assumes the Twitter epoch, because Discord and others count from their own. A NanoID or a v4 holds no time at all, and the tool says so rather than inventing one. After each batch the second tool sorts a copy of what it just made and reports whether the ids really did come out in order, instead of asking you to take the claim on faith.

Why 22:22 in a compose file is not a port

The worst faults in a config file are the ones that parse. YAML 1.1 still reads 22:22 as a base-60 number, which is 22 × 60 + 22, or 1342. An unquoted ports line can therefore mean something entirely different with nothing complaining anywhere, so the Container Compose Converter writes every value holding a colon in quotes. It also splits the two volume short forms that look identical: data:/var/lib makes a named volume the engine keeps wherever it likes, while ./data:/var/lib binds the folder you are standing in.

Zone files have the same shape of trap. A name that does not end in a dot gets the origin stuck on the end of it, so a mail target typed as mail.example.com becomes mail.example.com.example.com, pointing nowhere, in a file that loads without a murmur. The DNS Record Builder prints every name twice, as you typed it and as the server will read it. HTTP supplies one more. Content-Length counts bytes, and text is not bytes: café is four characters and five bytes. A length worked out by counting characters is the usual reason a request hangs until it times out, with the server still waiting for a byte that was never coming. The Raw HTTP Message Inspector measures the body as UTF-8 and holds it against what the header claims.

The same habit runs through the heavier tools, which would rather say an awkward thing than look tidy. The Patch Applier reports which hunks moved and which needed fuzz, because a hunk that only matched after context was thrown away may have landed somewhere plausible and wrong. The API Spec Viewer merges allOf but refuses to merge oneOf or anyOf, since a merger of alternatives is an object that satisfies none of them; it shows the first branch and lists the rest beside it. The Access Log Analyser reads the first 300,000 lines and keeps 2,000 timings per path for its 95th percentile, then marks the rows where it hit that cap.