Webtools

Webtools

An online toolbox

Pick a tool to get started.

Webtools is a free collection of everyday developer utilities — encoders, formatters, generators, and testers — that live in one tab instead of ten different websites. Nothing requires an account or installation: open a tool, do the thing, close the tab. Where a tool's job doesn't need a server at all — generating a password, converting text case, building placeholder copy — it runs entirely in your browser and nothing you type ever leaves your device; where server-side processing genuinely helps, your input is used for that one request and immediately discarded.

Guides

Longer write-ups on the formats behind the tools, readable on their own.

Base64, Base64URL, and the padding problem

Why Base64 has two incompatible alphabets, what the = padding is for, and how to convert between the standard and URL-safe variants without corrupting data.

What's inside a JWT — and what it doesn't protect

A JWT is three Base64URL segments anyone can read. What each part contains, which claims actually mean something, and the difference between decoding a token and verifying it.

Reading a cron expression

The five fields, the step and range syntax, the day-of-month/day-of-week rule almost everyone gets wrong, and how daylight saving quietly skips or repeats jobs.

Choosing a hash function: MD5, SHA-1, SHA-256, and passwords

Which hashes are broken and for what, why a fast hash is the wrong tool for passwords, what length extension means for HMAC, and how to pick one for checksums, signatures, or storage.

UUID versions, and what they do to a database index

What the version and variant bits mean, how much entropy a v4 really has, why random UUIDs hurt B-tree inserts, and what UUIDv7 changes.

Percent-encoding: what to escape in a URL, and where

Reserved versus unreserved characters, why the rules differ per URL component, the difference between encodeURI and encodeURIComponent, and where the + for space myth comes from.

JSON, YAML and XML: picking a format, and their sharp edges

What each format actually optimises for, the YAML alias-bomb and XML external-entity risks, the Norway problem, and why round-tripping between them loses information.

Minifying JavaScript, CSS and HTML for production

What minification changes per language, why AST-based minifiers are safe where regex-based ones were not, what still breaks, and why it still matters alongside gzip and brotli.

JavaScript obfuscation: what it protects against, and what it doesn't

What control-flow flattening, string-array encoding and self-defending code actually do, why the browser having to run your code sets a hard limit on what obfuscation can hide, and where it's genuinely useful anyway.

HEX, RGB and HSL: how color actually works on the web

HSL isn't a different color model from RGB, just a different coordinate system for the same one — why that makes it easier to edit, where the hex alpha channel goes, and why HSL's Lightness isn't what your eyes perceive as brightness.

Naming conventions: camelCase, snake_case, and why splitting is the hard part

Where each casing convention came from, why Go makes case part of the language grammar rather than a style choice, and the actual algorithm for splitting an identifier into words correctly — including where it's genuinely ambiguous.

Lorem ipsum, and why realistic placeholder text is a UX trap

Where the Latin actually comes from, why filler text that reads as real language derails a design review, and the real limitation lorem ipsum's uniform word length hides until a much longer or much shorter piece of real content breaks the layout.

Four kinds of tools

Encoding & conversion

Translate data between the representations different systems expect: Base64 and percent-encoding for text that has to survive systems built for plain ASCII, color formats for design work, Unix timestamps for anything that stores time as a number, and YAML/JSON conversion and QR codes for moving data between tools and devices.

Formatting & code

Minify JSON, JavaScript, CSS, HTML, and XML for production, or beautify any of them back into something a human can actually read and review — the same operations, run in reverse.

Security & identifiers

Generate the fingerprints and identifiers software relies on: cryptographic hashes, random UUIDs, unique passwords drawn from your browser's own secure random number generator, and a JWT decoder for reading the tokens issued by login systems.

Generators & testing

Build and test text rather than transform it: a live regular-expression tester, a cron-expression explainer that shows the next five run times, a case converter for identifier naming, and a lorem ipsum generator for filling layouts before the real copy exists.

Frequently asked

Do I need to create an account?
No. Every tool works immediately, with no sign-up, login, or installation. Some tools use a server for the one request you make; none of them keeps a history of what you've used.

Is any of this stored or tracked?
Input you paste into a server-backed tool is processed for that one request and then discarded — nothing is logged. Tools that can run entirely in your browser, like the password generator and case converter, never send your input anywhere at all. See the Privacy Policy for what cookies and analytics are used for advertising.

Why is this free?
The site is supported by advertising, shown only after you choose to allow it in the cookie banner. There's no paid tier, no usage limit tied to an account, and no feature held back behind a signup.