All tools
Browse every free, browser-based developer tool on DevToolsCave: converters, encoders and decoders, and generators. No sign-up, no tracking, no uploads.
41 tools. One glimmer each, on the ceiling.
JSON
All of these run on the same parser, written for this site because the browser's built-in one is lossy in ways that matter: it rounds integers past 9,007,199,254,740,991, silently drops duplicate keys, and reports errors as a byte offset. These tools keep your original digits, show you both halves of a duplicated key, and point at the line that is actually wrong.
Time & Date
Time is the category where tools are most often confidently wrong, because the failure modes are invisible: seconds mistaken for milliseconds, a zone abbreviation that means two different offsets, a date that skips an hour because the clocks moved that night. These tools state their assumptions on screen instead of hiding them.
Encoding & Decoding
Encoding makes data safe to transport; it is not encryption and provides no secrecy. These tools decode in your browser, which matters because the values involved — tokens, credentials, payloads — are often things you should never paste into a website that uploads them.
Generators
Tools that produce new values on demand: identifiers, random numbers, sample data. Where randomness matters, these use the browser's cryptographic random source rather than Math.random, so the output is suitable for identifiers and not just for demos.
Text & Data
Text tools live or die on their handling of the awkward cases: multi-byte characters, mixed line endings, trailing whitespace that is invisible until it breaks a comparison. These treat those as the normal case rather than the exception.
Logs & Debugging
A production incident rarely hands you clean JSON — it hands you a log file where the payload you need is escaped twice, wrapped in a Java toString(), or cut off mid-line by a truncating appender. These tools are built for that mess: they find the structured data inside plain-text logs and pull it out intact, without asking you to write a regex first.
Config & Infra
Configuration formats look simple and are not. A .properties file separates its key from its value on the first unescaped space as readily as on an equals sign, and Java reads the whole file as ISO-8859-1. YAML resolves a bare no to false, and a leading zero to octal. These tools convert between them and tell you every place the meaning changed, rather than handing you a file that looks right.
Security & Hashing
Hashing tools are the ones it is least sensible to paste into a remote service, since the input is usually the secret. Everything here is computed locally with the browser's own Web Crypto implementation, and each tool says plainly what it can and cannot verify.
Color & Design
Color conversion looks trivial and is not: rounding between sRGB and HSL is lossy in both directions, and a value that round-trips unchanged in one direction may not in the other. These tools show the exact values rather than a re-rounded approximation.
Numbers & Bits
A number base converter built on parseInt is quietly wrong above 2^53, and every bitwise calculator built on JavaScript's own operators is quietly wrong above 32 bits. These tools run on BigInt throughout, state the width and signedness a value was read with instead of picking one, and say plainly when a fraction never terminates rather than rounding it and hoping.
Web & Markup
Every free minifier in this category is built on one of two libraries that silently delete a CSS rule nested with the & selector — measured 2026-09-10, no warning, HTTP 200. These tools are hand-written and nesting-native, keep licence comments by default, and show the gzip size a browser actually downloads rather than the raw byte count nobody transfers.
How these tools work
Every tool listed above runs as JavaScript inside your own browser tab. When you paste a JSON Web Token or a base64 string, the decoding happens on your device and the result never travels across the network — there is no API call behind these tools, and no server that could log what you entered even if it wanted to. You can verify this yourself: open your browser's developer tools, switch to the Network tab, and use any tool on this site. You will not see a request go out.
That design has a practical consequence beyond privacy. Because there is no round-trip, results appear as you type rather than after a submit, there are no rate limits or usage quotas, and the tools keep working when your connection does not. The site is installable as an app, and once installed the whole catalog is available offline.
Why paste-into-a-website is a real risk
Developer utilities are a soft target precisely because the values people paste into them are sensitive by nature: session tokens, API keys, internal identifiers, customer data pulled from a log line. A tool that posts your input to a backend has, at minimum, put that value into someone else's request logs. The convenient habit — search for "jwt decoder", click the first result, paste — is how credentials end up on servers nobody audited.
The honest answer is not to trust a promise on a marketing page, including this one. Prefer tools that decode locally, check the network tab when it matters, and treat any token you have pasted into an unknown site as compromised.
What gets added next
The catalog is deliberately small and growing slowly: each tool is unit-tested against its edge cases before its interface exists, because a utility that is quietly wrong on unusual input is worse than no utility at all. Planned additions include hash generators, a structural JSON diff, and a text diff viewer. There's also a percent-encoding reference table alongside the URL tools above, for looking up how a single character encodes across all four modes.