JWTs explained: structure, claims, decoding vs verifying, and common mistakes
How JSON Web Tokens work, what each part and claim means, why decoding isn't verifying, and the mistakes that cause real security bugs.
· 8 min read
Free developer tools
19 fast, focused tools for everyday development work — JSON, JWTs, encodings, IDs, regex, colours and text. Everything runs in your browser, so tokens, keys and code you paste never leave your machine.
Client-side only — nothing you paste is uploaded, logged or stored
Your input stays local. Every tool here does its work in JavaScript on your device. There’s no server-side processing for these tools, no analytics on what you type, and nothing is saved.
Secrets are flagged. If you paste something that looks like a private key, token or password, the tool says so and reminds you it’s processed locally — and to rotate anything you think has leaked.
Honest results. Errors show the exact position and reason. Nothing is faked: the JWT decoder really verifies signatures with Web Crypto, and the JSON minifier never rewrites your numbers.
JSON and tokens
Format, check and shrink data; inspect JWTs.
JSON Formatter
Pretty-print or tidy JSON with your indentation and sorted keys.
JSON ValidatorFind the exact line, column and reason a JSON document is invalid — including duplicate keys.
JSON MinifierStrip whitespace (and JSONC comments) without changing a single value.
JWT DecoderRead a token’s claims and expiry, spot risky settings and verify its signature.
Encoding and decoding
Base64, URL percent-encoding and HTML entities — each direction with its own tool.
Base64 Encoder
Turn text or files into Base64, URL-safe Base64 or a data URI.
Base64 DecoderGet the text or file back, with type detection and image preview.
URL EncoderPercent-encode a query value, whole URL or form data.
URL DecoderDecode %XX, unwrap double encoding and list every query parameter.
HTML Entity EncoderEscape text and code so it displays safely in HTML.
HTML Entity DecoderDecode every named and numeric entity, and fix double-escaping.
Generators and converters
IDs, passwords, timestamps, colours and placeholder text.
UUID Generator
Random v4 or time-ordered v7 UUIDs, up to 1,000 at a time.
Password GeneratorStrong passwords and passphrases from a secure random source.
Unix Timestamp ConverterConvert epoch seconds or milliseconds to dates and back.
Color ConverterHEX, RGB, HSL, HWB, OKLCH — and a WCAG contrast check.
Lorem Ipsum GeneratorPlaceholder text as paragraphs, sentences or words, plain or HTML.
Text and patterns
Regular expressions, case conversion and counting.
Regex Tester
Test JavaScript regular expressions with matches, groups and replace.
Text Case ConvertercamelCase, snake_case, kebab-case, Title Case and more.
Word CounterWords, sentences, paragraphs, and reading and speaking time.
Character CounterCharacters, bytes, UTF-16 units and SMS segments.
Also useful
Developer guides
Short, practical explanations of the formats these tools work with.
A practical regex guide for JavaScript developers
The regular expression syntax you'll actually use in JavaScript — character classes, groups, lookarounds, flags and replacements — with examples you can try.
· 9 min read
CSS colour formats explained: HEX, RGB, HSL, HWB and OKLCH
What each CSS colour format means, when to use it, why OKLCH is useful for palettes, and how to check colour contrast for accessibility.
· 7 min read
JSON, Base64, URL encoding and HTML entities explained
What JSON, Base64, percent-encoding, HTML entities, UUIDs and Unix timestamps are for — and the common mistakes developers make with each.
· 7 min read