Tools
Fileraz
Tools
Fileraz
Try jpg to png, compress image, pdf…
Developer tools
Consider what actually ends up in one of these boxes. The JSON you need formatted is an API response you are debugging, complete with bearer token, internal hostnames, and a few real customer records. The Base64 string you need decoded is a basic-auth header or a service-account key. The JWT you are inspecting is a live session token.
Pasting that into a tool that posts it to a server means it lands in someone else's request logs, and quite possibly their error tracker too. Nobody is being malicious; it is simply what happens when the transformation runs server-side. Running it in the page removes the question entirely.
Two of these tools deserve a specific warning, because their names mislead people. Base64 is not encryption — it is a reversible encoding with no key, so anything “protected” that way is effectively plain text. And the JWT decoder does not verify signatures; it shows you the claims. Verifying would need the signing key, which should never go into a web page, ours included.
Worth knowing before you start, rather than after.
JSON: prettify, minify, and syntax validation only — no JSON Schema, JSONPath, or diffing.
JWT decoder reads claims; it does not verify signatures. Never paste signing keys.
Hashes: MD5 is checksum-only; SHA family is not for password storage — use bcrypt or Argon2.
Base64: UTF-8 text with optional URL-safe mode — encoding, not encryption.
Passwords: crypto randomness, length 4–128, charset toggles — not a password manager.
UUIDs: version 4 via crypto.randomUUID(), up to 100 per run.
Cron URL is a five-field parser with next five runs — not a visual builder or Quartz six-field.
SQL formatter uses generic dialect with uppercased keywords — not Postgres/T-SQL-specific.
HTML, CSS, and JS use js-beautify (indent 4) — not Prettier, ESLint, or Sass compile.
XML formatter indents markup — no XSD, XPath, or XSLT.
RegEx tester is JavaScript RegExp only — catastrophic patterns can freeze the tab.
Unix timestamps: seconds vs milliseconds inferred from digit length; no timezone picker.
Color converter: HEX/rgb/hsl in; CMYK is approximate — not print ICC.
QR codes are static SVG/PNG with size, ECC, and colours — no scan analytics.
No offline mode: there is no service worker, so the page must load over the network.
The transformations run in JavaScript in the page, so nothing you paste is sent over the network — you can confirm that in your browser's Network tab. Apply your own organisation's policy on handling production data as well.
No. There is no service worker, so the page has to load over the network each time. What is true is that your data is not transmitted once the page is loaded.
No. There is no public sign-up on this site at all, and no usage limits on any of these tools.
No, and this is worth being blunt about. Base64 is a reversible text encoding with no key. Anyone can decode it instantly. A credential stored Base64-encoded is stored in plain text with an extra step.
No. It decodes the header and payload so you can read them. Verifying a signature requires the signing key, which you should never paste into a web page.