What each developer tool is for
These are the small utilities you reach for in the middle of debugging, when opening an IDE plugin or writing a one-off script would take longer than the task itself.
- Inspecting payloads: the JSON formatter pretty-prints JSON and flags syntax errors with the browser's parser message, which in Chrome and Firefox includes the line and column. The JWT decoder shows a token's header and claims, including when
expfalls. Decoding is not verifying, though: the signature is checked by your server, not by reading the token. - Encoding: use Base64 for binary-safe transport such as data URIs or Basic auth headers. Use URL encoding for query-string values. Neither is encryption.
- Converting formats: JSON to CSV, YAML and XML, plus CSV to Markdown tables for READMEs.
- Generating: UUIDs, hashes (SHA-256 for integrity checks; never plain hashes for storing passwords), cron expressions and .htaccess/nginx redirect rules.
- Shrinking: the HTML, CSS and JS minifiers strip whitespace and comments for quick one-off builds. For a real project, a bundler step is the better home for this.
Pasting production secrets into a web page is a reasonable thing to worry about. The formatters, encoders and decoders here run in your browser's JavaScript engine and make no network request with your input, which you can confirm in your browser's network tab. The exception is What is my IP, which by definition has to ask a server.