Text wrangling and developer odd jobs.

About these tools

Twenty-three tools for text you would rather not paste into a random website. Writing and editing: word and character counting, case conversion, find and replace, duplicate removal, sorting, and line-by-line comparison. Developer work: JSON formatting and validation, Base64, URL and HTML encoding, hashing, UUID generation, JWT decoding, and a regular-expression tester.

Everything runs locally, which matters most for the JSON formatter and the password tools — one often holds real production data, the other produces a secret. Neither should ever be typed into someone else's server.

Nothing here needs an account, and nothing you put into any of them is uploaded or stored. Every tool is a single page that does one job, so you can bookmark the one you use and skip this page entirely next time.

The privacy point, which is the real reason these exist

Most of what these tools handle is exactly the material that should not be pasted into an unfamiliar website. A JWT contains a session identity. An API response contains customer records. A configuration file contains internal hostnames. A diff between two contracts contains the contracts. Every hosted formatter, decoder and comparison tool receives all of that on its server, whatever its policy page says.

Everything in this section runs in your browser instead. The text you paste is processed by JavaScript on your own device and is never transmitted, which means these tools can be used on the material where it actually matters rather than only on things that were already public.

A note on the encoding and hashing tools

Two frequent misunderstandings are worth stating plainly, because both cause real security problems. Base64 is not encryption. It uses no key, hides nothing, and any encoded string can be decoded instantly by anyone. It exists to move binary data safely through text-only channels, not to protect it.

Hashing is one-way and cannot be reversed, but a general-purpose hash is the wrong tool for passwords. MD5 and SHA-1 are broken for security purposes — practical collisions have been demonstrated for both — and even SHA-256 is designed to be fast, which is precisely what you do not want when an attacker with a leaked database can test billions of guesses per second. Passwords need a deliberately slow, salted algorithm such as bcrypt, scrypt or Argon2.

Working with text at scale

Several of these tools come into their own on lists rather than single values: deduplicating an export, comparing two versions of a file, replacing a pattern across thousands of lines, or counting character frequencies to find an invisible character breaking a script. When results look wrong on a large input, the cause is almost always something invisible — trailing whitespace, mixed line endings, or smart quotes pasted from a word processor. Checking the before and after counts is the fastest way to catch it.

Browse the rest