I built 60+ developer tools that run 100% in your browser — here's how the "network" ones work

Every time I paste a JWT into some random online decoder, a small voice in my head asks: where is this token going? Most online tools POST your input to a server. For a JSON formatter that's mildly annoying. For a JWT decoder or a password generator, it's genuinely bad practice.

So I built developk.kr — a collection of 60+ developer utilities where nothing you type ever leaves your browser. No installs, no sign-ups, no uploads. Formatting, hashing, encoding, diffing — all client-side JavaScript.

The easy part was the tools that are pure computation. The interesting part was the "network" tools — DNS lookup, WHOIS, SSL checks — which need data from the outside world. Here's how I kept those server-free too.

The trick for network tools: public CORS-friendly APIs

A DNS lookup tool can't just open a socket in the browser. Instead of running my own backend, I used existing public resolvers that speak HTTP:

• DNS / MX lookups → DNS over HTTPS via cloudflare-dns.com, which returns JSON and allows CORS:

const res = await fetch(
  "https://cloudflare-dns.com/dns-query?name=example.com&type=A",
  { headers: { accept: "application/dns-json" } }
);
const { Answer } = await res.json();

• WHOIS → RDAP (rdap.org) instead of port-43 WHOIS. RDAP is the modern JSON replacement for WHOIS and works fine over HTTPS.
• IP geolocation → ip-api.com / ipwho.is free tiers.
• HTTP header / OGP checks → direct fetch to the target with mode: "cors", and the tool explains when a target blocks it.

Result: the "server" for these tools is the public internet itself. My site ships only static files.

What stays client-side

Everything else never touches a network at all:

• JSON formatter / encoder / diff — pure JS parsing and diffing
• Hash generator — crypto.subtle.digest() (the Web Crypto API, not a JS sha lib)
• Base64 / URL / HTML entity encoders — btoa/atob plus manual UTF-8 handling for non-ASCII
• CIDR calculator, timestamp converter, JWT decoder — bit math and Date

The JWT decoder is the one I'm happiest about: it decodes the header and payload segments and formats claims (exp, iat, nbf) into human-readable timestamps — all offline. Decoding a JWT is just Base64URL parsing; it never needed a server, yet most online decoders still send your tokens to theirs.

Why "no server" is more than a privacy slogan

Beyond not seeing your data, it changes the whole cost and trust model:

• Zero upload latency — a 5MB JSON file formats instantly because nothing goes over the wire
• Nothing to breach — there is no server-side storage to leak
• Static hosting — the whole site is HTML/CSS/JS on Cloudflare Pages, so it's cheap and fast anywhere

Reference content as a bonus

Each tool also ships with a written guide (60+ of them so far) — e.g. a JWT explained guide with the registered claims table, or a Base64 alphabet reference. These are meant to be the pages you bookmark, with the tool one tab away.

The tools are all free at developk.kr. There's also a sister set for PDF work (pdf.developk.kr) and images (image-tools.developk.kr) with the same browser-only rule — files are processed locally and never uploaded.

If you've got a network tool idea that seems impossible without a backend, I'd bet there's a public HTTPS API that makes it work. Curious what others have used for this pattern.