DEV Community

chenghui wu
chenghui wu

Posted on

15 tiny developer annoyances I stopped tolerating this year (and the browser tools that fixed them)

You know that specific flavor of dev annoyance — the tiny task that shouldn't exist, appears three times a week, and steals five minutes each time?

  • "This JWT looks wrong somehow."
  • "The API returned 418. Cool. What?"
  • "I need to strip EXIF before I post this photo."
  • "Merge these 8 PDFs into one, please."
  • "How much will this GPT-4o batch actually cost me?"

Individually, none of them are a crisis. Together, they're death by a thousand paper cuts. Over the last year I got tired of it and started building a tool for every single one — DevKits.vip. It's now 160+ tools, everything runs locally in your browser, no accounts, no uploads.

This post isn't the tool list. It's the 15 scenarios. Every dev has hit at least half of these. Let's go.

Ground rules

  • 100% local. Every operation runs in your browser. Your JWTs, private keys, PDFs, and photos never touch a server.
  • No accounts, no tracking of your inputs. Analytics counts page views. That's it.
  • Free forever. No trial, no upgrade nag.

If you're the kind of person who reflexively pastes secrets into random online tools, I hope this post at least gives you a safer place to do it.

Hero: three tools in one browser session — JWT Verifier, Fake Data Generator, Password Strength Checker

1. "A coworker sent me a JWT and something's off"

The user says login is broken. You get the JWT. Now what?

  • Header wrong? Payload wrong? Signature wrong?
  • Expired? Not-yet-valid? Issued in the future because someone's server clock is wild?
  • The classic — alg: "none" because someone's library trusted the header?

Old flow: paste into jwt.io, squint at the payload, wonder if the signature was actually checked, dig up the key from a Slack thread from 2 months ago.

New flow: JWT Decoder shows the header + payload immediately. If you have the signing key (secret or public PEM/JWK), JWT Verifier takes it and gives you a definitive pass/fail — plus per-claim time status (exp, nbf, iat).

It handles all 12 RFC 7518 algorithms: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512. alg: none is explicitly rejected as invalid.

JWT Verifier: green signature, red expired chip

Companion tools when you're on the producing side:

  • JWT Generator — signs with any of the 12 algorithms
  • JWKS Generator — build a /.well-known/jwks.json from your public keys
  • Public Key Extractor — derive the public key from a private one (found out your JWKS is out of date? this is faster than regenerating)

2. "Two API responses look almost identical, but which field actually changed?"

You're regression-testing an API. Git-style diff shows you 40 red-green lines — but 39 of them are because your JSON library sorted keys differently.

JSON Diff does a structural comparison. Key order doesn't matter. It tells you: "field user.email changed from alice@a.com to alice@b.com. Nothing else."

Same idea for YAML Diff (Kubernetes / Helm values), XML Diff, and character-level Text Diff with syntax-highlighted Code Diff for actual source code.

Bonus: all 5 diff tools now generate shareable URLs. Content is compressed with deflate-raw into the URL hash — nothing sent to any server, but the link works cross-machine.

JSON Diff: one real change, no key-order noise

3. "Postman gave me a cURL. I need it in Go."

Someone drops a curl -X POST -H 'Authorization: Bearer …' in Slack. You need it as production code by end of day.

cURL Converter — paste the cURL, click a language tab: Python / Node / Go / PHP / Ruby / Java. Ready to compile. Handles multi-line curls, multiple headers, JSON bodies, basic auth, everything.

cURL Converter: Stripe charge command → Go code

4. "The API returned 418. Cool. What?"

You know 200, 404, 500. But 418? 451? 511? And the perennial code-review argument: 401 vs 403?

HTTP Status Codes reference — 60+ codes, each on its own page, with the RFC citation, "when to use it," "how clients react to it," and internal comparisons. The 301/302/307/308 comparison and the 401 vs 403 breakdown are worth bookmarking alone.

Same treatment for HTTP Headers (45 headers, real-world examples) and MIME Types (50+, one page each).

HTTP 401 vs 403: when to use each

5. "I need a regex for X. Not writing it from scratch."

Every regex is a bug waiting to happen. The email one especially.

  • Regex Cookbook — 30 tested patterns (email, URL, IPv4, IPv6, UUID, hex color, phone, credit card, ISO date, semver, …) each with copy-ready JavaScript / Python / Go / Java snippets. These are tested. You can steal them.
  • Regex Tester — paste your pattern + test input, get live match highlighting and named-group output.
  • Regex Replace — with backreferences and a live preview so you don't have to run your dry-run 12 times.
  • Visual Regex Explainer — hover any part of a pattern to see what it does. Great for maintaining regex written by past-you.

Visual regex explainer: hover any part, see what it does

6. "My CSV has 47 columns and 'Smith, John' in one of them and I need it as JSON"

The "convert this data blob before I can even do real work" tax. Every non-trivial CSV has quoted commas that break every naïve parser.

Paste, click, done.

7. "I have a JSON payload and I want a typed interface for it"

Stripe webhook, Shopify order, whatever. You need type Order = { … } and you'd rather not hand-write 47 field declarations.

All handle nested objects, arrays, optional fields, null unions, and preserve field naming casing.

JSON → TypeScript interfaces, nested types handled

8. "The LLM returned broken JSON again"

Every RAG / agent developer has hit this. The response comes wrapped in `json, contains trailing commas, uses True/False/None because the model was trained on Python, single-quotes some fields. JSON.parse() throws. You retry, which burns tokens.

JSON Repair fixes all of the above, deterministically, in one pass. It handles:

  • Trailing commas
  • Single quotes instead of double
  • Unquoted object keys
  • Python-style True / False / None
  • Markdown code fences
  • Missing closing brackets (best-effort recovery)

Paste the broken output, get valid JSON.

JSON Repair: LLM slop in, strict JSON out

Related: JSON Validator gives you the exact line/column of every syntax error if you'd rather fix by hand.

9. "Wait — does this photo I'm about to post leak my home address?"

Every JPG straight off a phone can carry: GPS coordinates (to 5 meters), device serial number, timestamp, camera settings, sometimes even the WiFi network name.

  • EXIF Viewer — drag any photo, see what's in there. Includes a map pin if GPS is present.
  • EXIF Remover — strip all metadata losslessly (no re-encoding, no quality loss).

The file never leaves your browser. This is the one tool I'd tell a non-dev friend to use before posting anything to social media.

EXIF Viewer: what your phone photo actually contains

10. "Client sent 8 PDFs. Needs to be one."

The most-googled PDF task on Earth. And 90% of the "free" tools online want to upload your (probably confidential) client documents to their server.

Merge PDF: drag to reorder, everything stays local

11. "I need a favicon set for a new project"

12 sizes, a manifest.webmanifest, and the HTML snippet. Every time.

  • Favicon Generator — drop one square image, get a ZIP with every size (16 / 32 / 180 / 192 / 512 / …), the manifest, and the exact <link> HTML to paste into <head>.
  • SVG Optimizer — run your logo through SVGO in your browser before you rasterize it.
  • PNG → ICO — the "just the .ico please" case.

12. "Cron expression */15 9-17 * * 1-5 — when does that fire next?"

Cron syntax reads like APL. And you always, always want to see the next 5 fire times before pushing.

  • Cron Parser — paste any expression, get plain English + the next N runs
  • Cron Generator — visual builder if you'd rather not type

Cron Parser: expression, English, next 5 runs

13. "Standup at 3pm JST. I'm in São Paulo. When?"

Distributed teams. DST edge cases silently ruin calendar invites twice a year.

14. "How much will this GPT-4o batch job actually cost me?"

Blind estimate = surprise invoice. Vendor pricing pages are painful to compare.

  • Token Counter — estimates for GPT-3.5/4/4o, Claude, Gemini
  • AI Cost Calculator — 20+ models, daily-refreshed pricing via a cron, side-by-side comparison, cache / batch / prompt-caching discounts factored in
  • Text Chunker — character / word / token-based splits for RAG, shows per-chunk token counts
  • Cosine Similarity — pair mode + N×N matrix; useful for debugging why your RAG returned the wrong chunk

AI Cost Calculator: same workload, wildly different bills

15. "How strong is my password, really?"

Not "it has an uppercase letter and a number" strong — actually strong. Under a real attacker's compute budget.

Password Strength Checker gives you:

  • Entropy in bits (the actual math, not a color bar)
  • Crack time under 4 attack models:
    • Online, throttled (login form with rate limits): 100 tries/sec
    • Online, unthrottled (broken rate limit): 10k tries/sec
    • Offline, GPU on a fast hash: 10 billion tries/sec
    • Offline, GPU on bcrypt: 10k tries/sec
  • Structural findings: dictionary words, keyboard sequences (qwerty, 1234), repeats, common patterns
  • Optional HIBP k-anonymity lookup — checks Have I Been Pwned without ever sending your password. Only the first 5 chars of a SHA-1 hash go over the wire.

Fun exercise: try Summer2024!, correct horse battery staple, and a 32-char random string. The gap between them is educational.

Password Strength:

Related for the "I need a secret NOW" case:

Bonus: everything is discussable

Every tool page has an in-page Comments button in its hero — expandable thread pinned to that tool. There's also a global Community Board across all tools.

No signup. Nickname auto-suggests from your rough geo (with your IP masked). Report / mod tools exist for spam.

Community Board — no signup, chat by tool

What's the catch?

Honestly, none. It's a static Next.js site on Vercel. Cost to run: less than one coffee a month. There's no VC, no upsell, no email capture. I built it for me and it turned out other devs wanted it too.

If you find it useful:

  • Bookmark devkits.vip — it's a fast keyboard target when you need "that one converter"
  • Star / follow if I ever ship a GitHub repo (thinking about it)
  • Subscribe to the RSS feed for new releases (we ship weekly)
  • Something missing? Ping me on the community board.

Tech stack (for the curious)

  • Next.js 15 App Router + React 19 + Tailwind 3
  • All crypto via the browser's built-in Web Crypto API — no crypto-js, no jose, no node-forge. Everything is native subtle.generateKey, subtle.sign, subtle.verify.
  • PDFs via pdf-lib (write) + pdfjs-dist (read), including a hack to make text extraction work correctly on CJK PDFs
  • Regex visualizer built from scratch (parsing the pattern into an AST, no external lib)
  • Diff algorithm custom — Myers diff for text, structural walk for JSON/YAML/XML
  • Zero server-side data processing. The comment board is the only thing that hits a DB (Neon Postgres, and it only ever stores comment content — never your tool inputs).
  • Vercel for hosting; a daily cron submits the sitemap to IndexNow so Bing / Yandex see new tools within a day

Questions I get

"Why not use crypto-js / jose / node-forge?"
Every one of those is 100-400 KB gzipped. The browser has all of it built in, at zero bundle cost, running native code. There's no reason to ship a library that reimplements what your runtime already does — unless you need something the platform genuinely lacks (like RFC 6979 deterministic ECDSA, which we don't).

"How do you make money?"
I don't, yet. It costs less than a coffee to run. If it ever becomes expensive I'll add non-tracking ads or open sponsorships. No auth wall, no premium tier. Ever. The whole point is that these tools should exist without a login form.

"Is the source open?"
Not right now. I'm considering it. The concern is duplicate content — GitHub repos with heavy READMEs sometimes outrank their own product sites, which would be a weird outcome. I might open just the tool implementations without the marketing pages.

"Can I self-host?"
Not currently, but it's a plain Next.js app with no backend beyond a Postgres comments table — nothing exotic. If enough people ask, I'll write a self-host guide.

If you got this far, a share means a lot. Which of these annoyances did you last hit? Drop it in the comments — I'll add tools for the ones I don't cover yet.

— Built and maintained by one person, publicly, in a browser. If you're building something similar, I'd love to see it.

Top comments (0)