DEV Community

chenghui wu
chenghui wu

Posted on

I built 162 dev tools that never upload your data. Here's what I learned

#security #tools #privacy #webdev

The problem with 90% of "online dev tools"

You paste a JWT into a random site to decode it. You paste JSON into another one to format it. You paste a private key into a third to extract the public half.

Every one of those pastes is a leak. Your token, your JSON, your key — they hit someone else's server, get logged, and sometimes get sold.

For sensitive stuff, most of us just skip online tools and open a REPL. But you don't want to python -c "import base64; ..." for the 40th time this week either.

I got tired of the tradeoff. So I built devkits.vip — a set of 162 developer tools, all running entirely in the browser. Nothing is uploaded. No crypto-js dependency. No jsrsasign. No node-forge. Just the browser's native Web Crypto API doing the heavy lifting.

The whole point: curl -sD - https://devkits.vip/tools/jwt-verifier > /dev/null followed by network-panel-verification shows zero outbound requests when you actually use it. Try it.

Homepage of devkits.vip showing hero and category grid

The numbers

Total tools 162
Categories 11
Interactive visualizers 4
Reference pages (MIME / HTTP / regex / ASCII / status codes …) ~495
Data uploaded during typical use 0 bytes
Uses of crypto-js / jsrsasign / node-forge in package.json 0
JWT algorithms supported 12 (HS/RS/PS/ES × 256/384/512)
PBKDF2 iterations for AES 200,000

That last point is the whole thesis: everything is done with the browser's own primitives. If your browser can't do it, we don't ship it.

Five things that ended up being interesting to build

1. A JWT tool that supports every algorithm in RFC 7518

Most "JWT decoder" sites just base64-decode and hand-wave the signature. We do the actual verification, for the entire RFC 7518 algorithm family:

  • HS256 / HS384 / HS512 — HMAC with a shared secret
  • RS256 / RS384 / RS512 — RSASSA-PKCS1-v1_5 with an RSA public key
  • PS256 / PS384 / PS512 — RSA-PSS (modern padding) with an RSA public key
  • ES256 / ES384 / ES512 — ECDSA with a P-256, P-384, or P-521 public key

Paste a JWT and a public key (PEM or JWK), and you get a real signature check. The tool also flags time claims (exp / nbf / iat) and explicitly rejects alg: "none" — that classic JWT vulnerability where an attacker strips the signature and hopes the verifier accepts it.

All twelve algorithms are wired straight into crypto.subtle.sign / crypto.subtle.verify. Zero JWT libraries in package.json.

JWT Verifier showing signature check + time claim status

2. RSA & ECDSA key generation, without a single crypto library

The whole asymmetric-keys.ts module is 150 lines. It generates a key pair via crypto.subtle.generateKey, exports the private key as PKCS#8, the public key as SPKI, and both as JWK — all through browser APIs.

Output formats I actually needed:

  • PEM (PKCS#8 for private, SPKI for public) — for OpenSSL, Node, Go, Java, Python cryptography
  • JWK — for JWT libraries, browser Web Crypto import, JWKS endpoints
  • DER — hex or base64, for low-level inspection

There's also a companion "Public Key Extractor": paste a private key, get the matching public key. Useful when you inherit a .pem file with no matching .pub, or when you're about to publish a JWKS endpoint and only have the signing key on hand.

RSA Key Generator showing private + public keys in PEM

3. Regex Visualizer — the tool I wish I had in college

Regex is dense. When someone shows me ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ I want to see it decomposed, not stare at a wall of characters.

The Regex Visualizer at /visualize/regex breaks any pattern into colored tokens with plain-English explanations, and shows live match highlighting against your test string. It's less "tool," more "textbook you can play with."

Regex Visualizer showing token breakdown + live match

4. A fake-data generator that ships as ~5KB of word lists

Every dev needs 10 fake users as CSV at some point. The usual workflow is npm install faker, write a script, run it, delete. That's fine — but if you've already got a browser tab open, an online generator wins.

The problem: most online generators are backend calls (privacy leak) or bundle faker.js (~500KB gzipped).

I inlined ~50 items per category as plain string arrays. Total: about 5KB. That's enough entropy to look real for 100 rows of users. Combined with a seeded PRNG (mulberry32), you get reproducible output — same seed = same rows, byte for byte.

25+ field types, 5 output formats:

  • JSON array
  • JSONL / JSON Lines
  • CSV (proper quoting for commas & newlines)
  • SQL INSERT statements with configurable table name
  • TypeScript type Row = { ... } + a typed array literal

Fake Data Generator with SQL INSERT output

5. Password strength check that never uploads the password

Every "how strong is my password" site is a security joke: you paste your actual password into their form. Even if they don't log it, they could.

We do the entropy math locally — character-class analysis, keyboard-sequence detection, repeated-pattern detection, dictionary check — and estimate crack time under four realistic attack scenarios:

  • Online, throttled (10 tries/sec)
  • Online, no throttling (100 tries/sec)
  • Offline fast hash — GPU cluster on SHA-1 (10 billion tries/sec)
  • Offline slow hash — bcrypt cost 10 (10k tries/sec)

There's also an optional breach check against Have I Been Pwned, using their k-anonymity API. Only the first 5 hex characters of the SHA-1 hash are sent (matches ~450 hashes on average). Your actual password never touches the network, even for the breach lookup.

Password Strength Checker showing crack-time table

The rest of the toolkit (in ~10 seconds)

Rather than list all 162, here's the vibe per category:

  • JSON (12) — formatter, diff, repair (fixes LLM output — trailing commas, unquoted keys, python-style True/False), JSONPath tester, schema generator (Draft 2020-12 + OpenAI function-calling + Anthropic tool_use schemas), to-TS / to-Go / to-Rust / to-Python / to-C# / to-PHP / to-Java, flatten, minifier, escape, validator, sort, XML↔JSON, YAML↔JSON, CSV↔JSON
  • Encoding (9) — base64 / base32 / base58 (Bitcoin + Solana + IPFS CID v0) / URL / HTML / hex / punycode / rot13 / unicode escape
  • Security (20) — everything above + AES (GCM/CBC, 128/192/256, PBKDF2 200k iterations, self-describing ciphertext), bcrypt, HMAC, hash generator (MD5/SHA-1/SHA-256/SHA-512 with streaming for multi-GB files), JWKS generator (RFC 7517, auto SHA-256 thumbprint kid per RFC 7638)
  • AI & LLM (4) — cost calculator (live pricing for GPT / Claude / Gemini / DeepSeek — refreshed daily by cron), token counter, RAG text chunker (recursive / paragraph / sentence / fixed strategies), cosine similarity (pair mode + N×N matrix)
  • Converters (21) — cURL to Python/Node/Go/PHP/Java, number bases (BigInt-backed), unit converters (data size, bandwidth, Bitcoin, Ethereum, dates)
  • Web (17) — CIDR calculator, CSS visual generators (Grid, Flexbox, Box Shadow, Border Radius, cubic-bezier, text-shadow, glassmorphism, gradient), regex tester + replace, user-agent parser, meta tag preview (Google + Facebook + Twitter + LinkedIn cards), QR generator + reader
  • PDF (10) — extract text (with CJK support — proper cmaps + geometric reading order, not pdf.js's hasEOL guesswork), merge, split, remove pages, rotate, password remover, metadata viewer, images↔PDF
  • Image (19) — compressor (with target-KB binary-search mode — kills the "just under 2MB please" pain), EXIF viewer + lossless remover, format converters, resizer, cropper, favicon generator (one image → full ZIP with .ico + PNGs + apple-touch + manifest + HTML snippet), SVG optimizer (full SVGO in browser), image diff (pixelmatch)
  • Text (28) — diff (with syntax highlighting for 14 languages, zero external highlight libs — I wrote a 150-line tokenizer), case converter, sort, dedup, word/char/line counter, markdown-to-HTML with the works
  • Generators (14) — password, UUID v4 + v7, NanoID, ULID, KSUID, CUID2, Snowflake ID, fake data, lorem, random number / string / picker / shuffler
  • Time & Date (8) — timestamp converter, timezone converter with DST, cron generator + parser, age calculator, date diff, working days with holiday support, ISO 8601 duration

AI Cost Calculator comparing GPT / Claude / Gemini

CSS Grid Generator showing preview + CSS + Tailwind output

The 495 reference pages nobody asked for (but Google loves)

Some of my favorite dev-time browser habits:

  • "quick, what's the MIME type for .mjs?"
  • "what does HTTP Strict-Transport-Security actually do?"
  • "give me a regex that matches an ISO 8601 date"

The answer to each is curl or Wikipedia away, but that's 3 tabs and 20 seconds. I inlined all of it as static pages, one URL per entity:

  • 51 MIME type pages at /mime-types/*
  • 46 HTTP status code pages at /tools/http-status-codes/*
  • 48 HTTP header pages at /http-headers/*
  • 30 regex cookbook patterns at /regex-cookbook/* — each with runnable JS, Python, Go, and Java snippets
  • 256 ASCII/Latin-1 character pages at /ascii/* — every character 0–255 gets its own page with hex, binary, HTML entity, URL encoding, and UTF-8 bytes
  • 22 seasonal "days until X" pages at /tools/days-until/*

They're all static-rendered at build time by Next.js and served from the edge. This started as an SEO experiment but it also became my personal quick-reference — I use /http-headers/strict-transport-security more than the MDN version because it's faster.

MIME types reference hub

The tech stack

Deliberately boring. Nothing to justify.

  • Next.js 15.1.6 on the App Router
  • React 19
  • TypeScript 5.7 in strict mode
  • Tailwind CSS 3.4
  • Deployed on Vercel (SSG + edge CDN + analytics + speed insights)
  • Neon Postgres — used only for the comment board (/messages), because that one thing does need persistence. Every other tool is 100% client-side.
  • Web Crypto API for all crypto — JWT signing, AES, RSA, ECDSA, HMAC, hashing, PBKDF2. No crypto-js, no jsrsasign, no node-forge. Not a single crypto package in package.json.
  • pdf-lib + pdfjs-dist for PDF read/write
  • Canvas API + exifr + piexifjs + pixelmatch + svgo + jsqr + qrcode for imaging

Static-rendered pages share ~103 KB of JS. Every tool page loads its heavy deps (svgo, pdf-lib, pdfjs, jszip, exifr, pixelmatch) via await import() inside the operation handler, not at module top — so opening the JSON formatter doesn't pull down PDF rendering code.

How it grew: 16 releases in a few weeks

The project is open in the sense that every release is public and documented. There's a Changelog with 16 releases so far, and an RSS feed if you want the drip.

Recent shipments:

  • Image toolkit — 19 privacy-first image tools in one drop
  • PDF toolkit — 8 tools with CJK support, geometric reading order (not pdf.js's line-based guessing)
  • Security wave — RSA + ECDSA key generators, encrypt/decrypt, sign/verify, JWKS, public-key extractor, JWT verifier — all Web Crypto, no libraries
  • AI toolkit — cost calculator with live pricing, token counter, RAG chunker, cosine similarity
  • CSS layout wave — Flexbox + Grid + Box Shadow + Border Radius + cubic-bezier + text-shadow + glassmorphism generators, all with Tailwind output

Changelog with recent releases

Try it

I'd genuinely love to know what your paste-into-random-site-anyway workflow is — that's the next tool I want to build.

If you want to hear about new tools, subscribe to the changelog RSS: https://devkits.vip/changelog/feed.xml.

Cover image is auto-generated by the site's /api/og endpoint. All screenshots in this post are real screenshots of the live site — no mockups.

Top comments (0)