Collabier

Posted on Aug 16

Why I stopped pasting production JWTs into random websites (and built an offline tool suite instead)

#webdev #javascript #programming #opensource

Be honest: how many times this week have you pasted a bearer token, a customer payload, or an .env config snippet into an online formatter just to quickly see what went wrong?

I used to do it constantly.

Need to debug an expired JWT? Open the first Google result.

Need to format a 4MB JSON response from a legacy API? Paste it into a random tab covered in popup ads.

Need to merge two PDF invoices or test a RegEx? Another sketchy tab.

A few months ago, while debugging an auth issue on a client’s staging database, I caught myself about to paste an unhashed token payload into a random web tool. I paused and looked at the network tab on that site.

Sure enough: every keystroke was being sent as a POST request to an external analytics backend.

That was the breaking point.

The Problem with Modern "Free" Dev Tools

Most utility websites on the first page of Google share the same annoying traits:

Your data leaves your machine: Many tools send your raw strings, files, or tokens to a remote server for processing.
Aggressive ads & layout shift: Five sticky video banners jumping around while you are trying to read a diff.
Slow load times: Heavy server-rendered overhead for a task that modern JavaScript can do locally in under 5 milliseconds.

Modern browsers have WebAssembly, the Web Crypto Subtle API, Web Workers, and Canvas APIs. There is zero technical reason why formatting a JSON string, calculating a CIDR subnet, or splitting a PDF should ever hit a backend server.

So over the past few weeks, I decided to build a clean, unified alternative: Omnikite.

What I Built (80 Tools, 0 Server Uploads)

I wanted a single, ad-light workspace that runs 100% inside your browser memory. If you disconnect your Wi-Fi, the entire suite still works.

Here are a few tools I ended up building into it:

1. Zero-Leak Cryptography & Security

Shamir's Secret Sharing: Split master recovery keys or secrets into $N$ mathematical polynomial shares with a threshold $K$ directly in memory.
Content Security Policy (CSP) Level 3 Builder: Generates strict nonce/hash CSP headers with instant export for Nginx, Apache, and Next.js.
Shannon Entropy & Password Strength: Calculates true bit-entropy ($H = -\sum p \log_2 p$) and estimates offline GPU brute-force cracking times.

2. Everyday Developer Staples

JSON Formatter & Schema Validator: Handles multi-megabyte payloads without crashing the tab, with tree search and JSON-to-TypeScript type generation.
Interactive JWT Debugger: Inspects claims, verifies HMAC signatures using local WebCrypto, and checks expiration timestamps with zero external requests.
IPv4 CIDR & Subnet Calculator: Bitwise octet visualizer with auto-generated Linux ufw and iptables firewall rules.

3. File & Media Processing

In-Browser PDF Merger & Splitter: Uses client-side WebAssembly to re-order, extract, and combine PDF pages without uploading documents to remote cloud buckets.
Client-Side Image Converter & SVG Minifier: Lossless compression and format conversions (WebP, PNG, JPEG, AVIF) using the HTML5 Canvas API.

How it works under the hood

The tech stack is deliberately simple:

Next.js 16 (App Router) with Static Site Generation (SSG) for instant page loads.
Web Crypto Subtle API for cryptographic hashing (SHA-256, HMAC, PBKDF2).
React 19 & Tailwind CSS v4 with a dark/light mode engine that doesn't cause hydration flash.
useSyncExternalStore for persistent local favorites and recents without layout jank.

Here is a quick example of how simple it is to do native client-side SHA-256 in the browser without any third-party npm crypto libraries:

async function computeSha256(message: string): Promise<string> {
  const msgUint8 = new TextEncoder().encode(message);
  const hashBuffer = await crypto.subtle.digest("SHA-256", msgUint8);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
}

Try it out & feedback welcome!

I opened up the full directory of tools here:
👉 https://omnikite.vercel.app

The entire platform is free, doesn't require any login or API key, and will never send your inputs over the wire.

If you are a developer, security engineer, or someone who just hates bloated utility sites, take it for a spin. I would love to hear your thoughts, feature requests, or any edge-case utilities you think I should add next!

What is the one utility tool you find yourself searching for every single week? Let me know in the comments below!

DEV Community