DEV Community: Goksel Yesiller

CSP Builder: a small tool that solves a specific problem

Goksel Yesiller — Sat, 11 Jul 2026 10:00:13 +0000

You’re deploying a new feature and need to lock down your site against cross-site scripting, but the Content Security Policy spec reads like ciphertext. A stray semicolon or a missing quote can silently break legitimate resources or leave a gaping hole an attacker will find in minutes. CSP Builder turns that friction into a fast visual configuration—no memorizing directive syntax, no guesswork, just a clean policy string ready for production.

What it is

CSP Builder is a visual Content Security Policy generator, part of the DevTools collection of 200+ free browser utilities. Content Security Policy (CSP) is a critical web security standard that prevents XSS and code injection by telling the browser exactly which content sources to trust. Instead of writing raw policy strings, you compose directives through a form-based interface that enforces the correct syntax and catches common missteps as you go.

The tool treats each CSP directive—default-src, script-src, style-src, img-src, and more—as an independent row. For every directive, you pick sources from a curated list or type custom URLs. The output is a syntactically valid Content-Security-Policy header that you can drop into your web server configuration or application middleware without further massaging.

Because it lives entirely in the browser, the tool never sends your policy drafts anywhere; it’s a privacy-first utility that requires no signup.

How to use it

The interface is built around a clear mapping of directives to resource types. Each row represents a directive: start with default-src to set a baseline for all resource types, then override specific directives as needed. For each directive, quick-add buttons let you insert common source values like 'self' (same origin), 'none' (block everything), 'unsafe-inline' (allow inline scripts/styles), 'unsafe-eval' (allow dynamic code evaluation), and data: or https: schemes.

To add an external CDN, type the origin into the source field—for example https://cdn.example.com. You can stack multiple sources in a single directive; CSP Builder will join them with proper spacing. A live policy preview updates in real time so you always see the exact header string you’ll deploy.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:

A toggle above the directives switches the policy mode between enforcement and report-only. Report-only (Content-Security-Policy-Report-Only) logs violations to the browser console without blocking anything, which makes it the safest way to test a policy on a live site before you harden it. Once the violation reports show only expected activity, flip the toggle and deploy the enforced version.

As part of the DevTools suite, you can reach CSP Builder instantly without leaving your browser. There’s no installation, no account, and nothing to export your policy drafts outside your machine.

When to reach for it

CSP Builder excels when you need to create or tighten a Content Security Policy but don’t work with the spec frequently enough to write error-free headers from memory. Even seasoned developers waste time hunting down a forgotten 'unsafe-inline' that blocks their own UI. The tool removes that class of error by structuring the policy and validating source values as you type.

It’s especially useful during security reviews or when retrofitting CSP onto an existing application. Instead of chasing down every single resource the frontend loads, you can start with a strict default-src 'self' and incrementally add exceptions while observing the console in report-only mode. The visual layout makes it obvious when you’ve granted overly broad permissions—like allowing https: for scripts instead of a specific domain—which helps you maintain a minimal, maintainable policy.

Teams with developers who lack deep security expertise benefit from the tool’s guardrails. It acts as a pair-programmer who knows the RFCs, letting junior or full-stack engineers ship a base CSP that isn’t trivially bypassed. You still own the policy decisions, but the tool ensures the syntax survives a linting pass.

Try it yourself

Start with a restrictive baseline: set default-src to 'self' and block everything else until you know what’s needed. Open your application in a browser and watch the DevTools console for CSP violation reports. Each blocked resource is a clue; add the corresponding source—a CDN domain, a font provider, a WebSocket endpoint—to the appropriate

Try it: CSP Builder on DevTools

Unix Pipe Builder: a small tool that solves a specific problem

Goksel Yesiller — Wed, 24 Jun 2026 13:34:45 +0000

Building complex command-line pipelines often devolves into a cascade of syntax errors and unexpected outputs, even for experienced developers. The cognitive load of remembering flag combinations and debugging intermediate results can turn a straightforward log analysis into a frustrating exercise. The Unix Pipe Builder from DevTools addresses this friction directly, offering a visual workspace that transforms how you construct and reason about data processing chains.

What it is

The Unix Pipe Builder is a visual pipeline constructor that eliminates the guesswork from chaining Unix commands. Instead of typing, backspacing, and retyping in a terminal, you assemble pipelines by connecting commands in a graphical interface, with the final command string generated automatically. The tool understands standard utilities—grep, awk, sort, uniq, cut, and others—and lets you configure their options through form fields rather than memorizing flags.

It ships with a library of presets for frequent data-wrangling tasks, such as counting errors in log files, extracting unique IP addresses, or identifying the largest files in a directory. These presets serve both as ready-to-run recipes and as learning aids that demonstrate how commands flow together. Because the tool is part of the DevTools collection—over 200 free browser utilities that require no signup and run entirely client-side—your data never leaves your machine and you’re never prompted for an account.

How to use it

The pipeline builder occupies the central canvas. You can begin by selecting a preset from the dropdown or start with an empty pipeline. Presets like “Count errors in log” or “Top 5 URLs by count” instantly populate the builder with a sequence of commands configured for that scenario, giving you a working pipeline you can adjust.

To create a pipeline from scratch, click “Add Command” and choose from the available Unix tools. For each command, you set its options via dropdowns and input fields. When adding a grep step, for example, you can specify the pattern, toggle case-insensitivity, and choose between fixed strings or regular expressions—without typing any flags. The interface shows each command as a block in a flowing sequence, with arrows indicating how data passes from one step to the next.

As you modify the pipeline, the equivalent command string updates in real time below the builder. A typical construction might look like:

cat access.log | grep "ERROR" | cut -d' ' -f1 | sort | uniq -c | sort -nr | head -5

You can copy this line directly into your terminal. The visual layout also makes it easy to reorder steps, remove commands, or insert new ones without fear of breaking syntax. You stay focused on the logic of the transformation, not on escaping quotes or recalling the difference between sort -n and sort -nr.

When to reach for it

Reach for the Unix Pipe Builder whenever you face log analysis, file processing, or ad-hoc data exploration tasks but either lack fluency in pipeline syntax or want to prototype faster than typing allows. It’s invaluable for developers who work with the command line only occasionally—perhaps during deployment debugging or incident response—and find themselves repeatedly searching for flag details.

Operations teams benefit from the presets in particular. Monitoring scenarios often demand quick pattern extraction from production logs, and the builder speeds up constructing a reliable pipeline without the overhead of maintaining a personal shell-script library. The tool also shines as a teaching instrument. By seeing commands physically connected, newcomers to the Unix philosophy internalize the composability of simple tools, building intuition they’ll carry back to the terminal.

When the task involves sensitive data, the zero-server-upload design of DevTools ensures your pipeline configurations and sample data remain local. You can experiment with real log snippets without worrying about external exposure.

Try it yourself

Visit the Unix Pipe Builder and open the “Count errors in log” preset. Observe how the pipeline connects cat → grep → cut → sort → uniq → sort → head, and note the options selected for each step. This concrete example reveals how these commands collaborate to aggregate and rank error occurrences.

Next, replicate a task you do manually. If you often hunt for files over a certain size, build a pipeline that uses find, xargs, ls, and sort to surface the largest candidates. Tweak parameters and reorder steps to see how the data flow changes. Copy the generated command and test it with sample data in a safe directory. Once you’re comfortable, integrate the produced commands into scripts or monitoring routines—the builder accelerates prototyping, but the final command is pure, runnable Unix that works anywhere.

Related tools

Chmod Calculator helps you calculate Linux file permissions when manipulating files within your pipelines. Cron Expression Builder lets you schedule generated commands to run automatically. Environment Variable Encoder/Decoder handles encoded values when your pipelines interact with environment variables.

Try it: Unix Pipe Builder on DevTools

SQL Formatter: a data tool that earns its tab

Goksel Yesiller — Mon, 22 Jun 2026 18:41:52 +0000

Developers inheriting sprawling SQL codebases or revisiting queries from weeks earlier know the frustration: a dense, unformatted block that obscures joins, filters, and logical flow. Readable SQL isn’t cosmetic — it directly affects debugging speed, peer review accuracy, and long-term maintainability.

What it is

SQL Formatter restructures raw SQL into clear, conventionally formatted code, running entirely in the browser. It applies consistent indentation, capitalisation of keywords, and logical line breaks — all without altering the query’s semantics. The formatter understands the syntax of all major database engines, including PostgreSQL, MySQL, SQL Server, and Oracle, so it preserves dialect-specific functions and operators rather than flattening them into a generic style.

The tool is one of 200+ free browser utilities on DevTools. It processes all input entirely on your machine — no data ever leaves the browser, no account is required, and no analytics track your usage. That privacy-first design means you can safely format queries that contain proprietary business logic embedded in production SQL.

The engine handles the full spectrum of SQL complexity: basic SELECT statements, multi-table joins, Common Table Expressions (CTEs), correlated subqueries, window functions, and DML operations like INSERT or UPDATE. Because it parses the input rather than applying regular expressions, deeply nested constructs retain their hierarchy, with each subquery or CTE level indented to show ownership.

How to use it

Paste any SQL fragment into the left-hand editor and the formatted result appears instantly in the output panel. A live preview updates as you switch formatting options, so you can tune the output without re-pasting.

The primary configuration controls help you match your team’s conventions or personal preference:

Dialect: selecting a specific database ensures that functions such as PostgreSQL’s STRING_AGG or MySQL’s GROUP_CONCAT are not inadvertently mangled, and that quoting rules (backticks vs. double quotes) follow the platform’s norms.
Indent width: choose from 2 to 8 spaces; the default aligns with most SQL style guides.
Keyword case: switch between uppercase and lowercase for reserved words like SELECT, FROM, and WHERE.

Templates for common query patterns speed exploration: load a skeleton for a basic SELECT with a WHERE clause, a multi-table join with aggregation, a CTE, or a subquery-heavy statement, then modify it. The formatter re-indents your changes on the fly.

For long, deeply nested queries the tool preserves the logical hierarchy. Consider the transformation of a real-world example:

-- Before formatting
select u.id,u.name,count(o.id) as order_count from users u left join orders o on u.id=o.user_id where u.active=1 group by u.id,u.name having count(o.id)>5 order by order_count desc;

-- After formatting
SELECT
    u.id,
    u.name,
    COUNT(o.id) AS order_count
FROM users u
LEFT JOIN orders o ON u.id = o.user_id
WHERE u.active = 1
GROUP BY u.id, u.name
HAVING COUNT(o.id) > 5
ORDER BY order_count DESC;

Every column, JOIN condition, and GROUP BY field is laid out on its own line, making it trivial to spot which column is filtered, aggregated, or joined — even at a glance during a code review.

When to reach for it

Code reviews benefit immediately. When teams adopt a uniform formatting style, reviewers stop mentally parsing inconsistent indentation and focus on the logic: are the join conditions correct? Does the WHERE clause inadvertently filter rows that should remain? Consistently formatted code makes such questions visible.

Database migration scripts — often dozens of SQL files evolving over years — need predictable structure to survive in version control. Formatting before committing ensures that git diff shows only intentional changes rather than noise from whitespace and keyword casing. Later, when someone revisits a year-old migration to modify an index or add a column, the query’s intent is still immediately clear.

Teams that maintain applications across multiple database platforms benefit from the dialect-aware formatting. A query originally written for MySQL can be reformatted using the PostgreSQL dialect before being ported, highlighting syntax differences that might otherwise cause hard-to-debug runtime errors.

Inheriting a legacy codebase with inconsistent SQL style is another typical trigger. Instead of manually retouching hundreds of statements, you can batch-process them through the formatter — a step that establishes a consistent foundation before you start refactoring logic.

Finally, performance tuning sessions rely on quick comprehension of query structure. Execution plans describe operators in terms of scans, seeks, and joins, and mapping those back to a well-formatted query lets you correlate a costly nested-loop join with the exact JOIN clause that needs an index.

Try it yourself

The tool is available at SQL Formatter. It runs entirely in the browser and takes about 30 seconds to try on a real workflow: paste a tangled query from your active project, adjust the dialect and indentation to your preference, and inspect the output. Because all processing stays local, even queries containing proprietary business logic never leave your laptop.

Related tools

A few seconds of formatting today can save hours of debugging tomorrow.

Try it: SQL Formatter on DevTools

Choosing the Right Model for Each Task in a Multi-Module AI Agent (Hermes Architecture)

Goksel Yesiller — Mon, 22 Jun 2026 18:15:12 +0000

AI agents are no longer built around a single monolithic model. The smarter approach — especially for feature-rich agents like Hermes — is task-based model orchestration: routing each job to the model best suited for it. This improves both output quality and cost efficiency at the same time.

In this guide, we map the full 2026 competitive landscape — Anthropic, OpenAI, Google, DeepSeek, Moonshot (Kimi), MiniMax, Alibaba (Qwen), and Xiaomi (MiMo) — to specific agent modules. The frame isn't geography. It's capability tier: what does this task actually need, and what's the cheapest model that can reliably deliver it?

Why Task-Based Model Selection Matters

Not all models are created equal. Some excel at sustained autonomous execution over hours, others at ultra-long context, others at fast low-cost classification. Treating every task as if it deserves your most powerful model is a common mistake that compounds into real waste at scale.

The "one model fits all" approach causes:

Unnecessary cost — frontier models on tasks a balanced model handles fine
Added latency — large models are slower, even when a lighter one would suffice
Missed quality — some tasks genuinely need a specialist the default choice can't match

The right question for every module in your agent: what capability tier does this task actually need?

The Full Model Landscape by Tier

Frontier Tier

These are the models you reach for when reliability and sustained autonomous execution are non-negotiable. The gaps between them on most benchmarks are narrow enough that cost, data residency, and specific task fit often matter more than raw rank.

Claude Opus 4.8 (Anthropic, May 2026) is the leading model for long-horizon agentic work. It scores 69.2% on SWE-Bench Pro, is the only model to complete every case on the Super-Agent benchmark (beating GPT-5.5 at cost parity), and leads on Online-Mind2Web browser tasks at 84%. Its Dynamic Workflows feature fans out across hundreds of parallel subagents in a single session. Four times less likely than Opus 4.7 to let code flaws pass without flagging them — which matters enormously for unattended agent runs. $5 input / $25 output per million tokens.

GPT-5.5 (OpenAI, April 2026) is OpenAI's strongest agentic coding model, leading Terminal-Bench 2.0 at 82.7%. Optimized specifically for multi-step workflows: plan, use tools, check work, navigate ambiguity, and keep going. Works well as both orchestrator and subagent in multi-agent systems. Priced around $8 input / $32 output per million tokens.

Gemini 3.5 Flash (Google, May 2026) broke the traditional Pro/Flash quality hierarchy: it outperforms Gemini 3.1 Pro on agentic and coding benchmarks while running 4x faster. Scores 83.6% on MCP Atlas (best in class for agentic tool use), 76.2% on Terminal-Bench 2.1, and leads Finance Agent v2 at 57.9%. Natively multimodal: text, image, video, audio, PDF input. Its "thinking levels" (minimal to high) allow fine-grained cost/quality trade-offs in a single model. $1.50 input / $9 output per million tokens.

Gemini 3.1 Pro (Google, February 2026) remains the strongest Gemini model for pure reasoning depth — 77.1% on ARC-AGI-2, 94.3% on GPQA Diamond. 1M token context, 64K output. Best when the task requires multi-step reasoning with ambiguous intermediate states or conflicting information that a faster model handles poorly. $2 input / $12 output per million tokens (≤200K context).

Kimi K2.6 (Moonshot AI, April 2026) leads SWE-Bench Pro at 58.6%, ahead of GPT-5.4 and Claude Opus 4.6. Agent Swarm mode supports 300 parallel sub-agents across 4,000 coordinated steps — purpose-built for Hermes-compatible multi-agent orchestration. Hallucination rate dropped from 65% (K2.5) to 39% (K2.6), a meaningful production-readiness improvement. $0.60 input per million tokens. API routes through Chinese servers; self-host for regulated workloads.

DeepSeek-V4-Pro (DeepSeek, April 2026) has 1.6T total parameters, a default 1M-token context window, and three reasoning modes. Matches Claude Opus 4.6 and GPT-5.4 on most benchmarks. The most cost-efficient frontier option at $0.145 input / $3.48 output per million tokens. Same data residency caveat as all Chinese API endpoints.

Balanced Tier

Claude Sonnet 4.6 (Anthropic) — The reliable daily driver. Strong instruction following, natural summarization, and structured writing. The default choice when you need quality without frontier prices.

Gemini 3 Flash (Google) — Frontier-class at Flash cost. Achieves 78% on SWE-Bench Verified, outperforming Gemini 2.5 Pro. 3x faster than competitors at the same tier, per Artificial Analysis. $0.50 input / $3 output per million tokens. Strong multimodal support. The go-to balanced option for Google ecosystem builders.

Qwen3.5-397B-A17B (Alibaba, February 2026) — 397B total, 17B active (Gated DeltaNet + MoE hybrid architecture). Leads on instruction following: 76.5 on IFBench, beating GPT-5.2 and far ahead of Claude on that benchmark. 201 language support. 256K native context, extendable to 1M. Delivered responses 6x faster than Claude Sonnet 4.6 in benchmarks while maintaining competitive quality. Apache 2.0, fully open-weight, runs on consumer hardware. Ideal for instruction-following, multilingual, and high-throughput summarization workloads.

Qwen3-Coder 480B-A35B (Alibaba, July 2025) — Dedicated coding specialist, 70% code-focused training on 7.5T tokens, 480B total / 35B active, 256K context. The strongest purpose-built open-source coding model available for self-hosting.

MiniMax-M2.5 (MiniMax, February 2026) — 80.2% on SWE-Bench Verified, 76.3% on BrowseComp. Handles Word, Excel, and PowerPoint file operations natively. 241 tokens/second — fastest in the MiniMax lineup. $0.15 input / $0.90 output per million tokens.

MiniMax-M1 (MiniMax, June 2025) — The native long-context specialist. 1M-token context, consumes only 25% of the compute DeepSeek R1 needs at 100K token generation. When the binding constraint is context length — whole codebases, multi-document corpora, massive logs — M1 is the purpose-built choice.

DeepSeek-V3.1 (DeepSeek) — Hybrid thinking/non-thinking generalist, 671B parameters (37B active), 128K context. Strong tool calling and agentic workflows at Chinese lab pricing.

MiMo-V2.5-Pro (Xiaomi, April 2026) — 1.02T total, 42B active, 1M context, MIT licensed. Ranked #1 open-source model for agentic capabilities by Artificial Analysis. Demonstrated 4.3-hour unassisted compiler build and 11-hour video editor creation with no human in the loop. $1 input per million tokens. Designed for long-horizon software engineering workloads.

Lightweight Tier

Claude Haiku 4.5 (Anthropic) — Fast, cheap, reliable for routing, classification, and short-form generation. The proven default for the router layer.

Gemini 3.1 Flash-Lite (Google) — 363 tokens/second output (45% faster than its predecessor), $0.25 input / $1.50 output per million tokens. Leads on latency-sensitive UI, intent classification, and high-volume summarization where time-to-first-token matters.

DeepSeek-V4-Flash (DeepSeek) — $0.14 input / $0.28 output per million tokens. The cheapest adequate lightweight option available. At this price, the cost argument for any other model at this tier is hard to make.

MiMo-V2-Flash (Xiaomi, December 2025) — 309B total, 15B active, 150 tokens/second, 256K context. $0.10 input / $0.30 output per million tokens. Strong reasoning at lightweight cost; scored 73.4% on SWE-Bench Verified. By April 2026, processing roughly 21% of all OpenRouter traffic.

Qwen3.5-9B (Alibaba) — TAU2-Bench agent score of 79.1, BFCL-V4 function calling at 66.1. Runs on 8GB VRAM. The strongest local-deployment routing model, and a serious option for privacy-sensitive or air-gapped environments.

Module-to-Model Mapping for a Hermes Agent

Module	Frontier Options	Balanced Options	Lightweight Options	Notes
Web page summarization	Gemini 3.1 Pro	Claude Sonnet 4.6, Gemini 3 Flash, Qwen3.5	DeepSeek-V4-Flash, MiMo-V2-Flash	Cost/quality depends on page complexity and volume
Vision / image analysis	Claude Opus 4.8, Gemini 3.5 Flash	Kimi K2.6 (MoonViT-3D), MiniMax-M3	Qwen3.5 (early fusion vision)	Gemini 3.5 Flash leads Finance Agent v2; Opus 4.8 leads browser tasks
Context compression (50K+ tokens)	DeepSeek-V4-Pro	MiniMax-M1, MiMo-V2.5-Pro	—	MiniMax-M1 uses 75% fewer FLOPs than DeepSeek R1 at 100K tokens
Skill search / routing	—	—	Claude Haiku 4.5, DeepSeek-V4-Flash, Gemini 3.1 Flash-Lite, Qwen3.5-9B	Keep the router cheap. It just needs to be fast and consistent
Kanban / task decomposition	Kimi K2.5, Claude Opus 4.8	Claude Sonnet 4.6, Gemini 3 Flash, DeepSeek-V3.1	—	K2.5 if decomposition feeds directly into Agent Swarm execution
Title generation	—	—	DeepSeek-V4-Flash, MiMo-V2-Flash, Gemini 3.1 Flash-Lite	Any lightweight works; pick by cost
Agentic coding / long-horizon tasks	Claude Opus 4.8, GPT-5.5, Gemini 3.5 Flash	Kimi K2.6, MiMo-V2.5-Pro, Qwen3-Coder 480B	—	Opus 4.8 for reliability; GPT-5.5 for terminal tasks; Gemini 3.5 Flash for speed+cost
Math / formal reasoning	DeepSeek-R1-0528, DeepSeek-V4-Pro, GPT-5.5	Qwen3.5, Gemini 3.1 Pro	—	DeepSeek leads on price-performance for STEM; Qwen3.5 strong on math too
Multi-agent orchestration	Claude Opus 4.8 (Dynamic Workflows), GPT-5.5 (Agents SDK), Kimi K2.6 (Agent Swarm), Gemini 3.5 Flash	MiMo-V2.5-Pro	—	Architecture matters as much as model choice here (see below)
Multilingual / global audience	—	Qwen3.5 (201 languages), Gemini 3.1 Pro	—	Qwen3.5 is the strongest open-weight multilingual model
Office file tasks (Word, Excel, PPT)	—	MiniMax-M2.5	—	Native file operation support, no extra tooling needed

A Closer Look: Multi-Agent Orchestration

All four frontier options take meaningfully different architectural approaches:

Claude Opus 4.8 + Dynamic Workflows — Plan-execute-verify cycle with hundreds of parallel subagents per session. Best for structured, supervised workflows where the orchestrator checks results before reporting back. The honesty improvements make it less likely to report false progress in unattended runs.

GPT-5.5 + OpenAI Agents SDK — Supervisor/handoff pattern with clear specialist boundaries. Leads on Terminal-Bench 2.0 (82.7%), making it the strongest choice for command-line-heavy pipelines.

Kimi K2.6 + Agent Swarm — 300 domain-specialized sub-agents, 4,000 coordinated steps, trained with PARL (Parallel Agent Reinforcement Learning). Best for research synthesis, large-scale code migrations, and document generation where the output is a finished artifact assembled from many parallel threads. Explicitly compatible with the Hermes Agent framework.

Gemini 3.5 Flash — Optimized for parallel agentic execution loops, leads MCP Atlas (83.6%). Best when latency per step matters — in agentic loops with 10–20+ tool calls, its speed advantage compounds significantly.

Deep Dive: Web Page Summarization

High quality, nuanced content: Claude Sonnet 4.6 or Gemini 3.1 Pro. Both handle ambiguous or poorly structured pages gracefully.

Speed and cost at scale: DeepSeek-V4-Flash ($0.14/M) or MiMo-V2-Flash ($0.10/M) for high-volume pipelines. Qwen3.5 is compelling if instruction-following precision matters at that volume.

Very long pages (50K+ tokens): MiniMax-M1 — its efficiency advantage at long sequences is the largest of any model in this tier.

Multilingual content: Qwen3.5 covers 201 languages natively. Gemini models are also strong on multilingual.

Finance or structured data pages: Gemini 3.5 Flash leads Finance Agent v2 (57.9%). Worth routing financial content there specifically.

Implementation Considerations

1. Tier the routing, not just the models. A "summarization" task might be lightweight (a 500-word news article) or balanced (a 30-page technical PDF). Classify first, then route.

2. Keep the router cheap. The routing decision itself should cost almost nothing. DeepSeek-V4-Flash, MiMo-V2-Flash, or Qwen3.5-9B at the router layer. Fast and consistent is the only requirement.

3. Handle data residency from day one. DeepSeek, Kimi, MiniMax, MiMo, and Qwen managed APIs route through Chinese infrastructure. For regulated workloads (HIPAA, GDPR, SOC 2), these models are available as open weights under MIT or Apache 2.0. Self-hosting solves the residency problem but adds operational overhead. Gemini runs through Google Cloud with EU region options. Claude and GPT have established enterprise compliance postures.

4. Don't ignore local deployment options. Qwen3.5-9B runs on 8GB VRAM. Qwen3.6-27B runs on 24GB. For air-gapped, edge, or privacy-critical use cases, the Qwen family is the strongest locally-deployable option across the tier spectrum.

5. Log model selection decisions. If quality drops or costs spike, you need to trace which routing choice caused it. Model selection should be as observable as any other system event.

6. Re-evaluate quarterly. The release cadence from every lab covered here is fast. Treat routing config as a living document.

Cost Reference

Model	Tier	Input $/1M	Output $/1M	Standout Strength
Claude Opus 4.8	Frontier	$5.00	$25.00	Agentic reliability, unattended runs
GPT-5.5	Frontier	~$8.00	~$32.00	Terminal tasks, agentic coding
Gemini 3.5 Flash	Frontier	$1.50	$9.00	MCP tool use, Finance Agent, multimodal
Gemini 3.1 Pro	Frontier	$2.00	$12.00	Deep reasoning, ARC-AGI-2
Kimi K2.6	Frontier	$0.60	~$2.50	Agentic coding, Agent Swarm
DeepSeek-V4-Pro	Frontier	$0.145	$3.48	STEM, math, long-context
Claude Sonnet 4.6	Balanced	$3.00	$15.00	Instruction following, summarization
Gemini 3 Flash	Balanced	$0.50	$3.00	Balanced coding + speed
Qwen3.5-397B	Balanced	~$0.50	~$2.00	Multilingual, instruction following
MiMo-V2.5-Pro	Balanced	$1.00	—	Long-horizon agentic, open-weight
MiniMax-M2.5	Balanced	$0.15	$0.90	Office tasks, long-context
MiniMax-M1	Balanced	$0.40	$2.20	Ultra-long context efficiency
DeepSeek-V3.1	Balanced	~$0.27	~$1.10	General tasks, tool calling
Claude Haiku 4.5	Lightweight	$0.80	$4.00	Routing, classification
Gemini 3.1 Flash-Lite	Lightweight	$0.25	$1.50	High-volume, latency-critical
DeepSeek-V4-Flash	Lightweight	$0.14	$0.28	Cheapest routing option
MiMo-V2-Flash	Lightweight	$0.10	$0.30	Cheapest overall, 73.4% SWE-bench
Qwen3.5-9B (local)	Lightweight	self-hosted	self-hosted	Best local deployment option

Conclusion

The most capable AI agents aren't the ones running everything through the biggest model. They're the ones that are smart about which model handles which job.

The competitive landscape has expanded dramatically. Google's Gemini family is now a serious contender at every tier, with Gemini 3.5 Flash punching above its nominal "Flash" position on agentic tasks. Alibaba's Qwen series brings the strongest multilingual capability and the most credible path to local/edge deployment. Xiaomi's MiMo arrived fast and is already processing a significant fraction of real-world API traffic.

The decision framework is simple: frontier for quality-critical autonomous work, balanced for volume tasks, lightweight for routing and short-form generation. Geography doesn't enter into it. Capability, cost, and data residency constraints do.

Build the routing config thoughtfully, log everything, and revisit it quarterly. The landscape will look different again.

Diff Checker: a small tool that solves a specific problem

Goksel Yesiller — Mon, 22 Jun 2026 09:51:33 +0000

Code reviews, configuration changes, and debugging sessions demand precise understanding of what changed between two versions of text. Manual comparison of large blocks of code or configuration files is error-prone, and version control diffs don’t always provide a quick, focused view for sharing or verifying changes outside a repository.

What it is

Diff Checker is a browser-based text comparison tool that performs line-by-line analysis of two text blocks and highlights differences with color-coded visual indicators. It processes text entirely in the browser—part of the 200+ free tools on DevTools—meaning no data is uploaded or stored, a privacy‑first design.

The interface uses a split‑pane layout: original text on the left, modified text on the right. As you paste or type, the comparison engine recalculates the diff in real time, marking added, removed, and changed segments so differences are immediately clear.

Several configuration options tailor the analysis. Toggling whitespace sensitivity ignores differences in indentation or blank lines, useful when comparing code from teams with different formatting conventions. Case sensitivity can be turned off for text where capitalization inconsistencies are irrelevant. A swap button reverses the comparison direction with a single click, handy when the assignment of “original” and “modified” is accidentally reversed.

How to use it

Paste the original text into the left panel and the modified version into the right panel. The diff view updates instantly, so you don’t need to press a button to see changes.

For code, the process is straightforward. Drop a baseline function on the left:

function calculateTotal(items) {
  let total = 0;
  for (let item of items) {
    total += item.price;
  }
  return total;
}

And the updated version on the right:

function calculateTotal(items, taxRate = 0) {
  let total = 0;
  for (let item of items) {
    total += item.price * (1 + taxRate);
  }
  return Math.round(total * 100) / 100;
}

The tool highlights the signature change, the modified calculation, and the rounding addition, giving you an unambiguous map of the edit.

Use the comparison options to narrow the focus. Enable “Ignore whitespace” when comparing code from editors with different indentation styles. Disable “Case sensitive” when reviewing prose or identifiers where case differences aren’t meaningful. If you’ve placed the newer version in the left panel, use the swap button to reverse the direction.

When to reach for it

Developers reach for Diff Checker during code reviews when they need to isolate the exact lines that changed between file versions. Instead of scrolling through a full diff in a terminal, they can paste two snippets and see only the relevant modifications, making it easier to discuss the scope and intent of an update.

Configuration file management benefits from the same precision. Deploying across staging, production, and local environments often means verifying that environment‑specific configs match expectations. The tool highlights missing variables, altered API endpoints, or differing feature flags, preventing deployment mistakes.

Database schema comparisons gain clarity from the side‑by‑side layout when reviewing migration scripts or table definitions. The line‑level analysis makes added columns, modified constraints, or changed data types immediately visible, reducing the risk of overlooking a breaking change.

Documentation updates—README files, API docs, inline comments—also become simpler with a visual diff. Technical writers and developers can compare versions to confirm that all additions are correct and nothing important was accidentally removed.

Finally, debugging workflows that involve log dumps, error stacks, or data extracts demand spotting subtle differences between two outputs. Diff Checker surfaces those differences without forcing an engineer to scan thousands of lines manually.

Try it yourself

The tool is available at diff-checker. It runs entirely in the browser, processes data locally, and takes about 30 seconds to test on a real diff—no signup, no tracking, no installation.

Related tools

JSON Formatter – Format and validate JSON data with syntax highlighting and error detection, also processing everything in the browser.
XML Formatter Validator – Clean up and validate XML documents with proper indentation and structure verification.
YAML Validator – Validate YAML syntax and structure with detailed error reporting and formatting options, ensuring configuration files remain clean and ready for comparison.

Try it: Diff Checker on DevTools

Lorem Ipsum Generator: a small tool that solves a specific problem

Goksel Yesiller — Mon, 22 Jun 2026 09:49:38 +0000

Placeholder text is necessary scaffolding in web development, but ubiquitous Lorem ipsum can lead to design monotony and disconnect from project context. Developers building mockups, prototypes, or content-heavy interfaces often need filler text that matches the tone of the target application without introducing distracting Latin.

What it is

The Lorem Ipsum Generator is a browser-based tool that produces placeholder text in multiple styles, moving beyond classical Latin pseudo-text. It offers distinct variants: traditional Lorem ipsum, Hipster Ipsum with artisanal terminology, Corporate Speak filled with business jargon, and Pirate Ipsum with nautical themes. Each style maintains readability while providing vocabulary that aligns with the spirit of a given project.

The generator is part of DevTools, a privacy-first collection of 200+ free browser tools where all processing happens locally—no signup, no tracking. Developers can configure generation parameters to specify the number of paragraphs, total word count, and whether to start with the familiar “Lorem ipsum dolor sit amet” opening. The output is plain text ready for pasting into HTML, design files, or CMS entries.

How to use it

The interface is a straightforward form: select a text style from the dropdown, then set the number of paragraphs or words you need. The tool generates the text instantly and provides a one-click copy button.

<!-- Example output structure when pasting into HTML -->
<div class="content-area">
  <p>Leverage agile frameworks to provide a robust synopsis for high level overviews...</p>
  <p>Iterative approaches to corporate strategy foster collaborative thinking...</p>
</div>

For typical workflows, 1–3 paragraphs suffice for article previews or body content. Headlines work well with 5–15 words, while navigation elements often need only 2–5 words. The quick copy functionality streamlines populating multiple content areas.

Different styles suit different contexts: Corporate Speak makes business application mockups feel authentic, Hipster Ipsum fits creative or lifestyle projects, and Pirate Ipsum adds character to gaming or entertainment interfaces during development. Because the tool runs entirely in the browser, there is no server round-trip to slow the generation loop.

When to reach for it

This generator is valuable during several development phases. Frontend engineers building responsive layouts need varied text lengths to test content reflow across breakpoints. Generating text that matches the project’s tone helps stakeholders and clients visualize the final product without distraction from foreign-language filler.

UI/UX designers benefit from contextually appropriate placeholder content in prototypes and wireframes. Instead of generic Latin that can confuse non-technical reviewers, themed text maintains the project’s atmosphere during presentations and usability walkthroughs.

The tool also supports CMS development, where developers need realistic text volumes to test pagination, search indexing, and content display components. Different text styles often surface layout issues that uniform Lorem ipsum might hide, such as word-break problems with unconventional vocabulary or line-length variation from corporate jargon.

API documentation and testing scenarios frequently require placeholder content that demonstrates various text lengths and styles, making this generator useful for creating comprehensive test datasets. The privacy-first design means no placeholder text ever leaves the browser—important when working in environments with strict data policies.

Try it yourself

The Lorem Ipsum Generator is available at lorem-ipsum-generator. It runs entirely in the browser and takes about 30 seconds to try on a real workflow—no setup, account, or data sharing required.

Related tools

Mock Data Generator – Creates structured test data including names, addresses, and other realistic content for development and testing. mock-data-generator
Slug Generator – Converts titles and phrases into URL-friendly slugs, useful alongside placeholder text when building routing or CMS structures. slug-generator

When placeholder text aligns with a project’s tone, it stops being a distraction and becomes a subtle part of the design process.

Try it: Lorem Ipsum Generator on DevTools

Dockerfile Builder: a small tool that solves a specific problem

Goksel Yesiller — Sun, 21 Jun 2026 23:51:51 +0000

Dockerfiles that pass a casual build check can still fail silently in production when they lack proper layer caching, run as root, or omit health checks. For teams without a dedicated container specialist, arriving at an optimized, secure configuration often means multiple rounds of scanning, tweaking, and rebuilding — time that could go into shipping features.

What it is

Dockerfile Builder is an interactive configuration tool that generates production-grade Dockerfiles following current best practices. Rather than editing text directly, developers select a runtime environment — Node.js, Python, Go, Rust, Nginx, Ruby, Java, Deno, or Bun — and the tool constructs a multi-stage build, layer caching strategy, health check, and non‑root user setup tailored to that stack.

The output is a complete Dockerfile with inline comments that explain the rationale behind each instruction, from choosing slim base images to ordering COPY commands for cache efficiency. The builder automatically splits dependency installation and application code across stages, reducing final image size without manual tweaking. It appends a HEALTHCHECK instruction that common orchestrators can query, and it generates the USER directive and associated permission changes so the container never runs as root. Every generated file follows patterns aligned with the OWASP container security guidelines and Docker official image best practices.

The tool runs entirely in the browser — no uploads, no signup, no tracking — part of the DevTools collection of 200+ free browser tools for engineers. All configuration stays local, so proprietary project details never leave the machine.

How to use it

Start by selecting your application’s runtime. The interface immediately picks an appropriate slim base image (for example, node:18-alpine for a Node.js service) and suggests common patterns for that ecosystem.

Next, define the build stage. Specify the builder base image version, working directory, and the files to copy first for layer caching. For a Node.js project, you might select package.json and package-lock.json and set the build command to npm ci --only=production. The tool uses this to place dependency installation before source code, maximizing cache reuse:

# Builder stage — generated example
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

Move to the final stage. Choose the production base image (often the same slim variant), a working directory, and which artifacts to copy from the builder stage. Add environment variables, set the exposed port, and specify the start command. The generator structures the copy step to avoid dragging development-only dependencies into the final image.

Toggle the health check option and provide the endpoint your application exposes (e.g., /health on port 3000). The builder inserts the appropriate HEALTHCHECK instruction with retry and interval defaults that you can tune. The security toggle creates a dedicated system user and sets file ownership, so the container’s runtime user is never root. The final generated Dockerfile can be copied, downloaded, or edited directly in the browser.

When to reach for it

Reach for Dockerfile Builder when containerizing a greenfield service and you want a secure, optimized baseline without spending an afternoon on Dockerfile research. It’s equally useful for teams that deploy containerized workloads only occasionally — the generated comments help maintainers understand the configuration months later.

The tool addresses a specific gap in existing Docker tooling: interactive, visual configuration with immediate feedback. Unlike IDE snippets or static templates, it enforces best practices (multi-stage builds, non‑root user, health checks) by default rather than leaving them as optional checkboxes. That makes it a quick standardization layer when an organization wants every new service to ship with uniform security and observability patterns, regardless of the original author’s Docker experience.

Use it as a learning aid when ramping up on containerization. Because every line includes an explanatory comment — why COPY comes before RUN npm install, why Alpine images are selected, how the --from=builder syntax works — the output doubles as reference material. When a project’s needs outgrow the generator, the resulting Dockerfile remains a readable foundation that can be extended by hand.

Try it yourself

The tool is available at dockerfile-builder. It runs entirely in the browser, so you can generate a best‑practice Dockerfile in about 30 seconds without creating an account or installing anything. Select a runtime, walk through the stages, and get a deployable configuration you can inspect or copy directly.

Related tools

For managing secrets and configuration values in container environments, the Environment Variable Encoder/Decoder helps encode and decode base64 strings without leaving the browser. The Gitignore Generator builds tailored .gitignore files that include Docker‑specific entries like .dockerignore and generated build artifacts, keeping repositories clean. Teams building test data for containerized services often combine the Dockerfile Builder with the Mock Data Generator, which produces realistic datasets for development and staging environments.

A well-structured Dockerfile doesn’t just build — it communicates intent to every engineer who touches it down the line.

Try it: Dockerfile Builder on DevTools

Introducing Advanced Markdown Previewer: A Quick Tour

Goksel Yesiller — Sun, 21 Jun 2026 14:19:26 +0000

Documentation workflows fracture when Markdown content needs precise rendering checks. Developers and technical writers waste cycles toggling between source editors and preview tools, breaking concentration and slowing iteration. A single environment that renders complex Markdown in real time eliminates that friction.

What it is

The Advanced Markdown Previewer is a browser-based editor with a split-pane layout: source on the left, live preview on the right. It renders Markdown instantly as you type. It supports the full GitHub Flavored Markdown (GFM) specification—including task lists, tables, and autolinks—alongside LaTeX-style mathematical expressions via KaTeX and syntax-highlighted code blocks across dozens of languages. Raw HTML embedding is supported, and external link behavior is configurable. The tool also tracks document statistics such as word count and character count in real time.

The previewer is one of 200+ free browser tools on DevTools, operating entirely client-side. No signup, no tracking—content never leaves the browser, making it suitable for proprietary or sensitive documentation drafts.

How to use it

Open the tool to see the dual-pane interface. Paste existing Markdown into the left editor or start writing from scratch. The preview updates immediately, reflecting GFM extensions and any math or code blocks.

For inline math, wrap LaTeX in single dollar signs: $E = mc^2$ . Display math uses double dollar signs:

$$
\int_{-\infty}^{\infty} e^{-x^2} dx = \sqrt{\pi}
$$

Code blocks with language identifiers get syntax highlighting. Example:

function fibonacci(n) {
  if (n <= 1) return n;
  return fibonacci(n - 1) + fibonacci(n - 2);
}

A settings panel lets you toggle GFM features, math rendering, HTML support, and link behavior. You can load sample documents to explore formatting, and export the rendered output as HTML. Real-time statistics—word count, character count—help when you’re working against length constraints.

When to reach for it

Use this tool when you need an accurate, zero-latency preview of Markdown destined for GitHub, GitLab, or similar platforms. It’s particularly valuable for documentation that mixes prose with mathematical notation, such as API specs involving formulas, academic papers, or engineering design documents. The KaTeX rendering matches what you’d see in many static site generators and notebook environments.

Technical writers preparing release notes, README files, or internal specs benefit from the side-by-side view during collaborative reviews, where both source and rendered output must be visible. The statistics panel aids content planning when you’re targeting a specific word count. And because the tool processes everything in the browser, it’s safe to use with confidential material without routing through a server.

Compared to a local editor’s Markdown preview plugin, this tool offers a dedicated, distraction-free environment with GFM and math support that may not be available in your IDE. It also serves as a quick validation step before pushing documentation to a repository.

Try it yourself

The Advanced Markdown Previewer is available at https://devtools.tools/markdown-previewer. It runs entirely in the browser. Try it in about 30 seconds—paste a README or a math-heavy document to see the rendering.

Related tools

Markdown Table Generator – Build properly aligned Markdown tables with a visual editor, then copy the formatted output directly into your documents.
GitHub README Generator – Assemble a complete README with project badges, installation instructions, and structured sections tailored for GitHub repositories.

Together, these tools streamline the documentation pipeline from drafting to final formatting.

Try it: Advanced Markdown Previewer on DevTools

Introducing AES Encryption: A Quick Tour

Goksel Yesiller — Sun, 21 Jun 2026 14:16:20 +0000

Developers implementing client-side encryption face a fundamental challenge: correctly implementing AES encryption requires deep knowledge of key derivation, initialization vectors, and authentication tags. One mistake in parameter selection or implementation can compromise the entire security model. The AES Encryption tool addresses this by providing a reference implementation that handles the cryptographic complexity while keeping sensitive data entirely within the browser.

Why it stands out

Most encryption tools fall into two problematic categories: server-based services that require trusting a third party with your plaintext, or complex libraries that require significant integration work. This tool occupies a unique position — it implements proper AES-GCM encryption with PBKDF2 key derivation using only the Web Crypto API, demonstrating how to build secure encryption without external dependencies.

The implementation choices reflect current cryptographic best practices: AES-GCM for authenticated encryption, PBKDF2 with 100,000 iterations for key stretching, and proper random generation for salts and initialization vectors. As one of 200+ free browser tools on DevTools, it operates with no signup, no tracking — data processed entirely in the browser.

What it is

The AES Encryption tool implements AES-256-GCM encryption with PBKDF2 key derivation through the Web Crypto API. The tool generates cryptographically secure random values for salts and initialization vectors, derives encryption keys from passphrases using PBKDF2-HMAC-SHA256, and produces self-contained encrypted outputs that include all parameters necessary for decryption.

The architecture ensures that plaintext, passphrases, and derived keys exist only in browser memory. The Web Crypto API provides the underlying cryptographic primitives, leveraging the browser's native implementation for both security and performance.

How to use it

The interface exposes two operations: encryption and decryption. For encryption, enter plaintext and a passphrase. The tool generates a 16-byte salt and 12-byte initialization vector using crypto.getRandomValues(), then derives a 256-bit key:

// Key derivation process
const salt = crypto.getRandomValues(new Uint8Array(16));
const iv = crypto.getRandomValues(new Uint8Array(12));

const keyMaterial = await crypto.subtle.importKey(
  "raw",
  encoder.encode(passphrase),
  "PBKDF2",
  false,
  ["deriveKey"]
);

const key = await crypto.subtle.deriveKey(
  {
    name: "PBKDF2",
    salt: salt,
    iterations: 100000,
    hash: "SHA-256"
  },
  keyMaterial,
  { name: "AES-GCM", length: 256 },
  false,
  ["encrypt", "decrypt"]
);

The encryption operation produces a base64-encoded output containing the salt, IV, and ciphertext with authentication tag. This self-contained format ensures portability — the encrypted data includes everything needed for decryption.

For decryption, paste the encrypted output and provide the original passphrase. The tool parses the embedded parameters, re-derives the key using the same PBKDF2 process, and attempts decryption. Failed authentication (wrong passphrase or tampered data) results in a clear error.

When to reach for it

Several scenarios benefit from browser-based AES encryption. During development of applications with client-side encryption requirements, the tool serves as a reference for proper implementation patterns. Developers can encrypt test data, configuration values, or API keys without installing additional software.

For debugging encryption-related issues, the tool provides a known-good implementation to verify expected outputs. When an application's encryption produces unexpected results, developers can use this tool to isolate whether the issue lies in their key derivation, encryption parameters, or data encoding.

The tool also functions as an educational resource. Developers new to Web Crypto API can examine a working implementation of AES-GCM with proper key derivation, understanding how the pieces fit together before implementing similar functionality in their applications.

Security auditors and penetration testers find value in quickly encrypting payloads or decrypting intercepted data during assessments, particularly when working with applications that implement similar AES-GCM schemes.

Technical implementation details

The tool demonstrates several cryptographic best practices. PBKDF2 iteration count is set to 100,000 — a balance between security and browser performance. The 96-bit IV size aligns with GCM mode recommendations. Salt generation uses cryptographically secure randomness, ensuring unique key derivation even with password reuse.

Error handling distinguishes between different failure modes: invalid base64 encoding, missing parameters, and authentication failures each produce specific error messages. This granular feedback helps developers debug integration issues with their own implementations.

The output format uses a simple concatenation scheme: base64(salt || iv || ciphertext). While not a standard format like JWE, this approach minimizes complexity while maintaining all necessary decryption parameters.

Try it yourself

The tool is available at devtools.tools/aes-encryption. It runs entirely in the browser and takes about 30 seconds to encrypt your first piece of data. No installation, no account creation, no data leaves your device.

Related tools

Base64 Encoder/Decoder: Convert between text and base64 encoding for data transmission
HMAC Generator: Create Hash-based Message Authentication Codes for message verification
UUID Generator: Generate cryptographically secure UUIDs for unique identifiers

P.S. If you're implementing client-side encryption in your own applications, consider this tool a baseline for comparison. The Web Crypto API makes secure encryption accessible — the challenge lies in getting the details right.

Try it: AES Encryption on DevTools