DEV Community: Usama Farooq

10 Free Online Tools Every Developer Needs (That Run Entirely in Your Browser)

Usama Farooq — Sun, 25 Oct 2026 04:56:51 +0000

10 Free Online Tools Every Developer Needs (That Run Entirely in Your Browser)

Every developer has a folder of bookmarked utility sites: the JSON formatter, the JWT decoder, the UUID generator. The problem is that most of them are ad-covered, slow, or — worse — they send your data to a server before showing you the result.

I run toolsofweb.com, a free tools site, and every tool there runs 100% in your browser. Nothing uploads, nothing needs an account. Here are the ten developer tools I reach for most, what each one actually does, and a real example of when you'd use it.

1. JSON Formatter

Paste minified JSON, get it readable. Sounds trivial until you're staring at a 4,000-character API response on one line.

JSON Formatter validates your JSON as you type and pretty-prints it with collapsible structure. Real example: a webhook from Stripe fails with a vague error, you paste the raw payload in, and the formatter shows the error.message field three levels deep that the one-line version hid. It also catches the classic mistakes — trailing commas, single quotes, unquoted keys — and points at the exact line.

2. JWT Decoder

A JWT is just three base64url segments separated by dots: header, payload, signature. You don't need a library to read one — you need to see what's inside it.

JWT Decoder decodes the header and payload instantly and shows the expiry (exp) as a human-readable date. Real example: your API returns 401 and you're not sure why. Paste the token in and you see exp was yesterday — the token expired, your refresh logic never ran, and it's not a permissions problem at all. Because it runs locally, your token never leaves the tab, which matters when it contains a live session.

3. UUID Generator

Every database row, every idempotency key, every test fixture needs a unique ID. uuidgen works on the command line, but you're usually already in the browser.

UUID Generator produces v4 UUIDs in bulk, and there's a UUID v7 generator too. Real example: you're seeding a test database and need 50 unique user IDs. Generate them in one click, copy, paste into your seed script. v7 is worth knowing about: it's time-ordered, so rows sort roughly by creation time, which keeps your database indexes happier than random v4 values.

4. Base64 Converter

Base64 shows up everywhere: data URIs in CSS, basic auth headers, binary data stuffed into JSON.

Base64 Converter encodes text to base64 and decodes it back, and handles files too. Real example: you need to embed a small SVG logo directly in your HTML. Convert it, paste the data:image/svg+xml;base64,... string into an <img> tag, and there's one fewer HTTP request. Going the other way, paste a suspicious base64 string from a log file and read the original text — often it's a JSON error message in disguise.

5. Cron Generator

Cron syntax is a language nobody fully memorizes: is 0 9 * * 1 Monday at 9, or the 1st of the month at 9? (It's Monday.)

Cron Generator builds the expression from plain-English choices — "every weekday at 9am" — and shows you the next few run times so you can sanity-check it before it goes into production. Real example: you're scheduling a nightly backup and want it at 2:30am, not 2:30pm. The preview of upcoming runs catches the AM/PM mistake before your backup silently runs in the middle of the working day.

6. URL Encoder / Decoder

URLs can't contain spaces, ampersands, or most punctuation — they have to be percent-encoded. And when you see %20 and %3F in a log, you need the reverse.

URL Encoder/Decoder handles both directions. Real example: you're building a search URL with a query like q=shoes & bags and your API keeps splitting it into two parameters. Encode it and the & becomes %26, so the whole query arrives as one value. Decoding is just as useful when a redirect URL in your logs is triple-encoded and you need to see the original destination.

7. Unix Timestamp Converter

1698225600 means nothing to a human. 2026-10-25 10:00:00 means everything.

Unix Timestamp Converter converts timestamps both ways — epoch to date, date to epoch — and shows the current time ticking live. Real example: a user reports a bug "around 3pm", your log shows event time 1761387600, and the converter tells you that's 3:00pm exactly, so you know which log lines matter. It handles seconds and milliseconds, which saves you from the classic bug of treating a 13-digit millisecond timestamp as seconds and landing in the year 56,000.

8. YAML to JSON Converter

YAML is what humans write; JSON is what APIs eat. Kubernetes manifests, GitHub Actions workflows, Docker Compose files — all YAML, all eventually needing to become JSON for a tool that only speaks JSON.

YAML to JSON Converter converts in both directions. Real example: your CI config is YAML, but a validation script expects JSON. Convert, validate, convert back. It catches indentation errors too — the number one YAML failure — and tells you which line is wrong instead of failing silently.

9. JSON to CSV Converter

APIs return JSON. Spreadsheets and data tools want CSV. Someone has to translate.

JSON to CSV Converter flattens JSON arrays into CSV with headers, handling nested objects by flattening their keys. Real example: you pull 200 rows of analytics from an API and your manager wants them in a spreadsheet. Paste the JSON, download the CSV, done — no throwaway Python script, no pandas install. It works the other way too when you have a CSV export and need JSON for an import.

10. Hash Generator — the one I built last week

I covered this in detail in yesterday's post, but it belongs on this list: MD5, SHA-1, SHA-256, SHA-384, SHA-512, HMAC, and file checksums, all computed locally. Real example: you download a Linux ISO and the mirror publishes a SHA-256 checksum. Hash the file in your browser, compare, and you know the download wasn't corrupted or tampered with — without uploading a 3 GB file to anyone's server.

Why "runs in your browser" is the whole point

Every tool above shares one design rule: your data never leaves your machine. That matters more for developer tools than for most others, because what you paste into them is often sensitive — API tokens, database dumps, config files with secrets, JWTs carrying live sessions.

A server-side tool has to receive your data to process it. A client-side tool doesn't. The browser already has everything needed: the WebCrypto API for hashing, atob/btoa for base64, JSON.parse for formatting. There's no technical reason for these utilities to phone home, and every reason for them not to.

All ten are free, no signup, no ads on the tool pages themselves. If there's a developer tool you're missing, the site has a request-a-tool form — every request gets read.

What utility do you reach for most? I'd genuinely like to know what to build next.

How I Built a Free Hash Generator That Runs 100% in Your Browser

Usama Farooq — Sat, 24 Oct 2026 05:06:10 +0000

How I Built a Free Hash Generator That Runs 100% in Your Browser

Every week I add a free tool to toolsofweb.com, and the newest one is a hash generator. It computes MD5, SHA-1, SHA-256, SHA-384 and SHA-512 — plus HMAC for all of them — without a server, an account, or a single byte of your data leaving the tab.

This isn't a launch post. It's a build log: the decisions I made, the crypto API quirks I hit, and the code that shipped.

Why client-side matters for this one

Most free hash tools online paste your input into a form, POST it to a server, and return the digest. For a hash generator, that's backwards: people hash things precisely because the data is sensitive — passwords before storing them, file checksums before trusting a download, API secrets when debugging HMAC signatures.

The site's rule is simple: anything you hash stays on your machine. The whole tool is a React component plus one TypeScript module, and the only "backend" is crypto.subtle — the WebCrypto API already living in your browser.

MD5: hand-rolled, RFC 1321, streaming

Here's the surprise: browsers no longer ship MD5 in WebCrypto. crypto.subtle.digest() supports SHA-1, SHA-256, SHA-384 and SHA-512, but MD5 was left behind because it's not collision-resistant anymore.

Still, people need MD5 constantly — legacy database fields, Gravatar URLs, htpasswd files (our htpasswd generator uses it). So I wrote an incremental MD5 implementation straight from RFC 1321:

export class Md5 {
  private a = 0x67452301; // Initial state, straight from the RFC
  private b = 0xefcdab89;
  private c = 0x98badcfe;
  private d = 0x10325476;
  private buf = new Uint8Array(64); // one 512-bit block
  ...
}

The round constants are derived the way the spec demands — floor(abs(sin(i+1)) * 2^32) — no magic-number tables copied from the internet. And because the class is incremental (update() keeps 64 bytes of internal buffering and processes full blocks as they arrive), I can hash a 100 MB file in chunks without loading it all into memory. That matters on phones.

One detail I was careful about: I verified my implementation byte-for-byte against the MD5 function already powering the site's htpasswd generator. Two implementations agreeing on every test vector means a bug would have to exist identically in both — unlikely. md5("hello") gives the famous 5d41402abc4b2a76b9719d911017c592, as expected.

SHA family: let the browser do the heavy lifting

For SHA-1 through SHA-512, there was no reason to hand-roll anything. WebCrypto's digest() is implemented in the browser's native crypto layer — it's faster and better reviewed than anything I'd write:

const digest = await crypto.subtle.digest('SHA-256', data);

One gotcha worth knowing: crypto.subtle.digest() is async and takes an ArrayBuffer (a bare Uint8Array needs a cast). The tool computes all five digests in parallel with Promise.all for text input, so the UI updates essentially instantly — no loading spinner for normal text.

HMAC: half native, half by hand

The tool has an HMAC tab — you supply a key and a message, it signs it. For HMAC-SHA-*, WebCrypto has you covered:

const cryptoKey = await crypto.subtle.importKey(
  'raw', keyBuffer, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
);
const sig = await crypto.subtle.sign('HMAC', cryptoKey, data);

But HMAC-MD5 needs the hand-rolled MD5 again, built exactly per RFC 2104:

HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m))

with ipad = 0x36 and opad = 0x5c repeated over a 64-byte block-sized key (hash the key first if it's longer than 64 bytes). Nothing exotic, but getting the padding exactly right is the whole game with HMAC, so I tested it against Python's hmac module output before shipping.

Four tabs, each answering one real question

The UI is four tabs, one per question people actually ask:

Text — "What are the hashes of this string?" All five digests compute live as you type.
File checksum — "Is this download intact?" Drop a file (up to 100 MB) and it gets hashed locally — FileReader reads the bytes, WebCrypto/MD5 digests them, nothing uploads. Then paste the checksum the publisher listed and use…
Compare — "Does this match?" Paste the expected hash and your input; the tool auto-detects the algorithm from the hex length (32 chars → MD5, 40 → SHA-1, 64 → SHA-256, 96 → SHA-384, 128 → SHA-512) and reports match/mismatch.
HMAC — "What's the signature for this webhook payload?" Key + message → signature.

Real example: after downloading a Linux ISO, the mirror usually publishes a SHA-256 checksum. Open the File checksum tab, drop the ISO, compare against the published value. If it matches, the file wasn't corrupted or tampered with in transit. Doing this without uploading a 3 GB file to someone's server is the entire point of building it client-side.

What I learned shipping this

WebCrypto is async everywhere. Mixing it with a synchronous hand-rolled MD5 meant making the MD5 path synchronous and the SHA path async, then joining results with Promise.all. Fine, but plan the API boundary early.
Verify against independent implementations. My MD5 cross-checks against the htpasswd generator's MD5; my HMAC-MD5 cross-checks against Python's hmac module. One self-consistent implementation can be self-consistently wrong.
Streaming isn't optional for files. A naive implementation reads the whole file into memory. The incremental MD5 processes 64-byte blocks as they arrive; WebCrypto handles its own chunking internally. Keep the memory footprint flat.
MD5 is still everywhere. People reach for it for checksums, cache keys, deduplication — non-security uses where collision resistance doesn't matter. A "SHA-only" tool would have missed half the use cases.

Try it

The tool is free, no signup, no ads: toolsofweb.com/hash-generator. Paste some text, drop a file, or check an HMAC — everything happens in your browser, and I never see any of it.

If there's a hash-related feature you'd want (bcrypt/argon2 wrappers, keccak, bulk file hashing), the site has a request-a-tool form — every request gets read.