I pasted a production JWT into a random website. Then I read their privacy policy.

Zeeshan Imdad — Sat, 15 Aug 2026 17:13:05 +0000

I'd like to tell you this was a one-time lapse.

It wasn't. I do it constantly. A JWT to check what's in the payload. A chunk of JSON to pretty-print because the API response came back on one line. A cron expression I inherited from a script written by someone who left the company two years ago.

Every time, the same two seconds of hesitation before hitting submit: where is this actually going?

Then I hit submit anyway, because I had a ticket to close.

The part that bothered me

Most free online dev tools send whatever you paste to a server to do the work. For a JSON formatter, that's mildly wasteful. For a JWT decoder, it means your token — with whatever claims, user IDs, and issuer details it carries — just took a trip to someone else's backend.

And the thing is, none of these tools need a server. atob() has been in browsers for two decades. JSON.parse runs fine in a tab. The server-side version exists because it's easier to build, not because the work requires it.

So I built the version that doesn't.

DevTools Hub

devtools-hub-sigma.vercel.app — eight tools, all running entirely in your browser. No account, no upload, no backend in the loop at all.

Formatting — JSON Formatter, YAML ⇄ JSON Converter Encoding — Base64 Encoder/Decoder, JWT Decoder Generators — UUID Generator (v4, v7, nil) Text & Data — Timestamp Converter, Regex Tester, Cron Parser

Nothing exotic. These are the eight things I personally reach for in a normal week. The bar for adding a tool was "did I need this and get annoyed at the alternatives," not "would this look good on a feature list."

Client-side isn't just a privacy pitch

Three things fall out of the architecture for free:

It's faster. No request/response cycle. Results update as you type, because the work is happening ten inches from your eyeballs instead of in us-east-1.

It works offline. Load the page once, kill your wifi, keep working. Useful more often than you'd think — planes, hotel wifi, that one meeting room.

There's nothing to log. Not "we promise not to log it." There is no server in the path that could log it. That's a different kind of guarantee.

The stack

Next.js (App Router), TypeScript, Tailwind, shadcn/ui, deployed on Vercel.

Every tool page also has a short explainer, worked examples, and an FAQ — partly for the person who lands there from Google typing "what does the asterisk mean in a cron expression," and partly because a tool that does the thing without explaining the thing feels like a missed opportunity.

Your turn

Here's the question I actually want answered: what's the tool you use constantly and still hate?

The one where you've memorized which of the five ad banners to scroll past. The one you keep bookmarked despite the interstitial. That's my roadmap — tell me in the comments and I'll build it.

And if you try one of these and it breaks on some edge case I didn't think of, that's the most useful comment you could leave.