I built Payload Haven, a free collection of developer utilities that process tool inputs in your browser. No account or upload is required to use the tools.
Here are three workflows you can try with sample data.
1. Compare JSON values instead of formatting
Suppose an API changes from:
{"status":"pending","user":{"name":"Ada"},"tags":["api"]}
to:
{"tags":["api","private"],"user":{"name":"Ada"},"status":"complete"}
The JSON comparison tool ignores object key order and reports changed paths. In this example, /status changes and /tags/1 is added. Arrays are compared by position, so reordering them can produce several changes. Paths use JSON Pointer escaping to distinguish keys that contain slashes.
2. Inspect a JWT without confusing decoding with verification
The JWT decoder displays the header, payload, and timestamp claims. Decoding does not verify the signature or establish that the claims are trustworthy. Your application still needs to verify the signature and validate the issuer, audience, expiry, and other requirements for its use case. The sample token is deliberately not a credential.
3. Encode Unicode text correctly
The Base64 tool converts text to UTF-8 bytes before encoding, so inputs such as café 👋 round-trip correctly. It also supports URL-safe Base64. Base64 is encoding, not encryption. For individual query parameter values, use the separate URL encoder instead.
What else is included?
- JSON formatting, validation, minification, and syntax error locations
- URL encoding and decoding
- Unix timestamp conversion with explicit time zones
- Random v4 UUID generation, including batches
- JSON string escaping and unescaping
- Result downloads and settings-only sharing links
Tool inputs and results are not uploaded for processing. The site has a separate analytics choice described on its privacy page; browser-local processing does not mean that loading a website makes no network requests.
One limitation: the JSON tools use JavaScript numbers, which can round very large integers or high precision decimals. Preserve the original input when exact numeric representation matters.
I would appreciate specific feedback: which workflow would you bookmark, and what currently makes it awkward to use?
Disclosure: I used AI assistance to build the site and draft this post.
Top comments (1)
Keeping JWT/JSON parsing local is the right privacy posture for a debugging tool — that's the exact reason I'd never paste a prod token into most online decoders.
Staff SDET here; I ran payloadhaven.com through a quick automated QA pass and it scored 89/100 (B). The top flag is short meta descriptions across the tool pages — /json-diff/ is 48 characters ("Compare two JSON values by path in your browser."), the homepage 62 — so Google tends to swap in its own snippet. Stretching each to ~140 characters and leading with the "nothing leaves your browser" angle is a quick win, since that's the differentiator searchers care about. 5 more warnings showed up in that pass.
Is the JWT decoder verifying signatures too, or decode-only for now?