Skip to content

A space we build together

MOA
Log in

Developer Tools

Forty everyday developer helpers in one place (including TOTP, semver, bit operations, .env/INI/TOML conversion, JSON Schema validation, docker run → compose, .gitignore, OG tags and ASCII/ANSI tables) (now with subnet/CIDR, chmod, an HTTP/MIME/port reference, robots/sitemap and dummy data): URL, Base64, HTML and Unicode encoding, JSON formatting, CSV and type generation, Unix time, JWT decoder, hashes, UUIDs, regex, text diff, number bases, cron, certificate/CSR and mail header readers, business registration number checks, and a table converter.

Everything runs inside this browser; what you enter is never sent to a server or stored. You can paste tokens and keys with some peace of mind, but on a shared computer close the page when you are done.

Good to know

  • Text is always handled as UTF-8 bytes, so Korean and other non-ASCII text survives (Base64, Hex, hashes).
  • The JWT decoder does not verify signatures — it only reads the contents. The payload is plain Base64, not encryption, so never put secrets in it.
  • Times are shown in both UTC and Korea Standard Time (KST, +9).
  • Regular expressions run in a separate worker and are stopped after 1.5 seconds (to guard against runaway patterns).
  • MD5 and SHA-1 are for checksums only. Do not use them for security such as password storage.

FAQ

Is the JSON or token I paste sent to a server?

No. Every conversion happens in your browser and nothing is transmitted or stored.

Does it verify JWT signatures?

No. Verification needs the secret key, and asking you to type that into a web page is not safe, so only decoding is offered.

Korean text breaks in Base64.

This tool encodes text as UTF-8 bytes. If another tool used EUC-KR or another encoding, the output will differ.

I cannot tell whether my Unix time is seconds or milliseconds.

The unit is detected from the digit count (10 digits seconds, 13 milliseconds, 16 microseconds). If the result looks wrong, pick the unit yourself.

How to use this tool

The conversions and checks developers need most often, in one place: URL, Base64, HTML and Unicode encoding, JSON formatting and validation, JSON↔CSV, JWT decoder, Unix time, regular expressions, text diff, hashes, UUID, cron explanation, subnets (CIDR), chmod, dummy data, cURL conversion and more — 28 tabs.

Frequently asked questions

What tools are included?

28 tabs including encodings (URL, Base64, HTML, Unicode), JSON formatting and validation, JWT decoder, hashes, UUID, regular expressions, text diff, cron explanation, subnets, chmod and dummy data.

Is it safe to paste a JWT?

Decoding happens in the browser and nothing is sent to a server. Still, avoid pasting real secret production tokens anywhere.

How do I convert Unix time?

In the Unix time tab you can convert a number of seconds to a date and a date to a number.

See all tools

JSON, XML & YAML Parser

Paste or open a JSON, XML or YAML file to validate it (with the exact line and column of any error), browse it as a collapsible tree, search values and keys, look values up by path, pretty-print or minify it, and convert between formats. Everything runs in your browser — your input and files are never sent to a server.

CSS Generator

Build gradients, shadows (box/text-shadow), rounded corners (border-radius) and flex/grid layouts while watching them, then copy the CSS. Nothing is sent to a server.

Password Generator

Create a hard-to-guess password from a length and character types, or as an easy-to-remember word combination (passphrase). The result never leaves this page.

What is my IP

Check your public IP address and approximate location.

File & Text Encryption

Encrypt and decrypt text or files with a password using AES-256. Everything happens in this browser; your text, files and password are never sent to a server.

Web Page & RSS Checker

Enter an address and our server visits it to check titles, descriptions, Open Graph preview data, response headers, redirects and the SSL certificate expiry — inspect an RSS/Atom feed for common problems, or check whether an API allows browser requests from another site (CORS), and look up a domain's DNS records (A, MX, TXT, NS and more) through public DNS.