savetools
dev toolbench
Security Header Check Library Scan Certificate
Format JSON Beautify XML Beautify YAML Beautify
Encode / Decode Base64 JWT URL Encode
Generate UUID Generator Hash Generator
Convert Timestamp Color
Text String Counter Text Diff Regex Tester
More utilities soon
Checking server
OWASP baseline · retire.js
Security — HTTP responseruns on our server

Header Check

Checks a site's HTTP response against the OWASP secure headers baseline and scores what's missing.

This check cannot run in your browser — cross-origin rules hide other sites' response headers from web pages. Only the target URL is sent to this site's server to make the request; nothing you type anywhere else ever leaves your device.

Security — JavaScriptruns on our server

Library Scan

Finds the JavaScript libraries a page loads and matches them against known vulnerabilities in the retire.js database.

This scan cannot run in your browser — cross-origin rules hide other sites' HTML from web pages. Only the target URL is sent to this site's server to fetch and inspect the page.

Security — Transportruns on our server

Certificate Check

Inspects a site's SSL/TLS certificate: validity, expiry, trust chain, hostname match, and which protocol versions the server offers.

This check cannot run in your browser — web pages cannot inspect TLS certificates. Only the target hostname is sent to this site's server to open the inspection connection.

Format — JSONruns in your browser

JSON Beautify

Validates raw JSON and formats it — pretty-printed or minified, with the exact line and column when parsing fails.

Indent

Encode / Decode — Base64runs in your browser

Base64

Encodes text to Base64 and decodes Base64 back to text — UTF-8 safe, accepting both the standard and URL-safe alphabets.

Encode / Decode — JWTruns in your browser

JWT

Decodes JSON Web Tokens — header, claims, expiry — and verifies or creates HMAC signatures (HS256/384/512). Your secret never leaves this tab.

Mode Alg

Encode / Decode — URLruns in your browser

URL Encode

Percent-encodes text for URLs and decodes it back — component or whole-URL encoding, with the exact position when a sequence is malformed.

Encode as

Text — Countingruns in your browser

String Counter

Counts text the way machines see it — graphemes, code points, UTF-16 units, and bytes each differ, and length limits care about the difference.

Generate — UUIDruns in your browser

UUID Generator

Generates UUIDs — v4 (random) or v7 (time-ordered, sortable — the better choice for database keys).

Version Count

Format — XMLruns in your browser

XML Beautify

Checks XML well-formedness and formats it — pretty-printed or minified, with the exact line and column when a tag is broken.

Indent

Generate — Hashruns in your browser

Hash Generator

Computes MD5, SHA-1, SHA-256, and SHA-512 digests of a text — MD5 and SHA-1 are marked weak: fine as checksums, never for passwords or signatures.

Text — Comparisonruns in your browser

Text Diff

Compares two texts line by line and shows what was added, removed, and unchanged — with line numbers for both sides.

Original
Changed

Format — YAMLruns in your browser

YAML Beautify

Validates YAML and re-indents it — comments and multi-document streams survive, and a broken document gets the exact line and column.

Indent

Text — Regexruns in your browser

Regex Tester

Tests a JavaScript regular expression against a text, live — matches highlighted in place, with positions and capture groups. Runs entirely in your browser.

Flags
Convert — Timeruns in your browser

Timestamp

Converts between UNIX epochs and dates — paste seconds, milliseconds, or a date string; the format is detected automatically.

Convert — Colorruns in your browser

Color

Converts a color between hex, RGB, and HSL — with WCAG luminance and the contrast verdict for black or white text on it.