Free Developer Tools Online: JSON, JWT, Base64, URL, Timestamp & Regex

Toolstik has six free developer tools that run entirely in your browser: a JSON Formatter & Validator, a JWT Decoder, a Base64 Encoder / Decoder, a URL Encoder / Decoder, a Unix Timestamp Converter, and a Regex Tester. There's nothing to install, no account, and nothing you paste is uploaded, which matters when the input is an API response, an auth token, or a production log line. This guide covers what each tool does, the exact controls you'll use, its limits, and which in-depth guide to read next.

Why browser-based developer tools

Most quick developer chores are small transformations: pretty-print this JSON, read this token, decode this query string, convert this epoch. You can do all of them in a terminal, but switching context to write a one-off script costs time, and many online utilities send your input to a server you know nothing about.

Toolstik's developer tools use the same built-in browser APIs you'd use in code (JSON.parse, atob/btoa, encodeURIComponent, Date, and RegExp), so results match what your JavaScript code would produce. Because processing happens in the tab, you can paste internal data without it leaving your machine. Still use judgment with live secrets: the safest token to paste anywhere is an expired one.

All six tools live in the developer tools category, and every Toolstik utility is listed on the all tools page.

JSON Formatter & Validator

What it does: parses JSON and either indents it, minifies it, or reports the first syntax error.

How to use it: paste into JSON input, choose an indent (2 spaces, 4 spaces, or 8 spaces), then click Format, Minify, or Validate. Valid input shows a Valid JSON badge and a nested key count. Invalid input shows an Invalid JSON message with a line and column when your browser's parser reports a position. Copy, Download (saves formatted.json), and Reset sit below.

Good to know:

• It checks syntax only, not JSON Schema.
• Output is re-serialized by JSON.stringify, so duplicate keys collapse to the last value and integers beyond 2^53 lose precision.
• Strict JSON only: comments and trailing commas are errors.

Read next:

• How to format and validate JSON online: a full walkthrough with command-line equivalents.
• Common JSON errors and how to fix them: trailing commas, quotes, BOMs, and invalid escapes with before-and-after examples.
• JSON pretty print vs minify: a comparison table with measured sizes, including after gzip.

JWT Decoder

What it does: splits a JSON Web Token into its parts and shows the header and payload as indented JSON.

How to use it: paste the token into JWT token (without the Bearer prefix) and click Decode JWT. The output is one JSON block with header and payload. Copy copies it.

Good to know:

• It decodes, it does not verify. The tool says so above every result: anyone can craft a payload that decodes perfectly. Trust only tokens your server has verified with the right key.
• It expects exactly three non-empty segments, so encrypted five-part JWEs and unsigned tokens with an empty signature are rejected.
• exp, iat, and nbf are Unix seconds. Paste them into the timestamp converter below.
• If accented characters in claims look garbled, decode the payload segment with the Base64 tool's URL-safe mode, which handles UTF-8.

Read next:

• How to decode a JWT safely: the practical workflow, a safety checklist, and decode error fixes.
• JWT header vs payload vs signature explained: what each segment contains, registered claims, and how HS256 and RS256 signatures work.

Base64 Encoder / Decoder

What it does: converts UTF-8 text to Base64 and back.

How to use it: type into Text, optionally switch on URL-safe Base64, and click Encode or Decode. Copy and Reset are next to the buttons.

Good to know:

• URL-safe mode swaps + and / for - and _ and drops the = padding when encoding. When decoding, it restores the padding for you. This is the variant JWTs use.
• héllo?> encodes to aMOpbGxvPz4= in standard mode and aMOpbGxvPz4 in URL-safe mode.
• It handles text, not binary files.
• Base64 is an encoding, not encryption. Anyone can reverse it.

Spot a string starting with eyJ? It's almost certainly Base64 JSON. Decode it here, then format it with the JSON tool.

URL Encoder / Decoder

What it does: percent-encodes or decodes URLs and URL components.

How to use it: paste into URL or text, choose a mode with the encodeURIComponent / decodeURIComponent switch (on by default), and click Encode or Decode.

Good to know:

• Switch on (component mode): encodes everything that isn't safe inside a single query value, including &, =, /, and ?. café & tea becomes caf%C3%A9%20%26%20tea. Use it for parameter values.
• Switch off (full URI mode): keeps URL structure characters like :, /, ?, &, and # intact and only encodes things like spaces and non-ASCII letters. Use it for whole URLs.
• A stray % that isn't followed by two hex digits makes decoding fail with an error about invalid escape sequences.

Building campaign links? The UTM Builder handles query-string encoding for you.

Unix Timestamp Converter

What it does: converts Unix timestamps to readable dates and dates back to timestamps.

How to use it: on the Timestamp to date tab, paste a number into Unix timestamp, pick a Unit (Auto-detect, Seconds, or Milliseconds), and click Convert. On the Date to timestamp tab, type an ISO 8601 date into Date and time and click Convert. Use current time fills in "now" on either tab. Results include ISO 8601 (UTC), Unix seconds, Unix milliseconds, UTC, Your local time, and Relative, each with a copy button.

Good to know:

• Auto-detect treats values of 100,000,000,000 (1e11) or more as milliseconds, so 10-digit seconds and 13-digit milliseconds are both read correctly.
• 1700000000 is 2023-11-14T22:13:20.000Z.
• Date-only input like 2026-10-10 is read as midnight UTC. A date-time without an offset, like 2026-10-10T12:00:00, is read in your local time zone. Add Z or an offset to be explicit.
• Microsecond and nanosecond values need dividing first.

Read next: How to convert a Unix timestamp covers seconds versus milliseconds, time zones, the 2038 problem, and tested snippets for JavaScript, Python, SQL, and bash.

Regex Tester

What it does: runs a JavaScript regular expression against sample text and shows every match.

How to use it: type the pattern (no slashes) into Pattern, tick flags (Global (g), Ignore case (i), Multiline (m), Dot matches newline (s), Unicode (u)), paste into Test text, and click Test regex. You get a match count, highlighted matches, and a table of index, match, and numbered and named groups.

Good to know:

• The flavor is ECMAScript, the same as in browser JavaScript and Node.js. PCRE features like possessive quantifiers, atomic groups, and (?P<name>...) will error.
• Limits: 100,000 characters of test text and up to 1,000 matches.
• Matching runs in a Web Worker and is stopped after 2 seconds, so a catastrophic-backtracking pattern like ^(a+)+$ can't freeze your tab.
• Without Global (g), only the first match is reported.

Read next: How to test a regex online covers greedy versus lazy quantifiers, escaping, backtracking fixes, and a PCRE-vs-JavaScript syntax table.

Common workflows that combine tools

Debugging a 401 from an API

1. Copy the token from the Authorization header and decode it in the JWT Decoder.
2. Paste exp into the Unix Timestamp Converter to see whether it has expired.
3. Check aud and iss against what the API expects.

Reading a webhook or log payload

1. If it arrives percent-encoded, decode it with the URL Encoder / Decoder.
2. If it's Base64, decode it with the Base64 Encoder / Decoder.
3. Format the resulting JSON with the JSON Formatter. If it fails, check common JSON errors.

Extracting fields from logs

1. Build and test the extraction pattern in the Regex Tester against a sample of real log lines.
2. Convert any epoch values you pull out with the timestamp converter.

Shipping structured data for SEO

Generate JSON-LD with the Schema Markup Generator, then sanity-check the syntax in the JSON Formatter. The full process is in how to create JSON-LD schema markup.

Quick reference

Privacy and limits in one place

• Local processing. All six tools run in your browser. Analytics record that a tool was used, not what you pasted.
• No verification or execution. The JWT tool doesn't check signatures, the URL tool doesn't fetch URLs, and the JSON tool doesn't validate schemas.
• Browser engine differences. JSON error wording and some date parsing come from your browser, so Chrome, Firefox, and Safari can word errors differently or parse unusual date formats differently. Positions and ISO 8601 dates are consistent.
• Size. Very large inputs can slow a tab. The regex tester caps test text at 100,000 characters.

Beyond developer tools

Toolstik also has tools for images, PDFs, SEO, text, and small-business math. Browse the free online tools hub for the full list, or jump to free SEO and text tools if you're working on page metadata and content alongside your code.