Most of a developer's day is not spent writing features. It's spent on the small stuff in between: pasting an API response somewhere to make it readable, decoding a token to find out why auth is failing, checking whether a cron expression really means "every weekday at 9", generating fifty UUIDs to seed a test table, or diffing two config files that are supposed to be identical and clearly aren't. Each of those is a two-minute job — right up until you're pasting production data into a random site that wants you to sign in first.
The developer tools on FWD Tools are forty-two free, browser-based utilities for exactly those jobs. They all run client-side: your JSON, your tokens, your API payloads, your passwords and your source code stay in the tab. No account, no rate limit, no paid tier, and nothing sitting in a log file on someone else's server after you close the page.
Who these are for
- Backend and full-stack developers debugging live systems — formatting a response, decoding a JWT, hashing a value, checking a timestamp against a time zone.
- Frontend developers wiring up an API — generating types from a payload, mocking an endpoint that doesn't exist yet, testing a request before writing the fetch call.
- Anyone handling data they can't paste into a public tool — internal API responses, staging credentials, customer records in a JSON sample, a token from a production session.
- People who need one answer, once, and don't want to install a CLI, open an IDE, or sign up for a SaaS to get it.
The four you'll open most
JSON Formatter is the one that earns its bookmark. Paste anything — a REST response, a config file, a log line with JSON buried in it — and get validated, syntax-highlighted, collapsible output, with minify and key-sort in the same panel. Invalid JSON gets an error pointing at the position that broke it, which is usually all you need to spot the trailing comma.
Regex Tester gives you live match highlighting as you type the pattern, capture-group extraction, and a flags panel, so you can iterate against real test input instead of running your script again to find out you got it wrong. Regex is the classic case where the feedback loop matters more than the tool: seeing all matches light up as you edit is the difference between five minutes and forty.
Diff Checker compares two blocks of text using LCS diffing, with split view, unified GitHub-style +/- view, and character-level inline highlighting. Use it for two versions of a config file, two API payloads that should match, or the "it works on my machine" environment comparison.
Base64 Encoder / Decoder handles plain text, files and Data URIs in both directions — the everyday plumbing for embedded assets, basic-auth headers, and anything that arrived from an API already encoded.
Security, identity and encoding
- JWT Decoder — Splits a token into its three parts, decodes header and payload, and labels every claim in plain English:
expwith a live expiry countdown,iat,nbf,sub,aud,iss, plus any custom claims your service adds. It also verifies HS256 signatures if you supply the secret. This is the tool that answers "is the token expired, or is my audience check wrong?" in about four seconds — and it's precisely the tool you should never paste a real token into on a server-backed site. - Hash Generator — MD5, SHA-1, SHA-256 and SHA-512 digests computed with the browser's native SubtleCrypto API. Useful for verifying a download, comparing a checksum, or reproducing a signature your backend generated.
- UUID / ULID / NanoID Generator — UUID v4 (random), v7 (time-ordered and sortable, which is what you want for database primary keys), v1, plus ULIDs and NanoIDs with a configurable alphabet. Generate up to 1,000 at once with uppercase and no-hyphen options — the fastest way to seed fixtures or a test table.
- Password Generator — Cryptographically random passwords with entropy scoring, plus passphrases, PINs, and a memorable mode for the handful of passwords you actually have to type.
- URL Encoder / Decoder — Percent-encoding in both directions, for query strings, redirect targets and the callback URL that keeps breaking because someone forgot to escape an ampersand.
- Security Headers Generator — Builds a Content-Security-Policy, HSTS, X-Frame-Options and the rest of the response-header set, in a form you can paste into Nginx, Apache or your host's config.
Time, scheduling and the time-zone off-by-one
Timestamp Converter moves between Unix timestamps (seconds or milliseconds), ISO 8601, and human-readable dates across time zones. Most "the job ran at the wrong time" incidents are really a UTC-versus-local misreading, and this is the two-second way to confirm which.
Cron Expression Builder translates cron syntax into plain English and back, and — the part that actually matters — shows the next five run times. Before you commit a GitHub Actions schedule, an EventBridge rule or a Kubernetes CronJob, checking that 0 9 * * 1-5 really fires the five mornings you think it does costs ten seconds and saves a week of a job silently not running.
API work: build it, test it, fake it
API Request Generator & Tester builds an HTTP request with custom headers, a body (JSON, form-data or raw), authentication (Bearer, Basic, API key) and query parameters, executes it live from the browser, and shows you the full response — status, headers, body. It then generates the equivalent code in twelve languages: cURL, Fetch, Axios, Python requests, Go, PHP, Ruby and more. The workflow it replaces is "open Postman, configure the request, get it working, then hand-translate it into your codebase" — here the working request and the code you paste are the same artifact.
API Mock Generator solves the other half of the problem: the endpoint doesn't exist yet and the backend team says Thursday. Define a schema with field types — name, email, date, UUID, number range, boolean, image URL — and it generates a realistic fake dataset of any size, exportable as a JSON Server db.json (npx json-server db.json gives you a local REST API in one command) or as a Postman collection.
Database Schema Designer is for the step before either of those: lay out tables, columns, types and relationships visually and get the schema back as something you can act on, without opening a heavyweight modeling app to sketch four tables.
Making JSON legible
- JSON Table Viewer — Renders a JSON array as a searchable, sortable table. When an endpoint returns eight hundred records and you need to find the one with the null field, a table beats a formatter.
- JSON → TypeScript — Generates interfaces from a sample payload, naming nested objects, marking fields optional where they're null or missing, and handling arrays of objects properly. The fastest route to typing an API you don't control.
- JSON Schema Generator — The validation-side counterpart: infers a JSON Schema from an example document, for request validation or contract testing.
- JSON Dashboard Generator — Turns a JSON payload or a live API URL into instant charts and stat cards. Genuinely useful for a quick look at whether the numbers coming out of an endpoint are plausible, before anyone builds a real dashboard.
Formatting and minifying code
- SQL Formatter — Beautifies MySQL, PostgreSQL, SQLite, T-SQL and BigQuery queries. The tool for that 200-character single-line query pulled out of an ORM log.
- HTML Formatter and XML Formatter — Indent, tidy and validate markup, including minified HTML pulled from a view-source and the XML that still shows up in every SOAP, RSS and sitemap conversation.
- JavaScript Minifier — Compresses JS in the browser, concatenates multiple uploaded files, preserves license comments, optionally uglifies simple identifiers, and downloads a
.min.js— without sending your source to a build service. - Tailwind Formatter — Sorts and tidies long utility-class strings into a consistent order, which makes reviewing a diff on a Tailwind component considerably less unpleasant.
- CSS Minifier / Beautifier — Both directions, with before/after byte counts.
Encoding, numbers and small conversions
- Binary / Hex / ASCII Converter and Number Base Converter — For bit flags, hex offsets, permission masks, and anything that arrived in a base you don't read fluently.
- HTML Entity Encoder — Escapes and unescapes
<,&, quotes and the rest, for when user content has to be safely rendered as text. - YAML ↔ JSON and CSV ↔ JSON — The two data conversions that come up weekly. Both auto-detect the input format and work in either direction.
- HTML → JSX —
classtoclassName, inline styles to style objects, self-closing tags fixed, for the moment a static mockup has to become a component.
Around the edges of shipping
- Responsive Preview Tool — Loads a URL at multiple device widths side by side, so you can check a layout at phone, tablet and desktop sizes in one glance rather than dragging a window.
- .htaccess Redirect Generator — Builds correct 301 and 302 rules, including regex patterns and wildcard paths, for a migration where getting redirects wrong is the expensive mistake.
- llms.txt Generator — Produces the emerging
llms.txtfile that tells AI crawlers what your site is and which pages matter, the wayrobots.txtdoes for search engines. - Code Screenshot Generator — Nine themes, 23 languages, four window styles. For READMEs, docs, and posting a snippet somewhere that mangles code blocks.
- Markdown Editor — Live split-pane editing with a rendered preview, for READMEs, changelogs and PR descriptions you'd rather not write blind.
- Meta Tag Generator, robots.txt Generator, Sitemap Generator, Schema Markup Generator and Hreflang Tag Generator — The pre-launch checklist items that are technically a developer's job, and all five produce output you paste straight into a
<head>or a file at the site root. The SEO Checker audits the result once the page is live.
And if what you actually want is a scratch environment rather than a utility, the 25 browser-based code playgrounds — SQL, Python, Node, React, Git and the rest — run in the same tab with the same no-install promise.
Questions these answer in under a minute
- "Why is this API call returning 401?" JWT Decoder — check
exp,audandissbefore you check anything else. - "What does this response actually contain?" JSON Formatter, or JSON Table Viewer if it's a long array.
- "Does this cron expression do what I think?" Cron Expression Builder — read the next five run times.
- "Is 1735689600 before or after the incident?" Timestamp Converter, in the right time zone.
- "I need types for this payload." JSON → TypeScript.
- "The endpoint isn't built yet." API Mock Generator →
db.json→npx json-server. - "These two files are supposed to be identical." Diff Checker.
- "Does my regex match the edge case?" Regex Tester, with the edge case pasted in.
- "I need 500 IDs for a seed script." UUID Generator, v7 if they'll be primary keys.
Frequently asked questions
Is my data sent to a server?
No. Every tool here processes input in your browser tab using standard JavaScript APIs — the hash and password tools use the browser's built-in SubtleCrypto, which runs natively with no network request at all. That's the whole reason these are safe to use with a real JWT, an internal API response, or a config file with credentials in it. The one deliberate exception is the API Request Generator & Tester: it makes the HTTP request you told it to make, to the endpoint you specified, from your browser — that request is the point of the tool, and it still doesn't route through any server of ours.
Are they really free, with no account or usage limit?
Free, no sign-up, no rate limit, no premium tier. Since the work happens on your machine there's no per-request cost to meter.
Is it safe to paste a production JWT into the decoder?
Into this one, yes — the decoding happens locally and the token never leaves the page. The general habit is still worth keeping: a JWT is a live credential until it expires, and most online decoders do post it to a server. Treat "does this tool upload?" as the first question, not an afterthought.
Can these replace Postman or a full IDE?
For a single request, a quick format, or one lookup — comfortably, and faster. For maintaining a saved collection of requests across environments, or anything with a debugger attached, no, and they're not trying to. The design goal is the two-minute job you'd otherwise open something heavy for.
Do they work offline?
Once a tool's page has loaded, the processing runs locally, so it keeps working on a flaky connection. The obvious exception is the API tester, which needs a network to reach the endpoint you're calling.
Which UUID version should I use?
v4 when you just need randomness. v7 when the IDs will be database keys or sort keys — it's time-ordered, so inserts stay sequential and indexes don't fragment the way random v4 keys do. ULID is a reasonable alternative to v7 if you prefer its shorter, case-insensitive encoding.
Can I use the output commercially?
Yes — generated IDs, schemas, code, configs and formatted output are all yours, free for commercial use, no attribution. Nothing is uploaded, so there's no copy on a server to have rights over.
Keep the tab open
None of these tools is impressive on its own. What makes them worth bookmarking is that the alternative — installing a CLI, opening an IDE, signing up for a service, or pasting a production token into a site that quietly posts it somewhere — costs more than the problem does. Start with the JSON Formatter if you're staring at an unreadable response, the JWT Decoder if auth is failing, or the API Request Generator & Tester if you're about to write a fetch call you haven't proven yet.
Browse the full set at FWD Tools Developer Tools, or the wider collection of free browser-based tools — all free, all local, none of them asking you to sign up.
