Developer guides from the workbench.
Practical, no-fluff guides on JSON, regex, JWTs, DNS, SSL, and email authentication, the things developers debug every day, written alongside the free tools that fix them.
Can you use comments in JSON? No, and here is what to do
JSON does not support comments by design. Why Douglas Crockford removed them, what error you get, and the real options: JSONC, JSON5, dummy keys, or a different format.
JSON Formatter & ValidatorHow to flush your DNS cache on any system
The exact commands to clear the DNS cache on macOS, Windows, and Linux, plus the browser's hidden cache, when flushing actually helps, and why it cannot speed up propagation.
DNS Propagation CheckerHTTP/1.1 vs HTTP/2 vs HTTP/3: what actually changed
What each HTTP version changed and why: head of line blocking, multiplexing, header compression, and why HTTP/3 abandoned TCP for QUIC. Plus how to check which version your site uses.
HTTP Header CheckerSymmetric vs asymmetric encryption, explained properly
How symmetric and asymmetric encryption differ, why real systems always use both together, and where AES, RSA, and elliptic curves fit, from TLS to password managers.
Encrypt / Decrypt TextWebSockets vs HTTP: when a request is not enough
How WebSockets work under the hood, the upgrade handshake, when they beat polling and SSE, and the operational costs of holding a connection open, with honest guidance on when plain HTTP wins.
API TesterCache-Control explained: no-cache, no-store, max-age
How HTTP caching actually works: what each Cache-Control directive does, why no-cache does not mean what it sounds like, ETags and revalidation, and recipes for assets, HTML, and APIs.
HTTP Header Checkercurl cheat sheet: the commands you actually need
A practical curl reference: GET and POST requests, sending JSON, auth headers, following redirects, saving files, inspecting TLS, and the flags that make debugging APIs fast.
API TesterREST vs GraphQL: an honest comparison
How REST and GraphQL actually differ in practice: overfetching, N+1 queries, caching, error handling, and versioning, with clear guidance on when each approach earns its complexity.
API TesterISO 8601 explained: the only date format worth using
How ISO 8601 dates work: the syntax, what the Z and offsets mean, why the format sorts correctly as text, and the JavaScript parsing pitfalls that still catch people.
Timestamp ConverterWhat is localhost? 127.0.0.1 and 0.0.0.0 explained
What localhost and 127.0.0.1 really are, why 0.0.0.0 is not an address you visit, why a server on 0.0.0.0 is reachable from other devices, and how to fix the classic loopback confusions.
IPv4 Subnet CalculatorCommon network ports: the numbers worth memorizing
What ports are, how well known, registered, and ephemeral ranges work, and a reference table of the port numbers you meet in real work, from SSH and HTTPS to Postgres and Redis.
IP Address LookupWhere to store JWTs: localStorage vs cookies
The real tradeoff between localStorage and httpOnly cookies for JWT storage: XSS vs CSRF, what each attack can actually do, and the pattern most production apps should use.
JWT DecoderXML vs JSON: differences, and when XML still wins
A practical comparison of XML and JSON: syntax, data model, schemas, namespaces, and performance, plus the shrinking but real set of cases where XML is still the right choice.
XML FormatterMD5 vs SHA-1 vs SHA-256: which hash should you use?
Why MD5 and SHA-1 are broken for security, where they are still fine, and why SHA-256 is the default. Collision attacks explained in plain language, with guidance per use case.
Hash GeneratorRegex cheat sheet: the patterns you actually use
A practical regular expression reference: character classes, quantifiers, anchors, groups, and flags, plus ready to use patterns for emails, URLs, dates, and numbers.
Regex TesterHow to check how strong a password really is
What password strength actually measures, why length beats symbol checklists, how crack-time estimates work, and why a checker must run locally in your browser.
Password Strength AnalyzerConvert CSV to JSON: headers to keys, rows to objects
How a CSV file maps to a JSON array of objects, what happens to types along the way, and the quoting, empty cell, and BOM traps that break naive conversions.
JSON ↔ CSV ConverterHEX, RGB, and HSL: how to convert colors between formats and when to use each
What HEX, RGB, and HSL actually represent, how conversion between them works, how alpha fits in, and the shorthand and rounding gotchas that trip people up.
Color Converter & Contrast CheckerHow to convert text between cases: UPPERCASE, camelCase, snake_case, and the rest
How to convert text between UPPERCASE, lowercase, Title Case, camelCase, snake_case, and kebab-case, plus the gotchas with acronyms, numbers, and separators.
Case Converter & SlugifyConvert a Unix timestamp to a date (and back) without the 1970 bug
How to turn a Unix timestamp into a readable date and a date back into a timestamp, spot seconds versus milliseconds, and handle timezones correctly.
Timestamp ConverterHow to generate a SHA-256 hash of any text
How to hash a string with SHA-256, SHA-1, or SHA-512, what a digest actually is, where hashes are useful, and why hashing is not for passwords or encryption.
Hash GeneratorHow to generate UUIDs online, one at a time or in bulk
What a UUID is, how the version 4 format works, why collisions are not a practical worry, and how to generate one UUID or hundreds at once in your browser.
UUID & Token GeneratorParse a URL into its parts: scheme, host, path, query, and fragment
How to break any URL into scheme, host, port, path, query, and fragment, read query string parameters correctly, and avoid the gotchas that skew results.
URL Encoder & ParserSlugify a title: how to turn any string into a clean URL slug
What a URL slug is and how to make one: lowercase, hyphens for spaces, strip punctuation, transliterate accents, plus edge cases like duplicates and length.
Case Converter & SlugifyURL-safe Base64 (base64url): what it is and how to encode and decode it
What base64url is, how it differs from standard Base64, why + / and = break URLs, and how to convert and decode it, including the padding rules JWTs rely on.
Base64 Encode / DecodeGET vs POST vs PUT vs PATCH: HTTP methods explained
What each HTTP method actually means, which ones are safe and idempotent, when to use PUT versus PATCH, and the practical differences that matter when building or calling an API.
API TesterHTTP vs HTTPS: what the S actually changes
The real differences between HTTP and HTTPS: what TLS encrypts and what it does not, ports 80 and 443, certificates, SEO impact, and how to move a site to HTTPS without breaking it.
SSL CheckerPublic vs private IP addresses: ranges, NAT, and how to tell which is which
The difference between public and private IP addresses, the exact private ranges to memorize, how NAT connects the two, and how to find both of your addresses right now.
IP Address LookupRegex for email validation: the pattern that actually works
A practical email regex for JavaScript, Python, and HTML, why the fully RFC-compliant pattern is a trap, and what validation regex can and cannot promise about an address.
Regex TesterSQL joins explained: INNER, LEFT, RIGHT, and FULL with examples
Every SQL join type explained with the same two small tables: INNER, LEFT, RIGHT, FULL OUTER, CROSS, and self joins, plus the NULL traps and row multiplication mistakes that catch everyone.
SQL FormatterTCP vs UDP: differences, ports, and when each one wins
How TCP and UDP actually differ, what reliability and ordering cost, which protocols and ports use each, and why DNS, gaming, and HTTP/3 choose UDP while the web long chose TCP.
DNS LookupHow to check MX records, and what they actually mean
What MX records do, how to read priorities, the common reasons mail fails to deliver, and how to check a domain's mail servers in seconds.
MX LookupConvert SSL certificate formats: PEM, DER, PKCS#12, and PKCS#7
What PEM, DER, PKCS#7, and PKCS#12 actually are, which servers expect which, and how to convert between them without mangling the key.
SSL ConverterDoes my private key match my SSL certificate? How to check
Why a key and certificate must match, the modulus check that proves it, what the mismatch error looks like, and how to verify the pair safely.
Key MatcherEmbedding images as Base64 data URIs: when it helps and when it hurts
How data URIs inline an image directly into HTML or CSS, the real trade-offs in size and caching, and when embedding beats a normal image request.
Image to Base64Certificate Transparency logs: find every certificate issued for your domain
What CT logs are, why every public certificate is recorded in them, and how to use them to catch unexpected or unauthorized certificates for your domain.
CT Log LookupA secure nginx SSL config, explained directive by directive
The TLS directives that actually matter in an nginx server block: protocols, ciphers, HSTS, OCSP stapling, and the redirect, with what each one does.
Nginx Config GeneratorDomain Control Validation: proving you own a domain for SSL
The three ways a certificate authority checks you control a domain before issuing a cert: HTTP, DNS, and email, plus when to use the DNS alternative.
Alt DCV CheckerWhich CA signed this certificate? Verifying the issuer chain
How certificate signing works, why the issuer and the CA must match cryptographically, and how to confirm a CA actually signed a given certificate.
CA MatcherOCSP and certificate revocation: how browsers check a cert is still valid
Why certificates need a revocation mechanism, how OCSP and CRLs work, what OCSP stapling fixes, and how to check a certificate's revocation status.
OCSP CheckerRSA key formats: PKCS#1 vs PKCS#8 vs SPKI
What the different RSA key encodings mean, how to tell them apart from their PEM headers, which tools expect which, and how to convert safely.
RSA Key ConverterWhat happens when you type a URL and press enter
The full journey from a typed address to a rendered page: DNS, TCP, TLS, the HTTP request, and the response. A clear walk through every developer should know.
DNS LookupHow to decode an SSL certificate or CSR and read its fields
What is encoded inside a PEM certificate or CSR, the fields that matter most, and how to decode and inspect them without uploading anything.
SSL & CSR DecoderERR_SSL_VERSION_OR_CIPHER_MISMATCH: what it means and how to fix it
Chrome throws ERR_SSL_VERSION_OR_CIPHER_MISMATCH when the browser and server share no common TLS version or cipher. The usual causes and the fixes.
SSL CheckerIPv4 vs IPv6: what changed and why it matters
Why the internet ran out of IPv4 addresses, how IPv6 fixes it, what the addresses actually look like, and what you need to know as a developer.
IP Address LookupHow to monitor SSL certificate expiry across many domains
Why expired certificates still cause outages, what to track beyond the expiry date, and how to check many hosts at once before one lapses.
Bulk SSL CheckerWe checked SPF and DMARC on 21 well-known SaaS domains: here's what we found
A reproducible snapshot of the email authentication posture of 21 well-known SaaS companies. Everyone publishes SPF and DMARC, but a quarter still stop short of enforcement.
DMARC Record GeneratorBIMI: how to get your logo to show next to your emails
What BIMI is, why it requires DMARC enforcement first, what a VMC certificate adds, and how to publish and check a BIMI record.
BIMI Record CheckerDMARC p=reject is bouncing legitimate email: how to find and fix the gap
When you move DMARC to p=reject, real mail can start bouncing because a sending source was never aligned. How to find the source and fix it without disabling DMARC.
DMARC Record GeneratorAn email deliverability checklist: why your mail lands in spam
The DNS and authentication records that decide whether your email reaches the inbox, in the order to check them, from SPF and DKIM to reverse DNS.
Email Health (SPF, DKIM, DMARC)The TLS handshake explained, step by step
How a browser and server agree on encryption before sending any data: certificates, key exchange, cipher suites, and what TLS 1.3 made faster.
SSL CheckerDNS propagation explained: why your change isn't live everywhere yet
Why a DNS change shows up in some places before others, how TTLs control the delay, and how to read a propagation checker when resolvers disagree.
DNS Propagation CheckerHow text diff works: line, word, and character comparisons
What a diff algorithm actually computes, the difference between line and word diffs, how to read a unified diff, and when each view is most useful.
Text Diff CheckerHow VPN and proxy detection works (and why you got flagged)
What a VPN detector actually checks: ASN and datacenter ranges, known provider lists, protocol probes, and reputation signals, plus how to read a verdict and dispute a false positive.
VPN & Proxy DetectorSPF PermError: too many DNS lookups, and how to get back under 10
SPF allows a maximum of 10 DNS lookups. Cross it and your record returns PermError and stops authenticating mail. How to count, flatten, and stay under the limit.
SPF Record GeneratorWhy is my IP blacklisted, and how to get it removed
What DNS blacklists are, the common reasons an IP lands on one, how to check which lists flag you, and the right way to request delisting.
Blacklist CheckWireGuard vs OpenVPN: what goes in a client config file
How the two main VPN protocols differ, what each field in a client config means, and how to generate a working configuration without guesswork.
VPN Config GeneratorNET::ERR_CERT_AUTHORITY_INVALID: why the browser does not trust your certificate
Chrome shows NET::ERR_CERT_AUTHORITY_INVALID when it cannot build a trusted path to a root CA. Self-signed certs, missing intermediates, and untrusted roots explained.
SSL CheckerJSON vs TOML: choosing a config format, and converting between them
The strengths and weaknesses of JSON and TOML for configuration, why TOML exists, and how to convert between the two without losing structure.
JSON ↔ TOML ConverterWhat is lorem ipsum, and why placeholder text is still Latin
Where lorem ipsum comes from, why designers use scrambled Latin instead of real copy, and when placeholder text helps a layout and when it misleads.
Lorem Ipsum GeneratorWHOIS and domain lookups: what the records tell you
What a WHOIS lookup reveals about a domain, how registration and expiry data works, why privacy protection hides owners, and how to read the results.
Domain Registration LookupDKIM signature did not verify: the causes, in order of likelihood
A DKIM signature fails for a handful of concrete reasons: a missing or wrong public key, body changes in transit, the wrong selector, or a key that is too short. How to find which.
DKIM Record GeneratorHTTP headers explained: the metadata behind every request
What request and response headers do, the ones that matter most for caching, security, and content type, and how to inspect the headers a server actually returns.
HTTP Header CheckerWord count, reading time, and readability: what text statistics tell you
How word and character counts, reading time, and readability scores are calculated, what each is good for, and where the numbers mislead.
Text Statistics & Word Counter301 vs 302 redirects: which to use, and why SEO cares
The difference between a 301 permanent and 302 temporary redirect, how each affects SEO and caching, and when 307 and 308 are the right choice instead.
HTTP Status Codestoolhq vs FreeFormatter: formatting XML and more in the browser
FreeFormatter is a broad, long running set of formatters and validators. toolhq does the common XML and JSON jobs entirely in your browser. A fair, focused comparison.
XML FormatterWhat's inside a CSR, byte by byte
A certificate signing request is a small ASN.1 structure: a subject, a public key, optional attributes, and a self-signature. A field-by-field walk through what it contains and why.
CSR GeneratorA record vs CNAME: when to use each
The difference between an A record and a CNAME, why you cannot put a CNAME at the domain root, and how to choose the right one for each hostname.
DNS Lookuptoolhq vs regex101: quick regex testing vs a full debugger
regex101 is a best in class regex debugger with explanations and multiple flavors. toolhq is for fast, distraction free testing. Here is when to reach for each one.
Regex TesterAES-256-CBC vs AES-256-GCM: which mode, and why
The difference between AES in CBC and GCM modes, why GCM's built-in authentication matters, and which to choose for new encryption work.
Encrypt / Decrypt TextReverse DNS and PTR records explained
Reverse DNS maps an IP address back to a hostname using PTR records. Learn the in-addr.arpa zone, why mail servers check it, and how FCrDNS works.
Reverse DNS (PTR Lookup)Fixing SSL certificate chain errors: valid in the browser, broken everywhere else
Why a site can look fine in Chrome while curl fails with unable to get local issuer certificate: missing intermediates, AIA fetching, and the fullchain.pem fix.
SSL CheckerHow to read email headers: tracing a message hop by hop
Where to find raw headers in Gmail, Outlook, and Apple Mail, how to read the Received chain from the bottom up, and what Authentication-Results actually proves.
Email Header AnalyzerSPF, DKIM, and DMARC explained: what each one actually verifies
What SPF, DKIM, and DMARC each prove, why no single one stops spoofing on its own, the record mistakes that break delivery, and a minimal correct setup.
DMARC Record Generatortoolhq vs jwt.io: decoding tokens without sending them anywhere
How toolhq's JWT decoder compares to jwt.io. Both decode in the browser, both are free, and one rule matters most: never paste a production token into a tool you do not trust.
JWT DecoderUnderstanding DMARC aggregate reports: what the XML is telling you
Why DMARC rua reports arrive as zipped XML, how to read the records inside, what alignment actually means, and when it is safe to move from p=none to reject.
DMARC Report ViewerHTML entities: when and how to encode them
Which characters must be escaped in HTML, named versus numeric entities, how encoding prevents broken markup and a class of XSS, and when you can skip it.
HTML Entity Encoder / DecoderCommon MIME types every developer should know
A clear reference to MIME types: what they are, how the Content-Type header works, the charset parameter, and why the wrong type breaks downloads and rendering.
MIME Type Lookuptoolhq vs IT Tools: two browser-first toolboxes compared
IT Tools is an excellent open source, self hostable toolbox. toolhq is a polished hosted set. An honest comparison through the lens of UUID and token generation.
UUID & Token GeneratorHow to format SQL queries for readability
Why consistent SQL formatting speeds up review and debugging, the conventions worth adopting, and a before and after example that changes only whitespace, not results.
SQL FormatterEncrypting text in your browser with AES
What AES encryption actually protects, why your passphrase carries the security, and how client side encryption keeps plaintext off every server you touch.
Encrypt / Decrypt TextUnix timestamps and epoch time explained: seconds, milliseconds, and the 2038 problem
What a Unix timestamp actually counts, why some are ten digits and some are thirteen, how time zones fit in, and the gotchas that cause off-by-1000 and off-by-a-lifetime bugs.
Timestamp ConverterCIDR notation and subnetting explained: what /24 actually means
How to read CIDR notation, work out how many addresses a subnet holds, find the network and broadcast addresses, and stop guessing when you write a firewall or VPC rule.
IPv4 Subnet Calculatortoolhq vs CyberChef: when you want simple over a full workbench
CyberChef is a powerful client side workbench for chained operations. toolhq is for the quick single task. Here is when each one is the right call.
Base64 Encode / DecodeHow to verify webhook signatures with HMAC
Webhook endpoints are public, so anyone can POST to them. Learn how HMAC signatures prove a payload came from the real provider and how to verify them.
HMAC GeneratorCSS easing and cubic-bezier curves, made intuitive
What an easing function is, what the built-in keywords actually do, and how the four numbers in cubic-bezier map to a curve, including overshoot with values above one.
Cubic Bezier GeneratorUnderstanding chmod and Unix file permissions: what 755 and 644 actually mean
How Unix permissions are structured, how to read and write the octal numbers behind chmod, and the safe defaults for files, scripts, directories, and SSH keys.
Chmod CalculatorConverting between binary, hex, and decimal
Understand number bases the practical way: how binary, hex, and decimal relate, why hex maps cleanly onto bytes, and how to convert by hand reliably.
Number Base ConverterHow to format JSON without uploading it anywhere
Most online JSON formatters upload what you paste. Here is how to format and validate JSON locally, why it matters for secrets, and how to verify nothing leaves your browser.
JSON Formatter & ValidatorHow TOTP authenticator codes work: the math behind the 6 digits
Why the codes in Google Authenticator and Authy change every 30 seconds, how the server verifies them offline, and what the QR code you scan actually contains.
TOTP Code Generatortoolhq vs CodeBeautify: a privacy-first take on online dev tools
How toolhq and CodeBeautify compare for everyday JSON work, where each one fits, and why a browser only formatter changes how your data is handled.
JSON Formatter & ValidatorURL encoding explained: why spaces become %20 and when you need it
What percent-encoding is, which characters are reserved, the difference between encodeURI and encodeURIComponent, and how to stop breaking query strings and redirects.
URL Encoder & ParserCSS gradients explained: linear, radial, and conic
How linear, radial, and conic gradients work in CSS, from angles and color stops to hard stops for stripes and layering multiple gradients in one background.
CSS Gradient GeneratorConvert YAML to JSON and back: the rules that trip people up
YAML and JSON map onto each other, mostly. The gotchas: indentation, types, the Norway problem, anchors, and multi-document files, with how each one converts.
YAML ↔ JSON ConverterHow to debug webhooks: see what Stripe, GitHub, and others actually send
Webhook integrations fail silently because you cannot see the request. Here is how to capture and inspect real webhook payloads before writing your handler.
Webhook InspectorCORS errors explained: why your API request works in curl but fails in the browser
The request works in curl and Postman but the browser says CORS error. What CORS actually is, why it exists, and how to fix it on the server.
API TesterHow to read an SSL certificate: subject, SAN, chain, and expiry
What the fields in a TLS certificate mean, how the chain of trust works, why the SAN matters more than the common name, and how to catch the problems before your users do.
SSL CheckerWhen to use SHA-256 vs HMAC vs bcrypt
Three things people reach for interchangeably and should not. What a hash, a MAC, and a password hash each guarantee, and which to use for integrity, authentication, and storing passwords.
Hash GeneratorWhat is actually inside a JWT, and why you can read it without the secret
JSON Web Tokens look like random strings but they are readable by anyone. What the three parts contain, what the signature does, and what JWTs cannot do.
JWT DecoderHow strong is your password really? Entropy explained
Password strength is not about symbols, it is about entropy. How entropy is calculated, why length beats complexity, and what crack-time estimates actually mean.
Password Strength AnalyzerGenerate TypeScript types from JSON: stop hand-writing interfaces
Why turning a real API response into TypeScript interfaces beats writing them by hand, how optional and nullable fields are inferred, and where generated types still need a human.
JSON to TypeScriptWhat every HTTP status code actually means
A practical guide to HTTP status codes by class: when to send each common one, the ones people misuse (401 vs 403, 400 vs 422), and what clients should do with them.
HTTP Status CodesHow to safely share logs and API keys in a bug ticket
Pasting logs into a ticket leaks tokens, emails, and internal hosts. How to redact sensitive values consistently before you share, and what attackers do with what leaks.
Encrypt / Decrypt TextcamelCase, snake_case, kebab-case, PascalCase: which goes where
A practical guide to the naming conventions you meet daily, why each ecosystem settled on its own, and how to convert between them without introducing bugs.
Case Converter & SlugifyReading a user-agent string: a field-by-field guide
User-agent strings look like noise but follow a pattern. How to read browser, engine, OS, and device out of one, and why they are full of legacy lies.
User-Agent ParserJSON to CSV: turn an API response into a spreadsheet
How to convert a JSON array into clean CSV for Excel or Sheets, including the escaping rules and what happens to nested objects and missing fields.
JSON ↔ CSV ConverterHow to fix "Unexpected token" JSON errors
Unexpected token errors mean your JSON breaks one of five rules. Here is how to find the exact character that breaks parsing and fix it fast.
JSON Formatter & ValidatorGenerate QR codes that never leave your browser
Most QR generators send your URL to a server and some add tracking redirects. How client-side QR generation works and why it matters for private links.
QR Code GeneratorOpen Graph tags: how to control how your links look when shared
The handful of meta tags that decide the title, description, and image when your page is shared on Slack, X, LinkedIn, and iMessage, plus the image rules that actually matter.
Open Graph Meta GeneratorMarkdown to HTML: a practical reference
The Markdown syntax that converts cleanly to HTML, the parts that vary between flavors, and how to preview the rendered output as you write.
Markdown PreviewerCron expressions explained with 12 real examples
Cron syntax in five minutes: what each field means, 12 copy paste examples from every minute to quarterly, and the day-of-week trap everyone hits.
Cron GeneratorUUID v4 vs v7: which should you use for database keys?
Random UUIDs fragment database indexes, time ordered ones do not. When v4 is fine, when v7 is better, and why auto increment integers still have a place.
UUID & Token GeneratorRegex lookahead and lookbehind, explained simply
Lookarounds let a regex check what comes before or after a match without consuming it. The four types, real examples, and when not to use them.
Regex TesterDNS records explained: A, AAAA, CNAME, MX, TXT, and NS
What each DNS record type does, how to check them, and how to debug the classic problems: propagation delays, wrong CNAMEs, and failing email.
DNS LookupWCAG color contrast: what AA and AAA actually require
The contrast ratios WCAG requires for text, what counts as large text, which elements are exempt, and how to check your colors in seconds.
Color Converter & Contrast CheckerBase64 is not encryption: what it is and when to use it
Base64 hides nothing. What encoding actually does, where Base64 shows up in web development, and the security mistakes it causes.
Base64 Encode / Decode