1. Debugging APIs and JSON

Most API debugging starts with a wall of minified JSON. Formatting it is step one; the real time savers come after — validating it when a parser rejects it, diffing two responses after a deploy, and turning a sample response into types.

• JSON Formatter – pretty-print and minify
• JSON Validator – find the exact line a parser chokes on
• JSON Diff Checker – compare two API responses
• JSON to TypeScript Interface – types from a sample payload
• cURL to Code Converter – turn a cURL command into Python, JS and more
• HTTP Status Code Lookup

2. Tokens, encoding and hashes

When auth breaks, the first question is usually "what's actually inside this token?"

• JWT Parser – decode header and payload, check exp
• Base64 Encoder / Decoder
• URL Encoder / Decoder
• HMAC Generator – verify webhook signatures
• SHA256 Hash Generator
• UUID Generator and ULID Generator

3. Frontend: CSS, colour and markup

• CSS Clamp() Generator – fluid typography without media queries
• Color Contrast Checker – WCAG AA/AAA check
• HTML to JSX Converter
• CSS Gradient Generator and Box Shadow Generator

4. Regex, text and data conversion

• Regex Tester – live matches and capture groups
• Timestamp Converter – Unix epoch ↔ human dates
• CSV to JSON and YAML to JSON
• SQL Formatter
• Markdown Table Generator

5. Config files for deploying your app

Boilerplate is where small typos cost the most time. Generate a sane starting point, then tweak.

• Dockerfile Generator and Docker Compose Generator
• GitHub Actions Workflow Generator
• Nginx Config Generator
• YAML Validator and .env File Validator
• .gitignore Generator

6. Servers, scheduling and networking

• Cron Expression Parser – "when does */15 2-5 * * 1 actually run?"
• systemd Timer Generator
• Chmod Calculator
• IPv4 Subnet Calculator
• SSH Config Generator

7. Security checks before you launch

• HTTP Security Headers Checker
• Content Security Policy Generator
• File Checksum Verifier

When a browser tool is the wrong choice

Browser tools shine for one-off checks — one token, one response, one config file. If the same job repeats, or the file is too big to paste, reach for a CLI (jq, openssl, yq) so you can script it and run it in CI.

And one rule that applies everywhere: don't paste live production secrets into any website. Use test tokens and redacted values, and rotate a credential if you're unsure where it's been.

This is a condensed version. The full guide — with a worked example for each group — is on the Online Toolkit Hub blog: Free Online Tools Every Web Developer Should Know in 2026. You can browse all 72 developer tools here, or explore the full set of 260+ free tools at onlinetoolkithub.com.