Developer tools that do not phone home
Format, validate, convert, encode and decode. Every tool here runs entirely in your browser, which means you can paste a production payload into one without it touching a server.
# no. nothing is uploaded.
$ tools run locally in your tab
$ 31 tools here · 150+ site wide
JSON, YAML, XML, CSV, and when each one earns its place
Half the converters on this page exist because a system that speaks one format has to talk to a system that speaks another. Here is what you actually gain and lose in each direction.
| Format | Comments | Types | Nesting | Best at | Worst at |
|---|---|---|---|---|---|
| JSON | No | Yes | Yes | APIs, config, anything machine to machine | Human editing, no comments allowed by spec |
| YAML | Yes | Yes | Yes | Config humans edit by hand | Whitespace sensitivity, and the Norway problem |
| XML | Yes | Via schema | Yes | Documents, mixed content, strict validation | Verbosity, attribute versus element ambiguity |
| CSV | No | No | No | Tabular data, spreadsheets, bulk import | Anything nested, and quoting edge cases |
| TOML | Yes | Yes | Shallow | Flat application config | Deeply nested structures get awkward fast |
The Norway problem is worth knowing if you touch YAML. In the 1.1 spec, the unquoted value NO parses as boolean false, which broke country code lists for years. YAML 1.2 fixed it, but plenty of parsers still default to 1.1 behaviour. When a YAML value must be a string, quote it.
CSV has a similar reputation for being simple and is not. There is no single specification, only RFC 4180 describing common practice. Delimiters vary by locale, quoting rules differ between exporters, and a leading equals sign or plus can trigger formula execution when the file opens in a spreadsheet.
Four encodings people mix up constantly
These do completely different jobs and none of them is encryption. If you are reaching for one to hide something, you want the security tools instead.
↓
SGVsbG8sIHdvcmxkIQ==
Turns arbitrary bytes into 64 safe ASCII characters so binary survives a text channel. Grows the payload by roughly a third. Fully reversible by anyone.
↓
a%20b%26c%3Dd
Makes text safe inside a URL. Use encodeURIComponent for values and encodeURI for a whole URL, never the other way round.
↓
<script>
Stops markup being parsed as markup. This is the escaping that prevents cross site scripting when untrusted text lands in a page.
↓
315f5bdb76d0…
One way by design. You cannot decode a hash, only compare one against another. Used for integrity checks and fingerprints, not storage you need back.
The distinction that matters: the first three are reversible transformations anyone can undo, and the fourth is deliberately not. Base64 in particular gets mistaken for security constantly. A JWT payload is Base64, which is exactly why anyone holding the token can read every claim inside it.
The specs these tools implement
Where behaviour is defined by a standard rather than a preference, these tools follow the standard. Worth bookmarking when you need to settle an argument.
- RFC 8259The JSON data interchange format. Short enough to read in one sitting, and it settles most JSON arguments including trailing commas and duplicate keys.
- RFC 4648Base16, Base32 and Base64 encodings, including the URL safe alphabet that swaps plus and slash for minus and underscore.
- RFC 3986Uniform Resource Identifier syntax. Defines exactly which characters are reserved and which need percent encoding.
- RFC 7519JSON Web Token, plus the IANA claims registry that names
iss,sub,aud,expand the rest. - RFC 4122UUID specification, now superseded by RFC 9562 which adds the time ordered versions 6, 7 and 8.
- YAML 1.2YAML Ain’t Markup Language. Version 1.2 is a strict superset of JSON, which is why every JSON document is also valid YAML.
- JSON SchemaThe vocabulary for annotating and validating JSON, used by the schema validator on this page.
- POSIX croncrontab specification, the five field baseline before Quartz and systemd added their own extensions.
The rest of the toolbox
Everything else on ConvertNow, free and growing.
Deep dives on the things these tools touch
Minification, UUID collisions, diffing API responses, and the other questions that come up around this toolset.
Questions developers actually ask us
Straight answers on safety, limits and which spec we follow.
Is it safe to paste a real JWT or production API response?
Do these tools work offline?
Is Base64 a form of encryption?
Which JSON specification do you follow?
Why does my YAML value NO turn into false?
NO, which famously broke country code lists. YAML 1.2 fixed it, but many parsers still default to 1.1 behaviour. Quote any value that must stay a string.Is there a size limit on what I can paste?
Which UUID version should I use?
Why does the minifier output differ from my build tool?
Why local execution matters more here than anywhere else
Developers paste real things into these tools. Access tokens, production payloads, connection strings, customer records in a CSV. That is the whole reason none of it leaves the tab.
