Online tools for developers

This category is for the small utilities you reach for in the middle of debugging something else: what is actually in this string, how many bytes is this really, why do these two values compare as unequal. They run in your browser, which for this particular set of tools is not a marketing point but a working requirement.

Why a developer tool specifically should not upload

Think about what actually gets pasted into online developer utilities during an incident. Production log lines. A JWT with a real subject claim in it. A row from a customer table. A signed URL. A filename from a system that is currently failing. An API response with an internal identifier. None of that is intended to leave the building, and all of it routinely does, because the reflex to be careful does not fire for a paste box.

The remedy is architectural rather than a promise. Everything in this category is computed by JavaScript in the tab you already have open. The Content-Security-Policy this site sends restricts network connections to our own origin, and your browser enforces that regardless of what our code attempts. You can verify it in about twenty seconds: open the Network tab and paste, or disconnect the network entirely and reload — the tools keep working, because they never needed a server.

What is here now

The Unicode character inspector breaks any text down one code point at a time: the U+ value, the exact UTF-8 byte sequence, the UTF-16 units, the general category and script, the East Asian width, and whether the character is one of the ones that renders as nothing at all. It also reports the code point count after NFC and NFKC normalisation, which is the fastest way to see whether two visually identical strings are actually the same data.

It is the tool for a specific class of bug: a comparison that fails on strings that look identical, a de-duplication that leaves duplicates, a database insert that rejects a value the length check accepted, a filename from a Mac that will not match the same filename from Windows. Those are almost always an invisible character, a surrogate pair, or two different normalisation forms of the same word — and all three are visible immediately in the character-by-character table.

Bytes, code units and characters are three different limits

The single most common source of confusion in text handling is that these three are used interchangeably in conversation and are not interchangeable in practice. A VARCHAR column declared in characters usually counts UTF-16 code units. A column declared in bytes counts UTF-8 bytes, and one CJK character is three of those, four for the rarer extension ideographs. A maxlength attribute counts code units. A QR code has a byte budget. An HTTP header limit is in bytes. A translation quote is in characters excluding spaces.

So "this field takes 20 characters" is not one specification, it is at least three, and which one applies determines whether a Chinese name fits. The tools here report all of them side by side rather than picking one and hoping it is the one you meant.

What is coming, and what we will not do

Formatters and validators for JSON, XML and YAML, encoders and decoders for Base64, URL and HTML entities, hash and UUID generators, a regular expression tester and a cron expression explainer are all planned for this category. Each one will be added the same way: local computation, an honest statement of what the method cannot do, and no dependency whose licence would be a problem for a site that carries advertising.

What we will not do is add a tool that requires sending your input to a server and describe it as private, and we will not add a paste box that quietly stores what you typed in order to give you a shareable link. Where a tool genuinely cannot work locally — anything that has to make a request out to the internet on your behalf — it gets the connection badge and a plain statement of exactly what was sent.