Topic
Developer Utilities That Run Locally
Six small utilities for the jobs that interrupt other work: format some JSON, test a pattern, decode a string, see what changed, check a download, fix a spreadsheet. What they have in common is that they run in the tab and send nothing, which matters more for this category than most people pause to consider.
Reviewed 3 September 2026
What you are actually pasting
Think about what is in the JSON you paste into a formatter when something is broken. It is usually a real API response, from a real environment, and it often carries a bearer token, a session identifier, an internal hostname, a customer's email address, an order. The CSV you paste into a viewer is frequently an export of real people.
The tool does not have to be malicious for that to matter. It only has to log requests, which is the default for almost every web server ever configured. Your production token is then in somebody's access log, and neither of you intended it.
This is the least glamorous privacy argument on the site and probably the most concrete: the safest place to paste a production payload is somewhere it cannot be transmitted.
Which one you want
JSON that will not parse: the formatter names the line and column of the failure, which is usually faster than reading it yourself. A pattern that does not match what you expect: the regex tester, which runs the JavaScript engine specifically — flavours differ, and a pattern that works in PCRE may not here. Something base64 that needs looking at, or a string that needs encoding: the base64 tool.
Two files that should be the same and are not: the diff checker. A download that should match a published hash: the checksum verifier, which reads the file locally rather than sending it anywhere — the entire point of verifying a download. A CSV with the wrong delimiter, a broken encoding or a column in the wrong place: the CSV editor.
Checking the claim rather than believing it
Open developer tools, switch to the Network tab, clear it, and use any of these. A tool that sends your data shows a request with a body carrying it. These show nothing after the page itself has loaded.
The stronger version takes ten seconds: load the page, disconnect from the network, and keep working. Anything that still functions offline cannot be sending your input anywhere. This site has a page walking through both checks, and it is written so it works on any site, not only this one — a claim you can only verify on the site making it is not worth much.
Tools in this topic
Common questions
Do these work offline?
Yes, once the page has loaded. That is the simplest proof that nothing is being transmitted: a tool that needed a server would stop working the moment you disconnected. It is also genuinely useful on a plane or a bad connection.
Which regex flavour does the tester use?
JavaScript, running in your own browser's engine — not a server-side emulation of it. That matters because flavours differ: lookbehind, named groups and some Unicode property escapes behave differently across engines, so a pattern verified against PCRE may not behave the same in a browser.
Regex Tester →Is it safe to paste a production API response?
Into these, yes, in the sense that the data does not leave your device and you can verify that with the Network tab. As a habit it is still worth redacting tokens before pasting anything anywhere, because the next tool you reach for may not work this way.
JSON Formatter →