About DevDecoder

A small set of developer tools that never phone home.

What this site is

DevDecoder is a free, browser-based collection of everyday developer utilities: encoding and decoding in six formats, cryptographic hash generation, JWT inspection, JSON formatting, regex testing, and small helpers like a UUID generator and Unix timestamp converter. The site exists to fill a gap that most "online tools" sites leave wide open — they ask you to paste sensitive content into a text box and then silently send it to a server you know nothing about.

Why it's all client-side

When a developer reaches for a JWT decoder or a hash generator, the input is often sensitive: a production access token, an API response that contains customer data, a candidate value for a key derivation. Pasting that into a remote service is a small, compounding risk: it ends up in server logs, in DDoS protection caches, in analytics pipelines, and in the memory of whatever LLM the site decides to wire up next year.

DevDecoder solves this by not having a server. There is no backend. There is no database. There is no request for your input to leave your machine. Every tool is implemented in plain JavaScript and runs in your browser, using standard Web APIs:

Hashes (SHA-1 / SHA-256 / SHA-384 / SHA-512) are computed with the browser's native SubtleCrypto API.
MD5, which isn't part of SubtleCrypto, uses a client-side build of CryptoJS.
UUIDs come from crypto.getRandomValues — the browser's CSPRNG.
Base64, URL, HTML entity, hex, binary, ROT13, JSON, regex, and case conversion are all pure string operations.

Open your browser's DevTools, switch to the Network tab, and use any of the tools. You'll see page assets load (HTML, CSS, JavaScript, fonts, the AdSense script). After that, no request fires when you hit "Encode" or paste a JWT — the tool logic itself never contacts a server. Background requests from the AdSense script are disclosed on the Privacy Policy.

How it's funded

DevDecoder is maintained as a side project and is hosted on Cloudflare Pages, so it's fast globally and cheap to run. Ads are served through Google AdSense to cover the domain and any future infrastructure costs — the ads are purely Google-served, DevDecoder has no access to anything Google learns about you, and none of your tool input is ever shared with them.

What's here, and why the list is short

The tool list is intentionally narrow. Adding tools that aren't routinely useful would just dilute the site. New additions are evaluated against three criteria: (1) is this genuinely useful to day-to-day development, (2) can it run entirely in the browser without exotic dependencies, and (3) is there a meaningful educational angle that makes the page worth reading.

Suggestions for additional tools are welcome on the contact page.

How the site is built

There is no framework. DevDecoder is hand-written HTML, CSS, and vanilla JavaScript. No React, no Vue, no Svelte, no Tailwind, no build step. This is deliberate: it keeps the page fast to load, easy to audit, and cheap to maintain. The entire front end is a single HTML file plus one CSS file plus one JS file. Total weight at rest is well under 100 KB.

Routing is handled by a small Cloudflare Pages function that rewrites per-tool page titles and meta descriptions for SEO, while still serving a single-page application shell to the browser. Legal and content pages (privacy, terms, this page, and the guides) are plain static HTML.

Trust, in a paragraph

You shouldn't have to trust any tool site to not leak your data. The right thing is to make trust unnecessary — by not having a server that could leak anything in the first place. That's the shape of DevDecoder. If you want to verify it, the Network tab in your browser will tell you the same story.