Free Online Text & Developer Tools

Every tool in this group processes text locally in the page using JavaScript. Nothing is uploaded, nothing is logged, and the tools keep working if the connection drops after the page has loaded. That is a deliberate design choice rather than a technical accident: text is the category where people most often paste something they should not send anywhere.

It changes what these tools are safe for. Formatting a JSON payload that contains customer records, diffing two versions of a contract, hashing a value, or encoding a token are all reasonable to do here, because the data never leaves the machine. The practical limit is size rather than privacy — very large inputs, in the tens of megabytes, will make the browser tab slow, since the work happens on the same thread that draws the page.

They cluster around three jobs. Preparing text for a system: case conversion for identifiers and slugs, URL encoding for query parameters, and Base64 for embedding data in a text-only channel. Checking text before it is used: formatting JSON to find the syntax error, diffing two documents to see exactly what changed, and counting words against a limit. Generating text: passwords, hashes, placeholder copy, and numbers written out in words.

The pairings that come up most are worth knowing. Formatting JSON and then diffing two formatted versions is far more readable than diffing two minified ones, because minified JSON is a single line and a line-based diff can only tell you that it changed. Converting a heading to kebab-case and then URL-encoding the result is the standard way to build a slug that survives being put in a link.

Three recur often enough to name. Treating Base64 as security. It is an encoding, not encryption, and anyone can reverse it instantly, so an API key that is merely Base64-encoded is a plaintext API key with extra steps.

Hashing passwords with SHA-256. General-purpose hashes are built to be fast, which is exactly wrong for password storage, where an attacker with the database is trying billions of guesses per second. Passwords need a deliberately slow algorithm such as bcrypt or Argon2.

Double encoding URLs. Running an already-encoded string through an encoder again turns every percent sign into %25, so a space becomes %2520 instead of %20 and arrives with visible escape codes. If you see %25 in a URL, the encoder ran twice.