Guides
Ten notes on decisions these tools cannot make for you. Each one links to the live tool and states a limit.
- JWT decode is not signature verificationDecoding a JWT shows the header and payload. It does not prove the token was signed by anyone you trust.Tool: JWT Decoder
- What JSON-to-TypeScript cannot inferA converter types the sample you pasted. Fields that were missing, null, or only one of several shapes will not appear correctly.Tool: JSON → TypeScript
- Base64 is encoding, not encryptionBase64, percent-encoding, and HTML entities change representation. They do not keep a secret.Tool: Base64 Encode / Decode
- bcrypt cost is login latencyThe bcrypt cost factor multiplies work. Higher cost slows attackers and also slows every legitimate login.Tool: Bcrypt Hash Generator
- JavaScript regex is not PCREThe DevTooKit tester uses the browser RegExp engine. Patterns from Perl, Python, or grep can mean something else.Tool: Regex Tester
- Unix time: seconds or millisecondsA 10-digit epoch is seconds. A 13-digit epoch is milliseconds. Mixing them shifts your date by decades or minutes.Tool: Unix Timestamp Converter
- 5-field cron versus a seconds fieldClassic cron has five fields and no seconds. Quartz and some cloud schedulers add a seconds field and then disagree about the rest.Tool: Cron Expression Parser
- HMAC for API request signingAn HMAC matches only when the key, the algorithm, and the exact bytes of the message match. The usual bug is the message, not the hash function.Tool: HMAC Generator
- Hashing text is not hashing a fileA checksum covers bytes. The bytes in a text box and the bytes in a file are often not the same.Tool: Hash Calculator
- What local-first means for developer toolsMost DevTooKit tools run in the tab. A few send a request because that is the feature. The difference matters for tokens and payloads.Tool: JSON Formatter