JSON Tools
3 tools
Format, validate, and compare API payloads. Each page also explains the JSON grammar, what parser errors mean, and why a structural diff beats a text diff.
Softkey Tools
Developer tools for payloads, encodings, tokens, and time.
Validate payloads, inspect tokens, test patterns, and generate codes in one workspace. Every tool explains the format it handles, with worked examples and the mistakes that cause the bugs.
- 23 tools
- 7 categories
- No signup
- Runs in your browser
Tools
Start with the tools people reach for most
Barcode Tools
QR Code Generator
Build QR codes with a chosen error correction level.
JSON ToolsJSON Formatter
Pretty-print and compact JSON instantly.
UUID / Hash ToolsUUID Generator
Generate RFC 4122 version 4 identifiers.
Auth ToolsJWT Decoder
Read token headers and claims locally.
Auth ToolsToken Generator
Create opaque access and refresh token pairs.
Encoding ToolsBase64 Encoder
Encode plain text into Base64 safely.
UUID / Hash ToolsSHA256 Generator
Hash text with SHA-256 in the browser.
Tool Categories
Browse by workflow
Auth Tools
4 tools
Inspect the tokens an authorisation server issued, and generate opaque access and refresh pairs for development, with the entropy and storage rules explained.
Barcode Tools
2 tools
Generate linear barcodes and QR codes in the browser, with check digits, quiet zones, and error correction explained rather than hidden.
UUID / Hash Tools
3 tools
Generate identifiers and fingerprints, with the reasoning behind them: how UUID versions differ, what a digest proves, and where MD5 must not be used.
Encoding Tools
4 tools
Convert data for transport and auth flows, and learn the rules underneath: Base64 padding, percent-encoding, and what a JWT signature does and does not guarantee.
Time Tools
1 tools
Translate timestamps and dates, and understand the classic failure modes: seconds versus milliseconds, time zones, and the 2038 boundary.
Text Tools
6 tools
Build regular expressions, generate passwords, inspect bytes, and preview markup, with the entropy maths and matching rules explained alongside each tool.
Start from the symptom
Which tool solves which problem
Most debugging sessions begin with a symptom rather than a format. This table maps the symptoms that come up most often to the tool and the explanation that goes with it.
| Symptom | Start here | What to check |
|---|---|---|
| An API request fails and I cannot tell why | JSON Validator | Confirm the body parses before debating the schema. Parser errors point at the exact position. |
| It worked before yesterday’s deploy | JSON Compare | A structural diff separates real contract changes from reordered keys and volatile fields. |
| A login works in staging but not in production | JWT Decoder | Read the issuer, audience, and expiry claims. Decoding is local, and it never verifies the signature. |
| I need a token or API key for a staging service | Token Generator | Opaque access and refresh pairs from the browser CSPRNG, with the SHA-256 you should store instead of the token. |
| A token expires immediately, or never | Unix Timestamp Converter | Almost always a seconds versus milliseconds mix-up. Ten digits is seconds, thirteen is milliseconds. |
| I need a QR code or a label barcode | QR Code Generator | Encoded locally, so Wi-Fi passwords and internal URLs never leave the browser. Downloads as SVG or PNG. |
| A redirect URL loses its query string | URL Encoder | Encode the value, not the finished URL, and check for the %25 that signals double encoding. |
| Two identical-looking strings are not equal | String to Hex | Byte-level output exposes trailing newlines, non-breaking spaces, and byte-order marks. |
| A field accepts input it should reject | Regex Tester | Usually a missing anchor. Test the values that must fail, not only the ones that must pass. |
| I need a throwaway credential for a staging box | Password Generator | Generated from the browser cryptographic random source, with the entropy figures shown. |
Guides
Learn the formats behind the tools
Longer walkthroughs for the topics that cause repeat incidents: payload debugging, regular expressions, token inspection, encodings, identifiers, and time handling.
6 min read
JSON Debugging Workflows for API Teams
A practical guide to formatting, validating, and diffing payloads before they hit production.
Read the guide →5 min readRegex Patterns Developers Reuse Every Week
Email, slug, UUID, and password rules you can adapt instead of rewriting from scratch.
Read the guide →7 min readJWT Claims, Expiration, and Safe Token Inspection
What to inspect in a JWT and what not to trust when you are debugging auth.
Read the guide →4 min readHashes, UUIDs, and When Each One Fits
A concise decision guide for choosing identifiers and fingerprints in web systems.
Read the guide →6 min readBase64, Hex, and Percent-Encoding Compared
Three encodings, three jobs. How to tell them apart, when each is correct, and why none of them protects data.
Read the guide →6 min readUnix Time, Time Zones, and Expiry Bugs
Why tokens expire immediately, jobs run twice a year at the wrong hour, and two people see different dates for one record.
Read the guide →Why This Site Exists
Useful context, not just text boxes
Softkey Tools is aimed at developers who need quick answers during implementation, support triage, code review, and release validation.
Built for production debugging
Each tool is designed for common engineering tasks such as validating payloads, checking encodings, and inspecting auth tokens before changes reach production.
Local-first outputs
Inputs stay in the browser so teams can test malformed data, credentials-adjacent strings, and copied logs without shipping them to a third-party API.
Workflow context included
The goal is not just to transform text, but to explain when to use each utility, what the results mean, and where mistakes usually happen in real delivery pipelines.
FAQ
Questions about how these tools work
Does my data leave the browser?
No. Every tool runs in the page using standard browser APIs such as JSON, TextEncoder, Web Crypto, and the regular expression engine. Nothing is uploaded, logged, or stored, which is what makes it reasonable to paste a production payload or an expired token.
Do I need an account, and is there a usage limit?
Neither. Because the processing happens on your device there is no quota, no rate limit, and no sign-in. The pages also work offline once loaded.
Why does each tool come with so much reading?
Most of these bugs are conceptual rather than mechanical. Knowing that Base64 is not encryption, that decoding a JWT is not verifying it, or that a hash cannot be reversed prevents far more incidents than any single conversion does.
Can I rely on these tools for security decisions?
Use them to inspect and understand, not to authorise. Signature verification, password storage, and access control belong in your backend with reviewed libraries. Each page states plainly where that boundary sits.