Browser-local developer utilities for comparing, formatting, encoding, generating, and inspecting data. Built with Next.js, React, and TypeScript for opensourcetools.dev.
Every interactive page (/tools and /tools/<slug>) uses React Client Components marked with "use client". After the page loads, tool input and processing stay in in-memory browser state; Vercel only serves the application files and never receives tool inputs or results.
There are no tool API routes, server actions, analytics, telemetry, cookies, or local-storage persistence. Refreshing the page clears the input unless the user copies or downloads it.
| Category | Tool | Browser implementation |
|---|---|---|
| Compare | Text Diff | Bounded line-based LCS with aligned replacement rows |
| Compare | JSON Compare | JSON.parse, recursive comparison, and JSON Pointer paths |
| Format | JSON Formatter | JSON.parse and JSON.stringify |
| Encode | Base64 | TextEncoder, TextDecoder, atob, btoa, and local Blob previews/downloads |
| Encode | URL Utility | encodeURIComponent, decodeURIComponent, and URL |
| Encode | JWT Inspector | Strict Base64URL and JSON decoding; no verification |
| Transform | Case Converter | Unicode-aware tokenization and deterministic case rules |
| Transform | Line Sort & Deduplicate | Array sorting, Set deduplication, trimming, and case options |
| Generate | UUIDv4 Generator | crypto.randomUUID() |
| Generate | Password Generator | crypto.getRandomValues() with rejection sampling |
| Inspect | Hash Generator | Web Crypto subtle.digest |
| Inspect | Regex Tester | Native RegExp in a disposable Web Worker |
| Inspect | Timestamp Converter | Explicit Unix units and JavaScript Date |
| Inspect | Number Base Converter | Arbitrary-precision BigInt conversion |
| Inspect | Unicode Inspector | Code-point iteration, TextEncoder, and UTF-16 inspection |
- Inputs and results exist only in browser memory and are not sent over the network.
- React renders user content as text; the app does not use
dangerouslySetInnerHTML,eval, ornew Function. - Downloads and image previews use temporary local Blob URLs that are revoked after use.
- Passwords and UUIDs use Web Crypto, never
Math.random. - Regex runs in a worker that is terminated after one second and capped at 200 matches.
- JWT inspection is decode-only: signatures, claims, issuers, audiences, and expiry are not verified.
- Production headers enforce a same-origin CSP, block framing and MIME sniffing, restrict permissions, and set HSTS.
| Area | Limit |
|---|---|
| Text Diff | 200,000 characters and 5,000 lines per side; 4,000,000 comparison cells |
| JSON | 1,000,000 characters per input; depth 80; 10,000 changes |
| Base64 | 2,000,000 input characters |
| JWT | 262,144 characters |
| Hash | 2,000,000 characters |
| Regex | 2,048-character pattern; 100,000-character input; 200 matches; 1 second |
| UUID | 100 per action |
| Password | 8-128 characters; 100 per action |
| Number base | 10,000 digits |
| Unicode | First 2,000 code points shown |
Limits are checked before expensive work and produce explicit errors instead of silent truncation.
Requires Node.js 22+ and npm 11+.
npm install
npm run devnpm test
npm run typecheck
npm run lint
npm run build
npm run test:e2eProduction dependencies are limited to next, react, and react-dom; no tool-specific runtime libraries are used.