The small conversions and checks that interrupt real work. Everything runs locally, so you are not pasting internal data into someone else's server.
Search for a JSON formatter or a JWT decoder and you get dozens of results. The problem is that most of them send your input to a server to process it. If that JSON contains customer emails and that JWT is a live session token, pasting it is an exfiltration event.
It is easy to wave away with «the token was expired anyway», but what matters in an incident review is rarely whether data leaked — it is that you cannot prove how far it went.
Everything in this category runs in the browser. The check takes ten seconds: open the network tab in devtools and use the tool. There are no requests.
A JSON formatter is used less for pretty-printing than for locating the parse error. The usual causes are a trailing comma, single quotes, and invisible characters picked up during a copy.
Base64 is not encryption. It is an encoding anyone can reverse; its purpose is carrying binary through a text channel, not hiding anything. And when it goes into a URL, + and / break things, so the URL-safe variant using - and _ is required.
With URL encoding, the question is always which part you are encoding. Path segments and query values need different characters escaped, and encoding a whole URL at once destroys the :// along with everything else.
A JWT is three dot-separated parts — header, payload, signature — and the first two are plain Base64URL. Anyone can read them. Putting personal data or internal identifiers in a token is equivalent to publishing them.
A decoder only reads those two parts. Signature verification is a separate operation, and without it nothing about the content is guaranteed. That gap is exactly why implementations accepting alg: none were a real vulnerability.
Expiry (exp) and issue time (iat) are Unix timestamps, which mean nothing to a human eye. Pairing the decoder with the timestamp converter shows immediately when a token dies.
Regular expressions go wrong most often at greedy quantifiers. .* consumes as much as it can, so <.*> matches from the first < to the last > rather than one tag. Making it lazy with .*? is the first fix to try.
The classic cron trap is specifying both day-of-month and day-of-week. In most implementations those combine as OR rather than AND, so the job fires far more often than intended. And unless you check the server's time zone, «3 a.m.» may be 3 a.m. somewhere else.
In CIDR maths, usable hosts are not 2^(32−prefix) but that minus the network and broadcast addresses. That is why a /30 gives two usable addresses rather than four, and why /31 exists as a special case for point-to-point links.
For timestamp conversion, most mistakes are seconds versus milliseconds. Ten digits is seconds, thirteen is milliseconds. The factor of a thousand is why you land in 1970 or fifty thousand years from now.
Text diff gives completely different output depending on whether you compare by line or by character. Line diff suits code review; character diff suits finding a typo inside a sentence.
Colour conversion moves between HEX, RGB and HSL. HSL is far easier for adjustments like «slightly lighter», because only one component changes.
QR generation lets you set the error correction level. A higher level makes the code denser but keeps it readable when print gets dirty or part of it is covered.
Server capacity sizing rests on Little's Law, the basic identity of queueing theory: the number of requests in the system equals arrival rate times time in system. From that you get the concurrency you need.
The counter-intuitive part is that queue time explodes as utilisation approaches 100%. Going from 90% to 95% degrades response time far more than going from 70% to 80%. «There is still 10% CPU headroom» is therefore not a safety signal.
This is a steady-state approximation. Traffic spikes and retry storms are not in the model. Use it as the starting point for capacity planning and confirm with real load testing.
Everything runs in the browser, works offline, and never sends your code, tokens or configuration to a server. With no account, no value is tied to an identity.
The browser is also a constraint: very large inputs consume a lot of memory, and anything requiring an actual network probe — port scanning, TLS chain validation — is out of scope.