maratool
Developer tools
Free browser-based developer utilities — crypto, IDs, scheduling, references. Everything runs locally — no data leaves your device.
About these developer tools
This page collects the small utilities that come up over and over in day-to-day engineering work — encoding and decoding tokens, hashing strings, generating identifiers, building cron schedules, testing regular expressions, and producing secure random values. They are the kind of tasks that interrupt real work for thirty seconds, and a fast, browser-based tool is usually faster than writing a one-off script or opening an IDE.
What you can do here
The tools split roughly into four jobs. Inspection tools read structured data and show you what is inside — for example, the JWT decoder splits a token into its header, payload, and signature so you can verify claims, audience, and expiry without a debugger. Generation tools produce values on demand: the UUID generator emits v1, v4, and v5 identifiers in bulk, and the password generator uses the browser's cryptographic random source rather than Math.random. Hashing tools compute fingerprints — the hash generator covers MD5, SHA-1, SHA-256, and SHA-512 at once, useful for checksums, cache keys, and integrity checks. Reference tools sit alongside, like the cron expression builder and the regex tester, which let you preview a schedule or a pattern before you commit it to production.
When to use which
Reach for the JWT decoder when you need to read a token you already have. Use the hash generator when comparing file fingerprints or producing stable cache keys. Use the UUID generator when seeding a database or writing fixtures. Use the regex tester when a pattern works in one engine but not another, or to debug a backreference that is matching the wrong group. Each tool keeps state in the URL or in localStorage where it makes sense, so you can paste the page link into a ticket or come back to it later without losing context.
Privacy
Everything on this page runs in your browser. Tokens, plaintext, generated identifiers, and any input you paste stay on your device — nothing is sent to a server, logged, or stored remotely. That makes these safe to use on real production credentials, internal API responses, or anything else you would not want flowing through a third party.