Developer Toolbox

About the Developer Toolbox

One window for the small developer jobs that come up all day. Paste anything — a JWT, JSON, Base64, a Unix timestamp, a cron expression, a /regex/, a URL, a UUID, a colour or plain text — and Smart paste works out what it is and opens it in the matching tool: decoded, formatted, explained and checked. Eleven tools share one input box, with a history of what you pasted (kept on this device only), Batch files for many files at once, and a command list on Ctrl+K (⌘K on a Mac).

Every tool here is built on the tested code of MySmartCoPilot’s own page for that job and runs in your browser: nothing you paste or drop is uploaded. Each of those pages is linked from its tool and works without a pass; the toolbox adds the convenience of having them together. Without a pass the toolbox is a free preview that shows the first part of every result, with Copy and Download locked until you unlock it.

Common uses

• Debugging an API: paste a token from a request header, the JSON body and a timestamp from the logs, one after the other, without opening a tab for each.
• Reviewing a config: check when a cron schedule runs next (crontab in your time zone, cloud schedulers in UTC, or any zone you choose), a colour’s contrast, or whether a URL’s query parameters are what you expect.
• Spotting what broke a comparison: the Text tool shows invisible characters such as zero-width spaces, no-break spaces and direction marks.
• Preparing a release: format or minify a folder of JSON files, or write the SHA-256 checksum list for the files you publish.

The tools in the toolbox

• JSON — formats, minifies and checks JSON, keeping every number exactly as written, warns about repeated keys and points at errors by line and column (JSON Formatter).
• JWT — decodes the header and payload, explains each claim and its dates, and flags alg "none" and other risky headers (JWT Decoder, which also verifies signatures).
• Base64 — decodes Base64, Base64url, data: URIs and PEM blocks to text or to a file named by its real type, or encodes text (Base64 Encoder & Decoder).
• Timestamp — turns seconds, milliseconds, microseconds or nanoseconds, or a date, into every common format in any time zone, one value or one per line (Timestamp Converter).
• Cron — explains Unix, Spring, Quartz, AWS EventBridge, Kubernetes and GitHub Actions schedules and lists the next runs (Cron Expression Generator & Explainer).
• Regex — runs a JavaScript regular expression over your test text in a separate worker that stops a runaway pattern after 1.5 seconds, with named groups and replacement (Regex Tester).
• URL — splits a URL into its parts, query parameters and path segments, or decodes and encodes %-escapes (URL Encoder & Decoder).
• UUID — reads the version and variant of a UUID and the time inside version 1, 6 and 7 UUIDs (RFC 9562), or generates version 4 and 7 UUIDs (UUID Generator).
• Colour — converts a hex code, a CSS colour name, rgb(), hsl(), hwb(), oklch() or oklab() (or HSV and CMYK values) to HEX, RGB, HSL, HWB, OKLCH, OKLAB, HSV and CMYK, with its WCAG contrast against white and black (Color Converter).
• Hash — MD5, SHA-1, SHA-256, SHA-384, SHA-512 and SHA-3 digests of the text, HMACs with a key, and a comparison with an expected hash (Hash Generator).
• Text — counts characters, code points, bytes, words and lines, and finds invisible and direction-changing characters (Unicode Character Inspector).

How Smart paste decides

It reads the text the way MySmartCoPilot’s home page Smart paste does: a JWT must have three Base64url parts whose header is JSON (in quotes, after Bearer or Authorization:, or broken across lines too); JSON must parse (or fail the way JSON fails, so you see the error); Base64 must decode to readable text or to a file with a known signature (a long run of Base64 can also be binary data); a number is a timestamp when its length fits seconds, milliseconds, microseconds or nanoseconds; a cron expression must parse for one of the schedulers; colours, UUIDs, URLs and /regex/flags literals are matched by their syntax. The best reading opens; the others get a dot in the tool list and a button under the box.

Short values can fit several kinds — five small numbers parse as a cron expression, a 32-digit hex string is the length of an MD5 hash — so the tool list always lets you choose. Untick “Open the matching tool by itself” to stay in one tool whatever you paste.

History, on this device only

The toolbox keeps up to 30 recent inputs in this browser’s local storage, newest first, so you can go back to a token or a payload from earlier; inputs over 20,000 characters are not kept. With “Leave secrets out” on (the default), every JWT is kept without its signature — it still decodes, but can no longer be used to sign in — and an encrypted one (JWE) with its header only, also inside JSON or a log line. Before anything is kept, ••• replaces the values of fields named like a password, token, secret, session, cookie or API key (in JSON, .env and YAML files, query strings and command lines), Authorization and Cookie header values, Bearer and Basic credentials, passwords in URLs, and the key formats the Secret & Credential Leak Scanner recognises.

A secret written where none of these rules can see it — a password on a line of its own, say — would be kept, so on a computer you share, untick “Keep a history on this device”, which also deletes the list. Ticking “Leave secrets out” again cleans what was kept while it was off. You can also remove one entry or clear the list. Nothing in the history is ever sent anywhere.

Batch files

Add any number of files and choose one job: Format JSON (2 spaces, 4 spaces or tabs), Minify JSON, Check JSON (a report only), Encode as Base64 (76-character lines, or URL-safe), Decode Base64 (each output named by the type its bytes show, such as .png or .pdf) or Checksums in SHA-256, SHA-512, SHA-1, MD5, SHA-384 or SHA-3. JSON and Base64 files of up to 25 MB each are read whole; checksums read files of up to 8 GB in slices in a background worker, and the list is written in the GNU coreutils format that sha256sum -c checksums.sha256 checks. Formatting, minifying, encoding and decoding give their files as one ZIP, Checksums gives the one checksum list, and every job has a CSV report of each file.

Offline and as an app

As soon as you start using it, the toolbox fetches every tool’s code in the background, so once MySmartCoPilot’s offline copy has saved the page it keeps working without a connection. To open it like an app, install MySmartCoPilot from your browser — the install icon in the address bar of Chrome or Edge, File → Add to Dock in Safari on a Mac (macOS Sonoma 14 or later), or Share → Add to Home Screen on an iPhone or iPad — and open the Developer Toolbox in it; Focus shows only the toolbox.

Limitations

• The toolbox is a web app in your browser, not a native desktop app: it cannot watch the clipboard in the background, sit in the menu bar or open from a terminal. Paste with Ctrl+V or the Paste button (the browser may ask before it lets a page read the clipboard).
• Smart paste goes by the text alone, so short or unusual values can open in an unexpected tool — choose the right one in the tool list.
• Regex uses JavaScript (ECMAScript) regular expressions: PCRE, Python and .NET extras such as possessive quantifiers or (?P<name>…) groups are not understood.
• Decoding a JWT does not prove who made it; the JWT Decoder checks the signature with your secret or public key.
• The JSON tool reads up to 8 million characters pasted in the box and shows the first 200,000 characters of a result; larger files belong in Batch files (up to 25 MB each).
• Colour reads hex codes, CSS colour names and rgb(), hsl(), hwb(), oklch() and oklab(), plus HSV and CMYK values; lab(), lch(), color() and color-mix() are not read.
• History leaves out the secrets it can recognise by their name, their header or their format; a secret written where no rule can see it is kept, so switch History off on a shared device.
• Open-source developer toolboxes that cost nothing exist for desktops and the web. What the toolbox adds is convenience: these tools in one window with one input box, a history and batch runs.

Privacy

Everything runs in your browser: nothing you paste, type or drop is uploaded. The history (up to 30 recent inputs) and your options are kept in this browser’s local storage under tv-pref-dev-toolbox until you clear them or switch History off; by default JWTs lose their signature and the secrets the toolbox recognises are blanked first.