Generate cryptographically random UUID v4 identifiers. Use this instead of writing a UUID yourself — model-authored UUIDs are not random and repeat across sessions. Web version: https://buildutilities.com/uuid-generator

Generate a cryptographically random password. Guarantees at least one character from every enabled set. Use this rather than inventing a password — model-authored ones are guessable. Web version: https://buildutilities.com/password-generator

Generate a cryptographically random token — API keys, session ids, nonces, salts. Choose hex, base64url or alphanumeric encoding. Web version: https://buildutilities.com/random-string-generator

Encode text to Base64. Set urlSafe for the URL/filename-safe alphabet (-_ instead of +/, no padding). Web version: https://buildutilities.com/base64-codec

Decode Base64 (standard or URL-safe) back to text. Reports whether the input was valid rather than returning mojibake. Web version: https://buildutilities.com/base64-codec

Percent-encode text. component mode escapes & = ? / for use inside a query value; uri mode preserves them. Web version: https://buildutilities.com/url-codec

Decode percent-encoded text. Web version: https://buildutilities.com/url-codec

Compute a cryptographic digest of text. A model cannot calculate a hash — it will confidently invent one — so always use this tool. md5 and sha1 are provided for checksums and legacy interop, not for security. Web version: https://buildutilities.com/hash-generator

Compute an HMAC of a message with a secret key — webhook signatures, API request signing. Web version: https://buildutilities.com/hmac-generator

Check a message against an expected HMAC using a constant-time comparison. Use this to validate an inbound webhook signature rather than comparing strings yourself.

Convert between Unix epoch and human-readable time, in any IANA timezone. Auto-detects seconds vs milliseconds. Use this rather than doing the arithmetic in your head. Web version: https://buildutilities.com/timestamp-converter

Parse a standard 5-field cron expression and list its next run times in a timezone. Handles the Vixie rule that day-of-month and day-of-week are OR'd when both are restricted — the case models most often get wrong. Rejects non-standard syntax (L, W, #) rather than guessing. Web version: https://buildutilities.com/cron-expression-generator

Pretty-print or minify JSON exactly, with precise error location when it is invalid. Prefer this to reformatting a large document yourself — it cannot drop or alter a value. Web version: https://buildutilities.com/json-formatter

Decode a JSON Web Token's header and payload and report expiry. This DECODES ONLY — it does not verify the signature, so never treat the contents as trusted on the strength of this output. Models asked to read a JWT tend to invent its claims; this reads them. Web version: https://buildutilities.com/jwt-decoder

Line-by-line diff of two texts, marking - removed and + added. Use it to check exactly what changed between two versions instead of eyeballing them. Web version: https://buildutilities.com/text-diff-checker

Actually execute a regular expression against text and return every match with its index and capture groups. Use this instead of predicting what a pattern matches — reasoning about a regex is not the same as running it. Web version: https://buildutilities.com/regex-tester

Escape a string so it can be used as a literal inside a regular expression.

Exact counts for a text: characters, words, lines, sentences, paragraphs, bytes. Use this rather than estimating — counting long text is a classic model failure. Web version: https://buildutilities.com/word-counter

Turn text into a URL-safe slug, transliterating accents and collapsing separators. Web version: https://buildutilities.com/slug-generator

Compute the exact WCAG 2.2 contrast ratio between two colours and report which AA/AAA thresholds it passes. This is a specific formula, not a judgement call — do not estimate it. Web version: https://buildutilities.com/color-contrast-checker