Sends an HTTP request and returns the status, headers, timing, and body, parsing the body as JSON when the content type says so. Redirects are followed manually so each hop can be re-checked. Responses are capped at 256 KB. Requests to private and loopback addresses are refused unless DEVKIT_ALLOW_PRIVATE_HOSTS=1 is set.

Decodes the header and payload of a JSON Web Token and reports the timing claims (iat, nbf, exp) in both epoch and ISO form, along with whether the token is expired. The signature is returned but NOT verified — this tool inspects tokens, it does not validate them, and the result always says so.

Computes a cryptographic digest (or keyed HMAC) of a string. Supports md5, sha1, sha256, sha384, and sha512 with hex, base64, or base64url output. Can also verify the result against an expected digest using a constant-time comparison.

Generates one or more UUIDs using a cryptographically secure random source. Version 4 is fully random; version 7 (RFC 9562) embeds a millisecond timestamp so the values sort chronologically, which makes them well suited to database primary keys.

Runs a JavaScript regular expression against a string and returns every match with its character offset, positional capture groups, and named capture groups. Optionally performs a replacement so you can preview the substituted output.

Translates a cron expression into plain English and lists its next scheduled runs in a given timezone. Handles both 5-field and 6-field (seconds) syntax, and reports the interval between runs so an accidentally too-frequent schedule is obvious.

Applies a reversible text transformation: base64 and base64url, hex, and URL percent encoding in both directions, plus JSON pretty-printing and minification. Decoding operations validate their input and report an error rather than returning garbage.