Count lines, words, sentences, paragraphs and characters in a chunk of text. Returns sixteen text metrics including duplicate-line detection, longest word, reading and speaking time estimates, and the dominant line-ending style (LF, CRLF or CR).

Base64-encode a string. Optional URL-safe variant (RFC 4648 §5: -/_ instead of +//, no padding).

Base64-decode a string. Accepts both standard and URL-safe Base64; missing padding is auto-fixed. Returns text when valid UTF-8, otherwise hex.

Percent-encode a string for URL use. mode=component (RFC 3986 strict, default), form (application/x-www-form-urlencoded), or path (keeps slashes intact).

Decode a percent-encoded URL string. mode=component (rawurldecode, default) or form (interprets + as space).

Compute one or more cryptographic hashes of a text input. Defaults to MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, SHA3-256, SHA3-512.

Generate cryptographically random passwords using a CSPRNG. Configurable length, count, character classes and ambiguous-character exclusion.

Score a password (0-4 zxcvbn-style), compute entropy bits, identify common-password fingerprints and keyboard sequences, and estimate offline-GPU crack time. Password is never logged.

Validate, pretty-print, minify or analyse a JSON document. Returns a structural summary (node counts, max depth, top distinct keys).

Convert a JSON array of objects to CSV. Configurable delimiter, columns, optional flattening of nested objects with dot-keys (e.g. meta.city). Max 50,000 rows per request.

Convert text into multiple case styles in one call: upper, lower, title, sentence, snake, kebab, camel, pascal, constant. Pass cases to limit the response.

Convert any text to a URL-safe slug. Unicode-aware: by default transliterates non-Latin characters to ASCII (set transliterate=false to keep them). Configurable separator and length.

Sort lines of text. Supports asc/desc, case-insensitive, locale-aware collation, natural-sort (line2 before line10), dedupe, line-trim and empty-line drop.

Generate placeholder text — N paragraphs, sentences or words of lorem ipsum. Suitable for mocks, fixtures and test data.

Convert any moment in time between formats. Bidirectional Unix epoch ↔ ISO 8601 ↔ RFC 3339 ↔ human-readable. Auto-detects epoch resolution. Accepts strtotime-style natural language ("next monday", "+2 weeks"). Optional timezone for local components.

Date arithmetic. Two modes: provide start + add (e.g. "+90 days", "-2 weeks") to compute the resulting date, OR provide start + end to compute the diff. Diff mode optionally counts business days only.

Match, replace or split text with a PCRE regular expression. Returns offsets and capture groups. ReDoS-protected: catastrophic patterns return an error rather than hanging.

Fetch and parse an XML sitemap or sitemap index from a public HTTPS URL (or paste raw XML). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses, re-validates redirects. Optional recursive expansion of sub-sitemaps. Returns lastmod, changefreq, priority when present.

Validate a card number using the Luhn algorithm and detect the brand (Visa, MasterCard, Amex, Discover, JCB, Diners, UnionPay, Maestro, RuPay). The card number is never logged — only its length, IIN prefix, last 4, masked form, and Luhn outcome leave the server.

Validate XML well-formedness; with optional XSD schema. Reports errors with line/column. Network and DTD fetches are disabled (no XXE risk).

Diff two strings by line, word or character. Returns structured changes (+/-/=), git-style unified diff, and a Jaccard similarity score. Use line mode for code/config; word mode for prose; char mode for short strings.

Descriptive statistics for a list of numbers: count, sum, mean, median, mode, min/max/range, variance, stddev (population AND sample), MAD, quartiles, IQR, percentiles (1-99), geometric mean, harmonic mean.

Convert integers between any base 2..36 plus Roman numerals. Big-int safe when GMP is available. Use from_base="roman" to parse a Roman numeral input, or include "roman" in to_bases to convert to Roman.

Multi-mode financial calculations. mode selects: loan (principal+rate+term [+extra]), compound_interest (principal+rate+years [+contribution]), simple_interest, discount, tip, sales_tax, roi (gain+cost), percentage (sub_mode: of / is_what_percent / change / increase), markup (cost + percent).

Convert any color (hex, rgb, rgba, hsl, hsla, named) into all standard color spaces. Returns hex, rgb, rgba, hsl, hsv, cmyk, closest CSS named color, WCAG luminance and contrast ratios vs. white and black (with AA/AAA flags).

Compute age in years/months/days from a date of birth. Returns next birthday, days until, Western zodiac sign, generation (Gen Z / Millennial / Gen X / Boomer / Silent / Greatest / Gen Alpha), birth weekday, and leap-year info.

Compute the reduced aspect ratio (16:9, 4:3, 21:9, ...) from a width and height; OR scale a given width OR height to a target ratio.

Fetch a public HTTPS URL and extract structured page metadata: title, description, keywords, canonical, language, charset, full OpenGraph dictionary, Twitter Card, favicon (absolute URL), hreflang map, JSON-LD blocks, response headers and counts (h1/h2/images/links/scripts). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses and re-validates every redirect. 2 MB body cap.

Generate a complete HTML head block — standard , OpenGraph, Twitter Card and Schema.org JSON-LD — from a small set of inputs (title, description, url, image, author, keywords, type). Returns ready-to-paste HTML plus an SEO score 0-100 with concrete warnings (title length, description length, missing OG image, etc.).

Apply chained text cleanup operations in sequence. Operations: trim, collapse_spaces, normalize_whitespace, remove_line_breaks, normalize_line_breaks, dedupe_lines, reverse_lines, strip_html, strip_emoji, strip_urls, strip_emails, normalize_quotes (curly → straight), normalize_dashes (em/en → hyphen), lowercase, uppercase. Returns cleaned text plus per-operation chars/lines removed.

Cryptographically random generator backed by random_int / random_bytes. mode=number (min/max), string (length + charset: alpha/alphanumeric/numeric/lower/upper/hex/hex_upper/base58/base64url), word (English word list), picker (pick N from a list, with/without replacement), team (balanced round-robin team allocation), dice (NdM notation), coin, country (ISO list), uuid (v4 or v7).

Hashtag operations on text. mode=extract (pull #hashtags out of text with offsets), remove (strip them out + tidy whitespace), generate (suggest #hashtags from text content via stop-word-filtered word frequency), format (normalize an array of hashtag strings to camel/snake/lower/preserve style). Unicode-aware (#日本語 works).

Resolve DNS records for a domain via the system resolver. Default lookup covers A, AAAA, MX, TXT, NS, CNAME, SOA, CAA. Also resolves reverse PTR records for A results. Use this to debug mail config (MX), domain ownership signals (TXT), name-server delegation (NS), CAA policy, and IP resolution. No SSRF risk — DNS only, no outbound connections.

Connect to {domain}:{port} over TLS and return the leaf certificate + full chain: subject, issuer, validity dates, days remaining, fingerprint (SHA-256), subject alternative names, signature algorithm, negotiated protocol and cipher. Useful for verifying a domain has HTTPS, the cert is not expired, and the chain is properly configured. SSRF-protected: refuses private/loopback/link-local/cloud-metadata IPs. 5s connect timeout.

Decode a JSON Web Token (JWT) and analyse its claims. Always returns header, payload, signature info, and expiry status (active/expired/not_yet_valid) computed from exp/nbf/iat. When secret is provided, verifies HS256/HS384/HS512 via HMAC. When public_key is provided in PEM format, verifies RS256/RS384/RS512 via openssl_verify. ES* and EdDSA are decoded but not verified. The token is never logged.