Is a UUID generated in the browser cryptographically random?

Yes — the BoxrTools UUID generator uses `crypto.randomUUID()` when available (modern browsers, secure contexts, all HTTPS deployments). It supports v4 (random), v5 (namespace + name SHA-1), and v7 (time-ordered random — increasingly preferred for database primary keys).

Are passwords generated in the browser actually safe to use?

Yes, with caveats. The password generator uses Web Crypto's `crypto.getRandomValues()` for entropy — the same API used in serious password managers. The output is sent nowhere because there is no network call. As always, the safety of a password depends on (1) entropy source and (2) whether the password itself ever leaves your machine before being saved. BoxrTools' generator is peer-reviewed for both.

How does JWT verification actually work without sharing the secret?

For HS256 tokens, secret input happens client-side and never touches the network. The signature verification runs in JavaScript using the Web Crypto API (via SubtleCrypto). For RS256, only the public key is needed and it doesn't matter where the verification runs. Note: this tool is for *debugging* JWTs you already have. It does not validate tokens on behalf of remote services.

Can the SQL formatter break down 1000-line queries?

Yes — the formatter is recursive and handles CTEs, nested subqueries, window functions, and a wide range of dialect-specific syntax (PostgreSQL, MySQL, Standard SQL, T-SQL, BigQuery). For queries above ~10 MB the formatter streams to keep memory under 30 MB — but at that size, your analysis approach probably needs revisiting anyway.

15 Free Online Developer Utility Tools You Should Bookmark in 2026

Most dev tutorials tell you to “open your terminal” for every utility. Most of the time the terminal is fine — but for the narrow band of utilities that pop up 5 times a day, a browser-based tool is faster, shareable with teammates, and works on a tablet.

This list picks the 15 developer utilities a working engineer reaches for weekly. They’re all free, all browser-side, and none of them need a signup wall in the middle of debugging.

How we picked these tools

Every tool on this list:

Runs client-side. No upload, no SaaS API call, no leaked source code.
Is free, with no signup. Click → use. No npm install required.
Has zero ads in the work area. Banners can live in the chrome, not the editor.
Gives shareable URLs. Your team can save the settings you used.

1. UUID Generator

Generate UUID v1, v4, v5, and v7 in bulk. v4 is the obvious default; v7 is the rising star for database primary keys (time-ordered, fewer B-tree page splits in Postgres / MySQL).

Best for: Seeding test databases, generating idempotency keys, creating stable identifiers for files.

Use the UUID Generator when you need 1, 100, or 10,000 of them with copy-friendly defaults.

2. Password Generator

Generate cryptographically-random passwords with entropy display and strength scoring. Show the work — entropy in bits is exposed so you can pick a length that meets any compliance bar.

Best for: Meeting a NIST or PCI password policy without installing a separate password manager on a borrowed machine.

Password Generator with live entropy display.

3. JWT Decoder

Decode, inspect, and verify JSON Web Tokens without exposing the secret to anyone. Includes exp, iat, nbf validation against the current time, and HS256/RS256 signature verification.

Best for: Debugging token flows, inspecting 3rd-party tokens, learning the structure of JWTs.

Try the JWT Decoder with the famous demo token — it shows live expiry, lifetime, and the warning states that matter.

4. Hash Generator (SHA / MD5)

Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 of any string or file. Bulk file hashing supported.

Best for: Verifying checksums, hashing fixed-length keys for HMAC, content-addressed identifiers.

Use the Hash Generator — keep in mind MD5/SHA-1 are cryptographically broken, fine for non-security checksums only.

5. QR Code Generator

Generate QR codes from any text, URL, or vCard. Choose error correction level and download as PNG or SVG.

Best for: Linking a website to a phone without sharing domain names out loud.

QR Code Generator with SVG output (vector, scales infinitely).

6. URL Parser & Query String Decoder

Parse any URL into its parts (scheme, host, path, query, fragment) and decode a query string into a readable key-value map.

Best for: Debugging redirect chains, understanding tracking params, parsing email link telemetry.

Try the URL Parser on a 1,500-character redirect URL — it makes them human-readable.

7. Regex Tester & Visualizer

Live regex matching with group capture, highlight, and a visual regex parser (railroad-diagram view of every token in your pattern).

Best for: Building a regex once and explaining it to your teammate (or your future self).

Use the Regex Tester — the visualizer shows you which alternatives / quantifiers / character classes are actually in your expression.

8. SQL Formatter & Minifier

Pretty-print SQL with PostgreSQL / MySQL / Standard SQL dialect. Recursive CTE, window function, and WITH RECURSIVE support.

Best for: Cleaning up generated SQL before review, normalizing SQL across mixed ORM query builders.

SQL Formatter handles queries up to several MB.

9. Cron Parser

Reads a cron expression and explains when it will fire next. Includes the 6-field extended notation (seconds) and Vixie cron 5-field standard.

Best for: Reviewing schedulers, copying configurations into monitoring tools.

Try the Cron Parser with */5 9-17 * * 1-5 — it shows “every 5 minutes between 9 AM and 5 PM, Monday through Friday”.

10. Text Diff

Compare two blocks of text with line-level diff highlighting and the option to ignore whitespace or case.

Best for: Sanity-checking a config change, comparing two data dumps, finding the line that changed between log files.

Text Diff supports mix-language content and ignore-whitespace mode.

11. Word Counter

Counts words, characters (with / without spaces), sentences, paragraphs, and reading time. Includes density metrics like longest-word and unique-words ratio.

Best for: Sanity-checking documentation length, fitting copy into strict character limits.

Use the Word Counter to verify README length and reading time.

12. Timestamp Converter

Convert between Unix timestamps, ISO 8601 strings, RFC 3339, and human-readable formats. Bulk conversion and timezone-display supported.

Best for: Reading timestamps from logs without context-switching to your IDE.

Timestamp Converter supports a 20-year forward and backward range.

13. Lorem Ipsum Generator

Generate placeholder text by paragraphs, sentences, or words. Includes a classic Lorem Ipsum variant and a famous-authors option (Twain, Shakespeare, etc.).

Best for: Mocking up content quickly.

Generate Lorem Ipsum — also includes a minimal Cyrillic variant.

14. HTML Entity Encoder / Decoder

Encodes characters for safe inclusion in HTML, attributes, JS, URLs, or CSS contexts.

Best for: Sanitizing copy/paste from PDF into a CMS without breaking the page.

Use the HTML Encoder — it shows all four encoding modes (HTML content, attribute, JS literal, URL).

15. Code Formatter (JS / CSS minify & beautify)

Minify JavaScript and CSS for production; beautify obfuscated or compressed snippets.

Best for: Reading a minified vendor script, preparing a config for a CSP-strict pipeline.

Code Formatter — AST-driven, no eval().

How to use this list

If you only use one from this list, install the UUID Generator and the Password Generator as PWA shortcuts. You’ll reach for them on every new project on day one.

Beyond that, every other tool here has a search-engine-friendly URL. When you hit the relevant problem in a moment, the boxr.tools root domain + tool name will surface in your search results — and you can hand the URL to a teammate without explaining which SaaS you mean.

A note on privacy

The strongest reason to use a browser-side developer tool over a SaaS one is that your tokens / secrets / config never leave the local browser tab. We wrote the Privacy Policy to specifically cover these use cases. The key sentence: every tool on this list “executes entirely in your browser via JavaScript and sends nothing to any server”.

Summary

Fifteen tools. Fifteen browser tabs you should bookmark. None will ask for your email. Most of them you’ll open once a week.