OnSumoTools

Developer tools

Daily dev utilities for JSON, regex, JWT, cron, and more — private and instant in your browser.

These tools handle the repetitive debugging and formatting tasks that interrupt development flow. The JSON validator and formatter catches syntax errors with line and column hints, sorts keys, and collapses or expands nested objects. It processes JSON entirely in the browser so API responses and config files with sensitive values never reach a server. The regex visualizer runs JavaScript patterns against test input with full match indexes, group captures, and a runtime flag editor, replacing the need to test patterns in a REPL.

The JWT decoder shows header and payload fields with expiry badges and claim explanations without any network request. The visual cron schedule builder converts between cron expressions and human-readable schedules with a field editor and preset library. The JSON-to-TypeScript interface generator produces typed interfaces, type aliases, or Zod schemas from pasted JSON. Additional tools include a Base64 encoder/decoder, a Unix timestamp converter, and an HTTP status code reference. Everything runs client-side.

Private JSON Validator & Formatter

Validate and format JSON in-browser with line and column hints, key sorting, and copy or download output.

Regex Visualizer & Tester

Test JavaScript regex with full match indexes, group captures, runtime stats, and replacement preview.

Visual Cron Schedule Builder

Build cron expressions visually with presets, field editor, plain English summary, and next ten run times.

JWT Decoder & Debugger

Decode JWT header and payload in-browser with expiry badges, claim notes, and optional HMAC signature checks.

JSON to TypeScript Interface Generator

Paste JSON to generate TypeScript interfaces, type aliases, or Zod schemas with nested types and optional fields.

SQL Formatter (Multi-dialect)

Format SQL with indentation, keyword casing, and dialect-aware quoting for MySQL, PostgreSQL, BigQuery, and T-SQL.

Markdown Live Editor

Write Markdown with live HTML preview, GFM tables and task lists, sync scroll, and export to HTML or .md.

JSON Diff Viewer

Compare two JSON objects with color-coded added, removed, and changed keys plus a copyable diff report.

Base64 encoder / decoder

Encode and decode Base64 with standard, URL-safe, MIME, UTF-8, file upload, and image preview.

URL encoder / decoder

Percent-encode and decode URLs, query strings, and path segments with RFC 3986 or form rules.

UUID generator

Bulk UUID v4, v5, and nil generator with uppercase, hyphen, SQL format, validation, and download.

Hash generator

MD5 and SHA family hashes plus HMAC for text or files with hex, Base64 output, and hash compare.

JSON to YAML converter

Bidirectional JSON and YAML conversion with validation, indent options, and anchor resolution.

HTTP status codes

Searchable HTTP status reference with causes, fix guidance, class filters, and RFC notes.

Small tools you open ten times a week

Every developer has a pile of tabs for the same chores. Format this JSON. Decode that token. Test a regex. Hash a string. None of it is hard, but none of it is worth installing software for either.

These tools run in the browser and keep your input local. That matters more than it sounds. Pasting a production JWT or an API response into a random website is how secrets leak. Here, nothing is sent anywhere.

What's in the toolbox

For data formats, there's a JSON validator and formatter with line and column hints, a JSON diff viewer that colors added, removed and changed keys, and a JSON to TypeScript generator that can output interfaces, type aliases or Zod schemas.

For text and encoding, you get Base64 (standard, URL-safe and MIME), a URL encoder that follows RFC 3986 or form rules, a hash generator for MD5 and the SHA family with HMAC, and a UUID generator for v4, v5 and nil.

For debugging, there's a regex visualizer with match indexes and group captures, a JWT decoder with expiry badges and optional HMAC signature checks, and a cron builder that prints the next ten run times.

For writing, a SQL formatter handles MySQL, PostgreSQL, BigQuery and T-SQL, and a Markdown editor shows a live preview with GFM tables and task lists.

Debugging an auth problem with the JWT decoder

A user says login works on one device and fails on another. Grab the token from the failing request and paste it into the JWT decoder. You'll see the header, the payload and a badge telling you whether it's expired.

Check the exp and iat claims first. Clock drift between servers causes more auth bugs than anyone admits. A token issued two seconds in the future gets rejected by a server whose clock runs slow.

Then look at aud and iss. If they don't match what your API expects, you've found the bug without touching a log file.

If you have the secret, you can verify an HMAC signature right there. Only do that with test secrets. Real production keys shouldn't be pasted into anything you don't control, though in this case the check runs locally.

Regex and cron: two things nobody memorizes

Regex is the classic write-once, read-never language. The visualizer shows every match with its index and each capture group, plus a replacement preview. Build the pattern against real sample text, not a toy string, or you'll miss edge cases.

Watch out for greedy matches. A pattern like .* will happily swallow far more than you meant. Switch to a lazy version, or be specific about the characters you allow.

Cron has the opposite problem. The syntax is short, and one wrong field changes everything. The builder gives you a plain English summary and the next ten run times. If the list doesn't match what you pictured, fix it before it ships.

Remember that cron servers often run in UTC. A job set for 9:00 might fire at a very different local hour.

Tips that save real time

Format JSON before you diff it. Key order and whitespace create noise that hides real changes. Sort keys, then compare.

When you generate TypeScript from JSON, feed it a sample with every optional field present at least once. The generator can only mark something optional if it sees it missing somewhere. Paste two or three payloads merged together if you can.

Use v5 UUIDs when you need the same input to always produce the same ID. Use v4 when you want random.

Don't treat Base64 as security. It's an encoding, anyone can reverse it. And never use MD5 to store passwords. It's fine for checksums, nothing more.

What these tools won't do

They don't replace your editor, your linter or your test suite. They're for quick checks and one-off conversions.

Very large inputs can slow a browser tab. If you're formatting a 50 MB JSON dump, use jq or a script instead.

And the SQL formatter changes layout only. It won't fix a broken query or tell you if a column exists.

A quick workflow to try

Say you're building a feature that consumes a third-party API. Paste a sample response into the validator to confirm it's valid JSON. Generate TypeScript types from it. Diff it against last month's response to see what the vendor changed. Done in a couple of minutes, with no install and no account.

Bookmark the two or three tools you use most. They load fast, and they work offline once the page has loaded.