Free developer tools that run in your browser.

Usually one of three business models, and it is worth knowing which one you are using. Ad-supported sites earn per page view, which is harmless but explains the layout. Freemium tools give away the basic conversion and gate batch processing or an API behind an account. The third model is the one to watch: tools that upload your input have a copy of it, and a privacy policy is the only thing limiting what happens next. Everything on devholster is free with no account and no paywall, because the tools run in your browser and cost us nothing per conversion.

Anything that is pure computation runs locally: formatting and converting JSON, YAML, XML, CSV and TOML, Base64 and URL encoding, hashing with SHA-256 or bcrypt, subnet math, cron parsing, regex testing, UUID and password generation. Browsers ship the primitives for all of it, including Web Crypto and WebAssembly. What genuinely needs the network is anything that asks another machine a question: DNS lookups, checking a remote host TLS certificate, whois, port scans, fetching a URL to inspect its headers. A browser also cannot open a raw socket on port 53, so DNS tools have to go over DNS-over-HTTPS to a public resolver. When a site offers a "local" tool from that second group, it is relaying through its own backend.

Watch the network, not the marketing copy. Open devtools with F12, switch to the Network tab, clear it, then paste a harmless test input and use the tool. Requests appearing at that moment, particularly a POST carrying your input in the payload, mean the data is going to a server. Two more signals: a tool that keeps working after you switch the browser to offline mode is doing the work locally, and a result that appears while you are still typing has no time for a round trip. Do this once per tool and you never have to trust a claim, including ours.

Often yes, and usually in four ways worth knowing about. Integers above 2^53 lose precision the moment they pass through JavaScript, so a 19-digit Twitter or Discord ID comes back wrong. Keys that look like integers get reordered, because JavaScript objects list "2" before "10" regardless of how you wrote them. A trailing zero disappears, so 1.0 becomes 1 and 19.50 becomes 19.5. Duplicate keys silently collapse to the last one. YAML adds its own: an unquoted NO becomes false and 1.10 becomes the number 1.1. Formatting a file is not a safe no-op, which is why it is worth using a tool that tells you what it changed.

Yes, and for anything scripted or repeated you should. jq handles JSON, yq covers YAML and can convert between both, Python has json.tool and tomllib built in, coreutils gives you base64, sha256sum and uuidgen, and csvkit covers the CSV side. The command line wins whenever the job runs more than once, belongs in a pipeline or touches a file too large to paste. A browser tool wins for the one-off: an unfamiliar format, a payload you want to read rather than transform, or a machine where you are not going to install anything.

Several, and they are the right answer if you work in an air-gapped environment. DevToys is a desktop app for Windows, macOS and Linux with a similar tool set. CyberChef from GCHQ runs as a single downloadable HTML file, so you can keep a copy on a USB stick and open it with no network at all. Most editors cover the common cases through extensions. Browser-based tools sit between those and a web service: nothing to install, but the page still has to load once, after which it keeps working with the connection off.

With client-side tools, yes: input never leaves your machine and is not logged, so pasting proprietary code is comparable to pasting it into a local editor. With upload-based tools you should assume the operator can read your input, so check how a tool works before you paste anything covered by an NDA. If you cannot tell, the Network tab settles it in ten seconds, and some employers resolve the question for you with a policy that forbids paste boxes entirely.

It can, and the deciding factor is whether the data leaves your machine. Pasting customer records into a tool that uploads them is a transfer to a third party, which needs a legal basis and a data processing agreement, and if the operator sits outside the EU it needs a transfer mechanism as well. Most free tools offer none of that, and the paste itself is what triggers the obligation, not what the operator does afterwards. A tool that processes in your browser stays outside all of it, because no data is transmitted and no third party is involved, which is the same reasoning that makes a local text editor unproblematic.

Yes. Once a tool page has finished loading, it needs no connection: you can switch to flight mode and keep converting, minifying or generating. The exception is the DNS tools, which have to ask a public resolver over the network, and they say so on the page. The privacy claim and the offline behaviour are the same fact seen from two sides, since a tool that never phones home has no reason to be online.