The Developer Toolbox
You Always Needed.

JSON Web Tokens (JWTs) are widely used for authentication in modern web APIs. When debugging an API or investigating a login issue, developers often need to quickly inspect the contents of a JWT — its header algorithm, payload claims, expiry time, and issued-at date — without writing any code. The JWT Decoder on gotomars.app lets you paste any JWT string and instantly see all three sections (header, payload, signature) decoded and formatted. It highlights the expiry (exp) and issued-at (iat) timestamps in human-readable form, making it easy to spot expired tokens at a glance. All decoding happens in your browser — the token is never sent to any server, which is critical when working with tokens that contain sensitive user claims.

JSON is the universal data format for APIs, configuration files, and databases — but raw JSON from an API response or log file is often a single minified line that's nearly impossible to read. The JSON Formatter takes any valid (or broken) JSON string and instantly formats it with proper indentation, color-coded keys and values, and collapsible nodes for large objects. It also validates the JSON and highlights exactly where syntax errors occur, which is invaluable when debugging API payloads. You can choose between 2-space, 4-space, or tab indentation, and minify JSON back to a single line for embedding in code. The tool processes everything locally with no data leaving your browser, making it safe to use even with production data containing PII.

Base64 encoding is used everywhere in software development — embedding images in CSS, encoding binary data in JSON, passing credentials in HTTP Basic Auth headers, and storing binary blobs in databases. The Base64 tool on gotomars.app supports both standard Base64 and URL-safe Base64 (which replaces + and / with - and _), making it suitable for encoding JWT signatures, OAuth tokens, and URL parameters. You can encode plain text strings or decode Base64 back to the original string instantly. The tool handles Unicode characters correctly, which is often a pain point with manual Base64 implementations. Results update in real time as you type, with a one-click copy button for the output.

Cryptographic hash functions are fundamental to security — verifying file integrity, storing passwords, signing API requests, and generating checksums. gotomars.app provides hash generators for MD5, SHA-1, SHA-256, SHA-512, and bcrypt in a single unified interface. MD5 and SHA hashes are computed instantly as you type, useful for verifying that a downloaded file matches its published checksum. The bcrypt hasher lets you set the work factor (cost), which controls how computationally expensive the hash is — higher values provide better security against brute-force attacks. Unlike online hash tools that send your input to a server-side API, all hashing on gotomars.app runs via the Web Crypto API directly in your browser, so sensitive data like passwords or API secrets never leaves your machine.

Universally Unique Identifiers (UUIDs) are the standard way to generate unique primary keys for database records, correlation IDs for distributed tracing, and idempotency keys for API requests. gotomars.app supports UUID v1 (time-based), v4 (random), and v5 (namespace-based), as well as the newer ULID format which is sortable by creation time — a major advantage for database indexing. You can generate a single UUID or bulk-generate up to 100 at once, which is useful for seeding test databases or generating fixture data. The tool also lets you toggle between uppercase and lowercase output and choose different separator formats (standard hyphenated, compact, or URN). All IDs are generated using the cryptographically secure crypto.randomUUID() browser API.

URL encoding (percent-encoding) is required whenever special characters — spaces, ampersands, equal signs, non-ASCII characters — need to be included in a URL query string or path segment. Incorrectly encoded URLs are a common source of bugs in web applications, especially when dealing with internationalized content or user-generated input. The URL Encoder/Decoder tool supports both encodeURIComponent (for individual query parameter values) and encodeURI (for full URLs), which behave differently and are often confused. It also handles decoding, turning percent-encoded strings back into readable text. This is especially useful when inspecting redirect chains, debugging OAuth callback URLs, or analyzing web server access logs that contain encoded characters.