Developer utilities

Short answer: To format JSON, encode Base64, generate a hash or encode a URL, use the matching utility and copy the result when it is ready. QuickMerge handles the value locally in your browser, so pasted data is not sent to a server.

Small tools for the things you would otherwise paste into a random website. These run entirely in the page, which matters when the string you are debugging is a token, a payload or a customer record.

8 tools in this canonical category. Supported operations use local browser processing; see how to inspect a specific workflow.

Inspect and format

  • JSON formatter — Beautify and validate JSON with error positions.
  • JSON minifier — Strip whitespace from JSON and see the byte saving.
  • Hash generator — Hash text or file bytes with MD5 or SHA, then compare a published checksum.

Encode and decode

  • Base64 encoder — Encode UTF-8 text or file bytes as standard, URL-safe or data-URI Base64.
  • Base64 decoder — Decode Base64 to plain text, hex or formatted JSON.
  • Base64 to image — Turn a Base64 string back into the file it encodes.
  • URL encoder — Percent-encode or decode URLs and query parameters.
  • vCard QR generator — Build a QR code that adds contact details in one scan.

Why run these locally

Every one of these has a hundred equivalents a search away, and most of them are fine. The difference is what happens to the string you paste. A JWT, an API response, a webhook payload or a customer record pasted into an online formatter has been transmitted to, and possibly logged by, a third party you know nothing about.

These run in the page. Nothing you paste is sent anywhere, which you can confirm in DevTools in about two minutes. That is the entire argument for using them — not that the formatting is better, but that the payload does not leave your machine.

Choosing a hash for the job

MD5 and SHA-1 are still here because checksums and legacy system matching are real work: verifying a downloaded file, or comparing against a value some older system already stores. Both are broken for anything adversarial and neither should be used for signatures.

SHA-256 is the sensible default when you need a cryptographic digest. None of these — including SHA-256 — is appropriate for password storage, which needs a deliberately slow algorithm such as bcrypt, scrypt or Argon2. A fast hash is exactly the wrong tool there, and that is a design property rather than an implementation detail.

Encoding is not encryption

Base64 and percent-encoding both make text safe to move through a channel that would otherwise mangle it. Neither conceals anything: Base64 is trivially reversible by anyone, and treating it as obfuscation is a recurring source of leaked credentials.

The practical uses are narrower and worth knowing. Base64 carries binary through text-only transports — data URIs, email attachments, JSON string fields. Percent-encoding keeps reserved characters from breaking a URL, which is why an ampersand inside a query value has to be encoded or it terminates the parameter early.

Guides for these tools

  • Proof of privacy — How to confirm with DevTools that a pasted string is not transmitted.

Questions people ask

Are these tools safe for secrets?

The tools do not transmit what you paste. That said, treat any browser page as untrusted for production credentials: rotate anything you paste anywhere, here included.

Why is MD5 still offered?

MD5 and SHA-1 remain useful for checksums and for matching against legacy systems. Neither is suitable for password hashing or signatures.

Is it safe to paste a JWT or API key here?

Nothing you paste is transmitted, so it is safer than a server-side tool. Even so, treat any browser page as untrusted for production credentials and rotate anything you paste anywhere, this site included.

Which hash should I use for passwords?

None of these. Password storage needs a deliberately slow algorithm such as bcrypt, scrypt or Argon2. MD5, SHA-1 and SHA-256 are all fast by design, which is what makes them wrong for the job.

Is Base64 a way to hide data?

No. It is an encoding, reversible by anyone in one step. It makes binary safe to move through text-only channels; it provides no confidentiality whatsoever.

When do I need to URL-encode something?

Whenever a value contains characters with meaning in a URL — ampersands, question marks, slashes, spaces or non-ASCII text. An unencoded ampersand inside a query value silently terminates that parameter.

Why does my JSON fail to parse?

Most often a trailing comma, a single quote where JSON requires double, or an unescaped character inside a string. The formatter reports the position of the first error, which is usually a line or two after the real mistake.

Other categories