<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[DevClat Blog]]></title><description><![CDATA[DevClat Blog]]></description><link>https://omnistack.hashnode.dev</link><image><url>https://cdn.hashnode.com/res/hashnode/image/upload/v1593680282896/kNC7E8IR4.png</url><title>DevClat Blog</title><link>https://omnistack.hashnode.dev</link></image><generator>RSS for Node</generator><lastBuildDate>Tue, 08 Sep 2026 20:34:52 GMT</lastBuildDate><atom:link href="https://omnistack.hashnode.dev/rss.xml" rel="self" type="application/rss+xml"/><language><![CDATA[en]]></language><ttl>60</ttl><item><title><![CDATA[Stop Pasting Your JWT Tokens Into Random Websites ]]></title><description><![CDATA[I built a 21-tool developer toolkit that runs entirely in your browser. No servers. No sign-ups. No data leaving your machine. Ever. Here's why, and here's what it does.

You're debugging a broken API]]></description><link>https://omnistack.hashnode.dev/stop-pasting-your-jwt-tokens-into-random-websites</link><guid isPermaLink="true">https://omnistack.hashnode.dev/stop-pasting-your-jwt-tokens-into-random-websites</guid><category><![CDATA[React]]></category><category><![CDATA[Security]]></category><category><![CDATA[Open Source]]></category><category><![CDATA[privacy]]></category><category><![CDATA[development]]></category><dc:creator><![CDATA[borre ddev]]></dc:creator><pubDate>Sun, 28 Jun 2026 12:08:44 GMT</pubDate><enclosure url="https://cdn.hashnode.com/uploads/covers/6a3fe055a2eb562b8b479d6f/1cef54fd-508e-439b-ad4b-9d9ce887ca4e.png" length="0" type="image/jpeg"/><content:encoded><![CDATA[<p>I built a 21-tool developer toolkit that runs entirely in your browser. No servers. No sign-ups. No data leaving your machine. Ever. Here's why, and here's what it does.</p>
<hr />
<p>You're debugging a broken API response at 11 PM. You've got a JWT token in your clipboard, a JSON payload that won't parse, and a CSS-to-Tailwind conversion you've been putting off since Tuesday.</p>
<p>So you open a random "online JSON formatter" from Google. Paste your JWT into a text box labeled "Enter your token here." Click "Decode."</p>
<p>Somewhere, on some server you'll never see, your token is now stored. Along with the 200 other things you've pasted into that tool this month.</p>
<p><strong>That's the problem I kept running into.</strong> And it's not just JWT tokens. It's API keys in Base64, test data in JSON, regex patterns you don't want logged, passwords you definitely shouldn't be typing into a random input field.</p>
<p>So I built something different.</p>
<h2>What is DevClat?</h2>
<p><strong>DevClat is a free, open, client-side developer toolkit with 21 tools</strong> — and every single one runs in your browser. No backend. No API calls. No "we take your privacy seriously" banner over a tracking script.</p>
<p>It's a single-page React app. You open it, use it, close it. Your data never touches a server because there is no server.</p>
<p><strong><a href="https://devclat.vercel.app">Try the DevClat Developer Toolkit →</a></strong></p>
<h2>The Tools (All 21 of Them)</h2>
<p>I didn't build 21 "me too" utilities. Each tool exists because I personally needed it and got tired of context-switching between 15 browser tabs.</p>
<h3>Data Generation</h3>
<p><strong>Mock Data Generator</strong> — The one that started it all. Pick a preset (Users, Products, Orders, Addresses, Transactions, Posts, Employees, Invoices, Reviews) or build a custom schema with any field type. Output as JSON, CSV, or SQL. Powered by faker.js, running entirely client-side. Generate 100 rows of realistic fake data without sending a single byte over the network.</p>
<p><strong>Lorem Ipsum Generator</strong> — Not the usual "lorem ipsum dolor sit amet" generator. Configure paragraph count, copy with one click, done. You've got bigger things to worry about than placeholder text.</p>
<h3>Editors &amp; Formatters</h3>
<p><strong>JSON Formatter &amp; Validator</strong> — Paste broken, minified, or malformed JSON. Get instant pretty-printing, syntax highlighting, and error line highlighting. Collapsible tree view for large payloads. One-click copy. No "Loading..." spinners, no "Your JSON has been saved for analytics."</p>
<p><strong>Text Diff Tool</strong> — Git-diff style comparison without opening a terminal. Side-by-side view with line-level and word-level highlighting. Unified, split, and words output modes. A statistics panel that actually tells you what changed. Perfect for comparing config files, API responses, or that SQL migration you're afraid to run.</p>
<p><strong>Regex Tester</strong> — Type a pattern, see matches highlighted in real-time. Toggle flags (g, i, m, s, u) without rewriting your regex. Capture groups displayed inline. No more running <code>grep</code> in the terminal just to test if your email regex actually works.</p>
<p><strong>HTML Preview Editor</strong> — Side-by-side HTML/CSS/JS editor with instant live preview. Full-page preview mode for when you need to see what your component actually looks like without deploying.</p>
<p><strong>Markdown Preview</strong> — Write Markdown on the left, see rendered HTML on the right. Real-time. Supports tables, code blocks, headings, links. Zero friction.</p>
<p><strong>CSS Minifier</strong> — Paste CSS, get compressed output. Side-by-side size comparison so you can feel smug about those extra 2KB you just saved.</p>
<h3>Converters</h3>
<p><strong>CSS to Tailwind Converter</strong> — This one's special. Paste raw CSS, get Tailwind utility classes. 200+ property mappings, dark mode support, arbitrary value handling, color palette resolution, and <code>@media</code> block support. Bidirectional — paste Tailwind, get CSS back. I use this daily.</p>
<p><strong>Base64 Encoder/Decoder</strong> — Real-time conversion. Full Unicode support. One-click copy. Encoding <code>eyJhbGciOiJIUzI1NiJ9</code> shouldn't require a three-step process.</p>
<p><strong>URL Encoder/Decoder</strong> — Encode and decode URL components instantly. Handles query parameters, path segments, and special characters. Works in both directions.</p>
<p><strong>JWT Token Decoder</strong> — Paste any JWT, see the header, payload, and signature decoded instantly. Check expiration, algorithm, and claims. Nothing leaves your browser. This is the tool I wish existed three years ago.</p>
<h3>Design Tools</h3>
<p><strong>CSS Gradient Builder</strong> — Linear, radial, and conic gradients with draggable color stops, angle control, and live preview. Copy the CSS output. No more guessing what <code>linear-gradient(135deg, #667eea 0%, #764ba2 100%)</code> actually looks like.</p>
<p><strong>Box Shadow Generator</strong> — Multi-layer support, inset mode, blur, spread, and offset. Live preview with copy-ready CSS output. Build complex shadow systems without opening Figma.</p>
<p><strong>Color Contrast Checker</strong> — WCAG 2.1 AA and AAA compliance checking. Enter foreground and background colors, get instant pass/fail results. Accessibility compliance without the accessibility audit.</p>
<h3>Generators</h3>
<p><strong>QR Code Generator</strong> — Enter text or URL, get a downloadable PNG. Canvas-based rendering, no watermarks. Works offline.</p>
<p><strong>Password Generator</strong> — Cryptographically strong passwords with configurable length, character types, and a real-time strength meter. The kind of password generator that actually generates <em>strong</em> passwords.</p>
<p><strong>UUID Generator</strong> — Batch generate up to 100 UUID v4 identifiers. Standard (hyphenated) or compact format. One click, done.</p>
<p><strong>Timestamp Converter</strong> — Unix timestamps to human-readable dates and back. Supports seconds and milliseconds, ISO 8601, and custom date formats. Finally, a timestamp tool that doesn't make you count zeros.</p>
<h3>Utilities</h3>
<p><strong>Flexbox &amp; Grid Playground</strong> — Drag and drop elements to build flexbox and grid layouts visually. See the Tailwind output update in real-time as you adjust gaps and alignment. Learn CSS layout without reading MDN for the 47th time.</p>
<p><strong>Text Tokenizer</strong> — Count tokens, words, characters, and lines. Visual token breakdown shows exactly how your text gets tokenized. Essential for LLM prompt engineering and staying within context windows.</p>
<h2>The Interactive Terminal (My Favorite Feature)</h2>
<p>Here's something you won't find in any other web-based dev tool: <strong>a working terminal.</strong></p>
<p>DevClat has a mock CLI built right into the homepage. Type <code>help</code> to see available commands. Type <code>open generator</code> to switch tools. Type <code>list</code> to see everything available.</p>
<p>It auto-types a demo command when you load the page — <code>devclat mock-data --users 3 --format json</code> — and shows you the output in real-time with syntax-highlighted JSON.</p>
<p><strong>This isn't a gimmick.</strong> It's a deliberate UX choice. Instead of forcing you to click through a grid of icons to find what you need, the terminal gives keyboard-first users a fast, predictable way to navigate. Type a command, get a result. No hunting, no scrolling.</p>
<p>Click "Try CLI" and the terminal focuses, auto-types <code>help</code>, and shows you exactly how to interact with it.</p>
<h2>How It's Built</h2>
<p>I'm not going to pretend this is rocket science. The architecture is deliberately simple:</p>
<ul>
<li><strong>React 19</strong> for the UI</li>
<li><strong>Vite 6</strong> for the build</li>
<li><strong>Tailwind CSS 4</strong> for styling</li>
<li><strong>faker.js</strong> for mock data generation</li>
<li><strong>qrcode</strong> library for QR code rendering</li>
</ul>
<p>Every tool is a standalone component. Navigation is managed via a single <code>activeTool</code> state variable — no client-side router, no URL history, no complex state management. Switching tools is instant because everything is already loaded.</p>
<p>The theme system uses CSS variables synced with a JavaScript constants file. Dark mode is default. Light mode works. Both are clean.</p>
<p><strong>The key insight:</strong> you don't need a backend for developer tools. Every tool I listed above can be implemented entirely with JavaScript string manipulation, DOM APIs, and browser-native features. The moment you add a server, you add latency, complexity, privacy concerns, and a maintenance burden. I chose none of those.</p>
<h2>Why This Matters</h2>
<p>There are hundreds of "free online developer tools" out there. Most of them are:</p>
<ul>
<li><strong>Ad-supported</strong> — banner ads, pop-ups, and "disable your ad blocker" notices</li>
<li><strong>Server-dependent</strong> — your data gets sent somewhere, processed, and (maybe) deleted</li>
<li><strong>Tracker-heavy</strong> — analytics scripts, fingerprinting, and retargeting pixels</li>
<li><strong>Offline-hostile</strong> — try using them on a plane or a spotty coffee shop WiFi</li>
</ul>
<p>DevClat is none of these things. It's a static site. There's nothing to track because there's nothing to send. It works offline because there's nothing to fetch. It's fast because there's nothing to wait for.</p>
<p><strong>Privacy isn't a feature. It's the architecture.</strong></p>
<h2>What's Next</h2>
<p>I'm adding more tools. The architecture scales trivially — create a component, add it to the tool list, done. Some ideas in the pipeline:</p>
<ul>
<li>CSS variable inspector</li>
<li>API response mock server (local, via Service Worker)</li>
<li>Diff viewer for entire files</li>
<li>More data presets for the mock generator</li>
</ul>
<p>If you've got ideas, or if you want to contribute, the project is built to be extended.</p>
<h2>Try It</h2>
<p>No sign-up. No "free trial." No credit card. Just tools.</p>
<p><strong><a href="https://devclat.vercel.app">Open the Free DevClat Toolkit →</a></strong></p>
<p>Paste a JWT token. Generate some fake data. Convert CSS to Tailwind. Build a gradient. Check a password's strength. Whatever you need — it's all client-side, all private, all free.</p>
<hr />
<p><em>Built with React, Vite, and a deep distrust of random web utilities that ask you to paste your API keys.</em></p>
]]></content:encoded></item></channel></rss>