Developer Toolbox
Six client-side developer utilities: Base64, JWT decode, text hashing, timestamps, Cron explanation, and URL encoding.Processed locally · input never uploaded
Operations
Base64 text encode / decode
Encode text to standard Base64 or base64url from UTF-8 bytes, or strictly decode back. Chinese and emoji round-trip intact; illegal characters, bad padding, non-canonical trailing bits and invalid UTF-8 all raise explicit errors.
JWT decode / inspect
Base64URL-decodes and JSON-parses the header and payload of a three-segment JWT and renders iat/exp/nbf as UTC. **Decode only — signature is NOT verified**, never marked signature-valid; damaged or non-JSON segments are recorded explicitly.
Text hash (MD5 / SHA-1 / SHA-256)
Real MD5, SHA-1 and SHA-256 hex digests computed in plain JS over UTF-8 input. Fixed vectors are checked against both node:crypto and literal strings in tests; browsers and Node share the same code.
Unix timestamp converter
Convert between Unix seconds, milliseconds and zone-aware ISO times. Explicitly labels epoch 0, s/ms units, UTC (Z) and the chosen time zone so local wall-clock time is never mistaken for UTC.
Cron expression explainer
Parses strict 5-field Vixie cron (minute hour day-of-month month day-of-week), expands each field and lists up to 20 upcoming UTC matches from a start instant. Out-of-range values, wrong field counts, macros and bad steps give explicit results; no real scheduled job is ever registered.
URL encode / decode
Clearly separates encodeURI (preserves URL structure) from encodeURIComponent (escapes structural characters), plus application/x-www-form-urlencoded form encoding. Only form decoding treats + as a space; %2B always remains a literal plus.
Real examples and limits
Default input cap is 1 MiB (UTF-8 bytes), reduced per operation: Base64 / hash / URL-encode 1 MiB, JWT 64 KiB, timestamp 256 bytes, Cron 2 KiB. Oversized input yields INPUT_TOO_LARGE and keeps your text. JWT is decode-only (no signature verification); MD5/SHA-1 are collision-prone and unsuitable for security; Cron only explains, never schedules; timestamps mark UTC with Z. All computation is local: no network, no eval, no keys, no persistence of input by default.
FAQ
Is my input uploaded?
No. All six operations are pure string functions; the shipped logic contains no fetch/apiFetch call and no eval. JWT and password-like samples never enter analytics, URLs, or logs.
Does the JWT tool verify signatures?
Absolutely not, and it never labels a token as signature-valid. It only Base64URL-decodes and JSON-parses the header/payload. Every report states "解码不验证签名 / Decode only — signature is NOT verified" and signatureVerification=NOT_PERFORMED. A well-formed token is not a trusted token.
Why not WebCrypto for hashing?
To share one code path between browsers and Node and to support MD5/SHA-1, all three digests are implemented in plain JS; tests compare them against node:crypto and literal fixed vectors. A WebCrypto (crypto.subtle) SHA-256 path could replace it later, but that was not done this round and is not browser-verified.
Does Cron create a scheduled job?
No. The shipped module contains no setTimeout / setInterval / Worker / crontab invocation and no scheduling API call. It only parses a strict 5-field expression and computes UTC matches inside a bounded 366-day scan.
Is my input persisted by default?
No. Input text is not persisted by default. If drafts are enabled later they use the al:dev:v1:<purpose> namespace and only clear this site's own keys. Service Worker is off by default.
Does it work offline?
The artifact is plain static HTML/CSS/ESM with zero third-party runtime dependencies and no network calls in the logic. This round has no browser binary, so offline behavior and 390/768/1440 widths are not measured and need browser-based acceptance.