TabTasker
Developers handle secrets all day
JWTs, API keys, passwords, hashes, encryption keys: developers work with sensitive data constantly. And the tools they use to handle it should be as secure as the data itself.
But too many developers paste JWTs into online decoders, send API keys to online formatters, and upload sensitive configs to online diff tools.
The developer tool privacy problem
Online developer tools are convenient, but they create attack surfaces:
- JWT decoders. JWTs contain payloads with user data, permissions, and sometimes secrets. Pasting them into an online tool sends that data to a server.
- JSON formatters. API responses often contain sensitive data: user information, internal URLs, configuration details.
- Diff checkers. Comparing code or configs online means sending your source code to a third party.
- Hash generators. If you're hashing passwords or secrets, the input should never leave your device.
Local dev tools exist
Here's a set of developer tools that run entirely in your browser, available at TabTasker:
- JWT Decoder: Decode headers and payloads locally
- JSON Formatter: Pretty-print and validate JSON
- Diff Checker: Compare text side by side
- Hash Generator: MD5, SHA-1, SHA-256, SHA-512
- Base64 Encode/Decode: Text and file encoding
- URL Encode/Decode: URL parsing and encoding
- UUID Generator: v1, v4, v7, and Nano IDs
- Regex Tester: Live regex matching and replacement
- Timestamp Converter: Unix, ISO, and human-readable
- Color Converter: HEX, RGB, HSL, OKLCH
- QR Code Generator: SVG and PNG export
- Cron Helper: Explain cron expressions
All of these run client-side. Your data stays in your browser.
Why this matters for developers
Developers are the people who should know better than this. You understand attack surfaces, data flows, and the principle of least privilege. Apply those same principles to your own tooling.
If you wouldn't commit an API key to a public repository, don't paste it into an online tool either.
The team angle
In a team setting, the risk multiplies. If one developer uses an online tool with sensitive data, that data is now on a third-party server. In regulated industries (finance, healthcare, government), this can be a compliance violation.
Recommend local tools to your team. The convenience difference is zero, and the security difference is everything.
The specific risk of online JWT decoders
JWTs deserve special attention. A JWT contains three base64-encoded sections: header, payload, and signature. The payload often includes user IDs, email addresses, roles, and permissions. Pasting a JWT into an online decoder sends all of that to a third-party server, one that may log, analyse, or store it.
More critically, some JWTs contain short-lived access tokens that, if intercepted, could allow account takeover before they expire. The risk is real and the vector is obvious: a developer pastes a JWT containing a live access token into an online decoder, and that token is logged server-side.
TabTasker's JWT Decoder decodes JWTs entirely in your browser using JavaScript. The token never leaves your device. You see the same header and payload you would see from an online tool, with zero exposure.
A note on hash generators
Hashing passwords or secrets online is an underappreciated risk. If you're hashing a secret value, even just to verify it, the input should never leave your device. Online hash generators receive your input, compute the hash server-side, and return the result. The input is transmitted in plaintext over HTTPS (protected in transit, but still processed server-side) and may be logged.
TabTasker's Hash Generator runs MD5, SHA-1, SHA-256, SHA-384, and SHA-512 in your browser using the Web Crypto API. Cryptographic operations happen locally. Your inputs are never sent anywhere.
Making local tools the default
The habit worth building is simple: before pasting anything into an online tool, ask whether the input is sensitive. API keys, tokens, hashes, configs, and internal JSON almost always are. Keep a bookmark folder of local alternatives and reach for those first. Your future self, and your security team, will thank you.