URL encoding, explained — why your %20 keeps breaking
The %20 vs + space confusion, the %2520 double-encoding bug, and which encode function to actually use.
Read postwhoami — a tiny toolbox for developers
Decode a JWT before it bites you in production. Untangle cron syntax. Hash a file, look up a status code, write a commit message you won't regret — all inside your browser tab. Nothing ever leaves it.
the toolbox
Everything below runs on your machine. Bookmark once, use forever.
Paste a token and see what's actually inside — header, claims, expiry — decoded the moment you hit paste. It flags expired tokens and malformed segments before they waste an afternoon.
Open the decoderCron is a write-only language. Build expressions with plain inputs, read them back in English, and preview the next five run times — no man page required.
Build an expressionMD5 through SHA-512, from text or files. Checksum a release, verify a download, compare digests — computed locally, case-toggled, one-click copy.
Generate a hashEvery status code with what it actually means and who's responsible — your browser, your server, or the proxy in the middle. Searchable, filterable, opinionated.
Look up a codePick a type, add a scope, flag the breaking change, copy the message. Conventional Commits without the syntax anxiety — your future self will thank you.
Write a commitwhy this exists
These tools are plain JavaScript executing on your machine. There's no API to fall over, no rate limit, no queue. Close the tab and the whole thing is gone.
No analytics, no cookies, no phone-home requests. Paste a production JWT if you want to — there's physically nowhere for it to go. View source and verify.
No framework, no build pipeline, no two-megabyte bundle. The entire site weighs less than a single photo from your phone — it loads instantly even on hotel Wi-Fi.
No account, no trial, no premium tier waiting to happen. Just tools you bookmark once and stop thinking about — the way a utility should work.
under the hood
Most "free online tools" are data pipelines with a UI bolted on. Stackblip is the opposite: plain HTML, CSS and JavaScript, served to your browser and executed there. No framework, no build artifacts, no analytics SDK whispering home about what you pasted.
The entire site is lighter than a single photo from your phone, and every byte of it is readable with View Source. If this page ever claims something the Network tab can't prove, call it out.
Verify it yourself: DevTools → Network tab → reload. Count the requests that aren't fonts. We'll wait.
$ stackblip --system-report
$
who this is for
exp claim, and get back to your night.
JWT Decoder
> devops_eng
Is 0 5 * * 1 "Mondays at 5" or "the 1st, at 5"? Know before it pages you — the OR rule bites exactly once per career.
Cron Builder
> frontend_dev
Your bug or the API's bug? Look up the code and find out whose fault this actually is — browser, server, or the CDN in between.
Status Lookup
> cs_student
First open-source PR? Make the commit message the best part of it — conventional from day one, zero syntax anxiety.
Commit Generator
faq
Anything else — the contact page is open.
Yes. There's no paid tier and no plan to add one. The site may show a few unobtrusive ads eventually — that's the whole business model, and it stays out of your way.
The tools run entirely in your browser — your input is never sent anywhere, which you can confirm in the network tab or the source code. That said, treat any pasted secret as sensitive on principle: your machine, your call.
No. No extension, no CLI, no npm install. Open a page and use the tool. Once loaded, most tools even keep working offline.
Five: a JWT decoder, a cron expression builder, a multi-hash generator, an HTTP status code lookup, and a conventional commit generator. Each one has its own page under Tools.
Absolutely — that's what the contact page is for. If it's useful, runs client-side, and doesn't need your data, it's a candidate.
tail -f blog.log
Field notes on the stuff the tools solve — scroll for more →
The %20 vs + space confusion, the %2520 double-encoding bug, and which encode function to actually use.
Read postWhat a .env file actually is, why git history makes leaked secrets permanent, and what to do if you've already committed a key.
Read postThe root-to-authoritative journey, what TTL really controls, why "propagation" is a myth, and how to debug it with dig.
Read postTwo swapped characters and some missing padding — the whole difference, and why atob() chokes on your JWT.
Read postThe types you'll actually use, scope discipline, the 50-character rule, and copy-paste examples for your next PR.
Read postMAJOR breaks, MINOR adds, PATCH fixes. The 0.x phase, what ^ and ~ bet on, and how Conventional Commits automate it.
Read post