Developer tools for API developers
Debug tokens, payloads, headers and webhooks without uploading sensitive request data. These tools and workflows run locally in your browser, so you can inspect production traffic safely while building and testing APIs.
Run the API Response Debugger workflow → Browse JSON & API tools →
Launch a tool
Tip: press 1–8 to open one- 1JWT DecoderDecode JWTs locally and verify HMAC signatures with a supplied secret.
- 2Webhook VerifierVerify Stripe / GitHub / Slack HMAC signatures.
- 3cURL ConverterConvert curl to Fetch, Axios, Python, Java, Node.
- 4JSON Schema ValidatorValidate JSON documents against a Draft-7 / Draft-2020 schema.
- 5JSON FormatterValidate, pretty-print, minify with tree view and secret detection.
- 6URL ParserParse URL parts, edit query params in a grid, rebuild.
- 7HTTP HeadersParse / edit headers in a grid, detect duplicates.
- 8Regex TesterPattern builder with presets and live match highlighting.
Run a workflow right here
Runs locally — nothing is uploadedAPI Response Debugger
Format an API response and flag any secrets accidentally left in the payload.
json-formatter → secrets-scannerJWT Inspector
Decode a JWT's header and payload locally. Signature is NOT verified.
jwt-decoder → json-formatterJWT Claims Secret Scan
Decode a JWT's claims locally and scan them for embedded secrets before sharing. Signature is NOT verified.
jwt-decoder → secrets-scannerTrack a checklist
Progress is saved on this deviceDaily tasks, guides & FAQ
Common daily tasks
- Decode and inspect bearer tokens during auth debugging
- Pretty-print and validate JSON API responses
- Verify Stripe, GitHub and Slack webhook signatures
- Validate a payload against a JSON Schema
- Convert a cURL command into client code
- Sanitize a request log before pasting it into a ticket
Recommended workflows
- API Response Debugger — format a response and flag any secrets left in the payload.
- JWT Inspector — decode a token's header and claims locally.
- JWT Claims Secret Scan — decode claims and flag embedded secrets before sharing.
Top tools
JWT Decoder
Inspect token header and claims locally while debugging auth.
Decode a JWT →Webhook Signature Verifier
Recompute Stripe/GitHub/Slack/RSA signatures to find why a webhook fails.
Verify a webhook →cURL Converter
Turn a cURL command into fetch, Axios or Python requests code.
Convert cURL →JSON Schema Validator
Validate a payload against Draft 7 / 2019-09 / 2020-12 schemas.
Validate a schema →See the full JSON & API contract tool cluster →
Why browser-local matters for API developers
API debugging means handling bearer tokens, signing secrets and real request bodies. Everything runs 100% in your browser — no analytics scripts, no cookies, no third-party requests. We count anonymous visits at the CDN edge only. That means you can inspect production traffic without sending credentials to a third-party service.
FAQ
Do these API tools send my payloads to a server?
No. Everything runs 100% in your browser — no analytics scripts, no cookies, no third-party requests. We count anonymous visits at the CDN edge only. Tokens, request bodies, and secrets stay on your machine.
Can I decode and inspect a JWT without uploading it?
Yes. The JWT Decoder parses the header and payload claims locally so you can check issuer, audience and expiry while debugging auth, and you can scan the claims for accidental secrets before sharing.
How do I debug a failing webhook signature?
Use the Webhook Signature Verifier. Paste the raw body, the signing secret and the signature header to recompute the signature and see exactly why a Stripe, GitHub, Slack or custom signature does not match.
Can I turn a cURL command into code?
Yes. The cURL Converter turns a copied cURL command into fetch, Axios, Python requests and other client code, which is handy when moving from a quick test to a real integration.
Related
- Security engineers — sanitize logs, scan secrets, verify signatures.
- Data / QA engineers — compare exports and clean datasets.
- JSON & API contract tools — the full tool cluster.
- Verify a Stripe webhook signature