TOOLKIT is a precision collection of utilities for generating passwords, JWTs, API tokens, and synthetic test data — engineered for the security-conscious engineer.
> toolkit password --len 24 --symbols K8#xL2$pQ9wM4!nR7tY3vBz% > toolkit jwt --alg HS256 eyJhbGciOiJIUzI1NiIsInR5cCI6 IkpXVCJ9.eyJzdWIiOiIxMjM0NSI sIm5hbWUiOiJBZGEgTG92ZWxhY2U iLCJpYXQiOjE3MTYyMzkwMjJ9... > toolkit token --format base64url v7_a8B2dF4hJ-KmN9pQrStUv_xYzC > toolkit testdata --count 500 ✓ 500 records synthesized ✓ exported to dataset.json
CSPRNG-based passwords with configurable entropy.
RFC 7519Sign HS256/384/512 tokens in the browser.
CSPRNGRandom tokens in hex, base64url, base32, UUID v4/v7.
DATASETSynthetic identity datasets — JSON, CSV, SQL.
CSPRNGArbitrary random strings from a custom alphabet.
IDENTIFIERSGenerate and decode UUID v4/v7 and ULIDs.
WEB CRYPTOSHA-1, SHA-256, SHA-384, SHA-512 digests.
TEXTGenerate placeholder paragraphs, sentences, or words.
QRRender QR codes for any text or URL — SVG / PNG.
LUHNGenerate test credit card numbers (Luhn-valid). Non-functional.
SCHEMAGenerate mock JSON from a simple schema.
DESIGNBuild harmonious palettes from a seed color.
BCRYPTHash and verify passwords with bcrypt.
WEB CRYPTOGenerate RSA / ECDSA / ECDH keys, export PEM/JWK.
TEXTConvert strings to URL-safe slugs.
Encode and decode UTF-8 strings to Base64.
ENCODERPercent-encode and decode URI components.
ENCODEREscape and unescape HTML entities.
ENCODEREscape control characters with backslashes.
ENCODERSerialize and unserialize PHP-compatible payloads.
ENCODERConvert text and bytes to and from hexadecimal.
ENCODERConvert text to and from binary representation.
ENCODERMap characters to code points and back.
ENCODERConvert text to and from Morse code.
RFC 3492Encode and decode IDN domain names.
RFC 4648Encode and decode Base32 strings.
Pretty-print, minify, and validate JSON.
FORMATTERConvert YAML documents to JSON and back.
FORMATTERPretty-print SQL across multiple dialects.
FORMATTERPretty-print and validate XML documents.
FORMATTERFormat or minify CSS with js-beautify.
FORMATTERFormat or minify JavaScript with js-beautify.
FORMATTERFormat or minify HTML markup.
FORMATTERPretty-print GraphQL queries and SDL.
FORMATTERConvert TOML configs to JSON.
Flatten a JSON array of objects to CSV.
CONVERTParse CSV (RFC 4180) into a JSON array.
CONVERTConvert JSON documents to YAML.
CONVERTInfer a TypeScript interface from JSON.
CONVERTInfer a Go struct from a JSON sample.
CONVERTRender GitHub-flavored Markdown to HTML.
CONVERTConvert between bases 2 / 8 / 10 / 16.
CONVERTRender a Unix timestamp across formats.
camelCase, snake_case, kebab-case, Title Case, …
TESTERTest JavaScript regular expressions with live matches.
TEXTCompare two texts line by line.
TEXTCount characters, words, lines, sentences, reading time.
TEXTSort, deduplicate, reverse, shuffle lines.
TEXTTrim, collapse, and strip whitespace.
REGEXReplace text with regex and capture groups.
TEXTReverse characters, words, or lines.
Decode and inspect a JWT — header, payload, signature.
WEBParse a URL into protocol, host, query, …
WEBRender arbitrary HTML in a sandboxed frame.
WEBConvert HEX, RGB, HSL, OKLCH.
WEBParse User-Agent into browser / OS / device.
WEBLook up MIME types by extension or vice versa.
RFC 9110Reference HTTP status codes and their meaning.
SEOGenerate SEO, Open Graph, and Twitter meta tags.
APACHETest redirect rules against sample URLs.
OPENAI-COMPATIBLEChat with any OpenAI-compatible API directly from your browser.
Convert between epoch seconds/ms and ISO 8601.
TIMEDescribe and preview cron schedule expressions.
TIMEConvert a moment across IANA time zones.
TIMECalculate the distance between two dates.
TIMEAdd or subtract durations from a moment.
Naive 3-way merge of base / left / right.
QUERYQuery a JSON document with JSONPath or JMESPath.
CRONCrontab Guru–style visualization of fields.
REGEXQuick reference and snippet builder for regex.
IPv4Calculate network, broadcast, ranges, and hosts.
Every byte is computed in your browser. No telemetry, no logging, no analytics.
All randomness is sourced from crypto.getRandomValues — not Math.random, ever.
Once loaded, every tool runs without a network. Air-gap a tab and keep working.