Cron expressions, regular expressions, JSON Web Tokens, and identifiers — the four things that get pasted into a search box mid-task, usually along with something that should never leave your machine. All four run entirely in your browser: the token you are debugging, the pattern you are refining, and the identifiers you generate stay on this device.
- 01
Get a schedule right before it deploys
Build the expression field by field, read the plain-English explanation, and check the next runs in your own time zone — the fastest way to catch a job that would have fired at 04:00 UTC instead of 04:00 local.
- 02
Debug an auth failure
Paste the token, read the claims and the expiry in local time, and verify the HMAC signature against the shared secret without sending a production credential to a website.
- 03
Refine a pattern against real input
Test the expression on a sample, inspect what each capture group actually captured, preview the replacement, then copy the equivalent snippet for JavaScript, Python, or Go.
- 04
Seed a database
Generate a bulk run of UUID v7 or ULID values, confirm the embedded timestamps decode as expected, and export as JSON or NDJSON straight into a fixture file.
Secrets stay on your machine
JWT decoding and signature verification use the Web Crypto API in the page. A token, its payload, and the signing secret are never transmitted — which is the difference between debugging a production credential and leaking one.
Cron explained field by field
Both POSIX and AWS dialects are supported, each field is described in words, and the upcoming executions are listed in the time zone you choose, so an off-by-one-hour schedule shows itself before deployment.
Capture groups you can see
The regex tester lists each match with its groups, named groups included, and previews the replacement string live, so a substitution can be confirmed before it touches a file.
Modern identifier formats
UUID v7, ULID, NanoID, and CUID sit next to UUID v4, and the time-ordered formats have their embedded timestamps decoded — which is the property that makes them index-friendly in the first place.
Bulk output ready to paste
Identifiers generate in bulk and export as JSON or NDJSON. Randomness comes from the browser's cryptographic source, not from `Math.random`.
No account, no rate limit
Nothing here is metered, because nothing here runs on a server. The tools work offline and keep working however many tokens you decode.
Is it safe to paste a JWT into this tool?
Safer than into most: decoding and verification happen in your browser with the Web Crypto API, and no request carries the token anywhere. That said, a token pasted anywhere is a token on screen — for a live production credential, rotate it when you are done debugging.
What does a cron expression like `0 9 * * 1-5` mean?
Minute 0, hour 9, any day of the month, any month, days of the week 1 through 5 — so 09:00 every weekday. The builder spells that out field by field and lists the next runs in your time zone, which is where most cron surprises actually live.
Why choose UUID v7 over UUID v4?
Version 7 puts a millisecond timestamp in the leading bits, so generated IDs sort by creation time. That keeps database index inserts sequential rather than scattering them, while keeping the uniqueness properties of a random UUID.
Which regex flavour does the tester use?
JavaScript's own engine, so what you see is exactly what will run in a browser or in Node. It also emits the equivalent snippet for other languages, which is a starting point rather than a translation: lookbehind and named-group syntax differ between engines.
Can these tools verify a token signed with RS256?
Signature verification covers HS256, HS384, and HS512 — the HMAC family, where one shared secret is enough. RSA and ECDSA tokens still decode fully, with the header, claims, and expiry shown; only the signature check requires the public key workflow.
Does anything I paste get logged?
No. There is no server-side component to these tools at all. Everything is computed in the page, and closing the tab discards it.