About CodeKit
The Developer's Daily Toolbox
Development work is full of two-minute detours. You paste a JWT into a terminal to remember the flags for decoding it. You bounce between three browser tabs to format JSON, encode a URL, and hash a string. You re-discover, for the fifth time this month, that PEM keys need 64-character line wrapping or half the deployment tools reject them. None of it is hard. All of it adds up.
CodeKit is the toolbox that sits next to your editor for those detours. Open a tab, pick the tool, paste, copy the result, close the tab. No install, no account, no "paste your secret here and we'll process it in the cloud."
Why We Built CodeKit
The breaking point was a single afternoon spent jumping between a Base64 decoder, a JWT inspector, a JSON formatter, and a regex tester β four tabs, four UIs, four sets of keyboard shortcuts, and the same secret token pasted into all of them. We wanted one place that held the whole workflow, so the output of one step could feed the next without a copy-paste relay.
That place turned into 27 tools, grouped the way a developer's day actually flows:
Encode & decode π€
Base64 (with URL-safe variant), URL/percent-encoding, HTML entities, hex, UTF-8, Unicode escapes, MIME encoded-words, and a number-base converter for bin/oct/dec/hex.
Hash & crypto π
Hash generator (MD5, SHA-1, SHA-256, SHA-512), HMAC signer, RSA/PEM key formatter, and a JWT decoder that splits header, payload, and signature.
Developer utilities π οΈ
Regex tester with capture groups, cron expression parser with next-run preview, Unix timestamp converter, UUID v4/v7 generator, password generator, QR code generator, color converter, Lorem Ipsum filler, and a live Markdown previewer.
Format & convert π
JSON, XML, SQL, and YAML formatters; CSV β JSON and YAML β JSON converters; and a text diff for spotting what changed between two versions.
Pipeline: Chain Operations Together
The pipeline editor is the part that makes CodeKit more than a list of tools. Drop a few steps onto the canvas β Base64-decode, then URL-decode, then JSON-format β and the output of each becomes the input of the next. A token that arrived triple-encoded unwinds in one click. A webhook payload goes from raw bytes to readable JSON without you playing clipboard relay.
Pipelines are shareable: serialize the steps into a URL, hand it to a teammate, and they get the exact same transformation in their browser. It's the difference between describing a five-step process in a Slack message and just sending someone the process itself.
Local-First for Sensitive Data
Half of what runs through a developer tools site is sensitive: JWTs that carry user claims, API keys, HMAC secrets, private keys, hashed passwords. Pasting any of that into a site that ships it off to a server is a quiet security incident waiting to happen.
CodeKit has no backend that sees your input. Every encoding, decoding, hash, and HMAC is computed in your browser by the same JavaScript you can read in the page source. The hashing runs in a Web Worker so the UI stays responsive on large inputs, but the data never leaves the tab. Your tokens and keys stay yours.
Open Standards, No Lock-in
Every format CodeKit reads or writes is a documented standard β Base64 (RFC 4648), JWT (RFC 7519), PEM (RFC 7468), UUID (RFC 4122), URL encoding (RFC 3986). There's no proprietary format, no account that holds your history, no cloud workspace you'd lose by switching tools. If you ever stop using CodeKit, everything you made with it still works in any other standards-based tool. Built with Astro, Vue 3, and Tailwind CSS; deployed on Cloudflare Pages.