ToolDeck

Changelog

How ToolDeck grew from a handful of paste boxes into developer tools that never see your data — with dates, not slogans.

Newest first. For who builds this and how to verify privacy, see About.

  1. Sysadmin tools and long-tail guides

    • Added chmod calculator, IPv4 CIDR/subnet calculator, cron explainer, HTTP status reference, MIME type lookup, user-agent parser, and a .gitignore builder from public templates.
    • Certificate decoder shows subject, issuer, SANs, validity and fingerprint from a PEM — still without claiming the chain is trusted.
    • cURL converter turns a command into fetch or Python requests without sending the command anywhere.
    • Published long-tail guides under the tools they explain: Base64URL and UTF-8/btoa, MD5 vs passwords, htpasswd hash formats, chmod and cron syntax, JWT decode vs verify, Unix seconds vs milliseconds, and common JSON errors.
    • Added IndexNow: ownership key at the site root, `npm run indexnow` to submit the sitemap, and a public webhook at `/api/webhooks/indexnow` (secret query, Bearer, or Vercel signature) that only fires for production deploys.

  2. IDs, tokens and time

    • UUID (v4 and v7), ULID, Nano ID / random token, and random number generator, all from the browser’s secure random source.
    • Unix timestamp converter covers seconds through nanoseconds, with UTC and local time.
    • JWT decoder reads header and payload and turns exp / iat / nbf into dates. Signature verification is deliberately not offered.

  3. Formats that talk to each other

    • JSON↔YAML, CSV↔JSON, XML↔JSON, .env↔JSON, and a CSV validator that flags broken quotes and wrong field counts.
    • JSON Schema validator (drafts 2020-12 through 4) with instance paths on every error.
    • Sample JSON generator for fixture data using reserved example domains.
    • SQLite playground: in-memory sql.js (WASM), open a local .sqlite file, export results as CSV. The database never leaves the tab.

  4. Text toolkit expansion

    • Diff checker, JavaScript regex tester, case converter, word/character counter, slug generator, Punycode/IDN, and a Unicode inspector for zero-width and bidirectional characters.
    • Line tools: prefix/suffix, numbering, join for SQL IN lists. Whitespace tool for CRLF↔LF, tabs/spaces and BOM.
    • HTML entities, string escape for JSON/JS/SQL/shell/CSV/XML/regex, URL encode/decode, and image↔Base64.

  5. Hashes that say what they are

    • SHA-1, SHA-256, SHA-384 and SHA-512 beside MD5, with file hashing and a compare field.
    • HMAC generator for webhook-style signatures. Pages label weak algorithms instead of hiding them.
    • bcrypt hash and verify as its own page; Basic auth header encode/decode.
    • Password generator gained EFF passphrases and an entropy figure in bits.

  6. Rebuild: everything stays in the tab

    • Rewrote the site on Next.js. Every tool is client-side. The old server htpasswd API is gone.
    • htpasswd now hashes with bcrypt (and labelled Apache MD5 / SHA-1) in the browser, with verify.
    • Base64 is UTF-8-safe with URL-safe and file options. JSON and XML report line and column on errors.
    • Removed the scaled blog (HTTP 410). Promise on every page: runs in your browser, input is not uploaded.
    • Added search (⌘K), About, Privacy rewritten to match reality, sitemap and llms.txt from the tool catalog.

  7. Correctness pass on the originals

    • Fixed off-by-one in the random number tool and switched to rejection sampling.
    • Password generator no longer biases characters with modulo; copy feedback is inline instead of alert().
    • Sort gained natural/numeric options; “seperator” spelling fixed.
    • XML formatter replaced a brittle regex pretty-printer with a DOM-based one.

  8. Privacy line made literal

    • Dropped the plan to keep a server round-trip for “hard” hashes. If Apache cannot use it in htpasswd, it does not belong as a silent default.
    • Tightened CSP so tool pages cannot phone home. Analytics limited to cookieless page views and speed.
    • Started writing real FAQs under each tool instead of marketing blurbs.

  9. Stopped publishing the LLM blog

    • Unpublished dozens of near-duplicate posts about “LLM workflows”. They did not help people use the tools and risked the domain.
    • Kept the lesson: guides belong under the tool they explain, with tested snippets only.

  10. SQL and HTML formatters

    • SQL formatter with dialect choice. HTML formatter that leaves script, style and pre alone.
    • CSS/HTML minifier with a bytes-saved readout.

  11. JWT and timestamp

    • First JWT decoder — decode only, with an explicit note that the signature is not checked.
    • Unix timestamp converter for the constant “what time is this epoch?” tab.

  12. XML, URL encode, more hashes

    • XML formatter/validator. URL percent-encode and decode.
    • Expanded hashing beyond MD5 toward SHA-256 for checksums people actually publish.

  13. htpasswd and password generator

    • Password generator and an htpasswd helper for Apache/Nginx basic auth.
    • Early version still leaned on a server for some algorithms — the wrong design for a site that asks you to type passwords. Marked for removal.

  14. First public tools

    • Launched tooldeck.net with JSON formatter, Base64 encode/decode, MD5, sort lines, and a thin homepage.
    • The brief was already the same: small pages for jobs you do mid-task, without shipping your paste to someone else’s server. The product took a while to catch up with that brief.