Urgent.News

One page, thousands of outlets. See who else covered it.

Editions

Tech

Why I stopped pasting production JWTs into random websites (and built an offline tool suite instead)

Be honest: how many times this week have you pasted a bearer token, a customer payload, or an .env config snippet into an online formatter just to quickly see what went wrong? I used to do it constantly. Need to debug an expired JWT? Open the first Google result. Need to format a 4MB JSON response from a legacy API? Paste it into a random tab covered in popup ads. Need to merge two PDF invoices…

Ever find yourself copy-pasting bearer tokens or JSON payloads into suspicious online utilities just to troubleshoot issues? I used to do it frequently. Need to inspect an expired JWT? Opened the first Google result. Need to format a massive JSON response from a legacy API? Pasted it into a pop-up ad-infested tab. In search of a PDF merger or an advanced RegEx tester?

Another sketchy website. A few months ago, while debugging an authentication problem on a client's staging database, I caught myself about to paste a raw, unhashed token into a random web tool. I paused, inspected the network request, and realized my data was being sent as a POST request to an analytics backend. That was my breaking point.

The Issue with Free Developer Tools Most of the top search results for developer utilities share a few common problems: Your data leaves your computer: Many tools send your raw strings, files, or tokens to a remote server for processing. Intrusive ads and layout shifts: Five sticky video banners disrupting your focus while you're trying to read a diff.

Slow load times: Heavy server-side processing for tasks that can be done locally in seconds with modern JavaScript. Today, I decided to create a cleaner, offline alternative called Omnikite. This ad-free, browser-based suite runs entirely in your memory, even if you're offline. Here's what I built: 1. Cryptography and Security Tools: Shamir's Secret Sharing for splitting master keys into secure shares.

A CSP header generator with instant Nginx, Apache, and Next.js export. A Shannon Entropy calculator for estimating password strength. 2. Developer Essentials: A JSON formatter and schema validator that handles multi-megabyte payloads without crashing. An interactive JWT debugger that inspects claims, verifies HMAC signatures locally, and checks expiration dates.

An IPv4 CIDR and subnet calculator with auto-generated firewall rules. 3. Browser-Based File Processing: A PDF merger and splitter using WebAssembly for in-browser page handling, and an image converter and SVG minifier. All tools operate without uploading any data to external servers. The platform is entirely free, requires no login, and never transmits your inputs.

I've built a single workspace containing 80 tools, all running locally in your browser. Check it out here: 👉 https://omnikite.vercel.app. I'm curious - what one utility would you find yourself searching for every week? Let me know in the comments below!

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

AWS IAM Least Privilege Without Losing Your Mind

Least privilege is the IAM principle everyone agrees with and few actually implement, because doing it by hand is tedious and "Action": "*" always works.

  • Begin with deny-all policy, add only needed permissions
  • Scope resources instead of actions (e.g., specific ARN)
  • Utilize conditions to further tighten policies

I audited every post on my 200-post blog. Here's what was quietly broken.

I've been running a technical blog for years. Posts accumulate — but so does everything around them: theme edits, editor migrations, hand-written HTML from 2018, mobile layouts nobody re-checked after…

  • Heading structure issue fixed by modifying theme template and inspecting posts
  • Visually hidden class problem resolved with proper CSS clipping technique
  • Version control implemented with separate updates and SHA-256 identifiers

More from Sunday 16 August →