Developer Data Toolkit — questions

No. Every conversion, hash, decode and diff happens in your browser using the page’s own JavaScript. There is no server component once the page has loaded, no analytics script and no third-party request of any kind. Open your browser’s network panel and use the tool: you will see nothing go out.

No. The toolkit writes nothing to localStorage, sessionStorage, IndexedDB or cookies. Reloading the page clears everything you entered; closing the tab does the same. There is no account system, so there is nothing to sign up for and nothing to delete.

Yes, exactly. Text is converted to UTF-8 bytes before encoding and decoded back with a strict decoder, so emoji, CJK, Arabic, combining marks and ZWJ sequences all round-trip byte for byte. This is the specific thing the browser’s built-in btoa() gets wrong — it throws on some characters and silently produces incorrect bytes for others.

With its own scanner rather than by reading the engine’s error message. Browser JSON error text is engine-specific and current V8 omits the position entirely for some failures. The scanner walks the document and reports the first offset that is not valid JSON, with a reason written for a human — a trailing comma, a single-quoted string, an unterminated string — plus the offending line and a caret.

Standard YAML 1.2 structure, read with a restricted schema that can only produce JSON-shaped data: strings, numbers, booleans, null, sequences and mappings. Tags that construct arbitrary objects are refused. You can choose between the JSON schema (strictest) and the Core schema (which also resolves ~ and empty values to null, hex integers, and .inf / .nan).

Because it uses a custom or language-specific tag such as !!js/function, !!python/object/apply, !!binary or !!timestamp. A loader configured to construct those is an arbitrary-object constructor, which in several languages is a remote-code-execution class of bug. This tool refuses them by design rather than making an exception.

They are computed by the browser’s own Web Crypto implementation, and the test suite checks them against the published vectors — SHA-256 of "abc" is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad, and the SHA-1, SHA-384 and SHA-512 vectors are checked alongside it, along with the empty-string digests.

Because it is. A practical collision was published in 2017 (SHAttered), and chosen-prefix collisions — the variant that breaks signatures and certificates — became affordable in 2020. It is included so you can reproduce existing SHA-1 values such as git object ids and legacy API signatures, which is a different thing from relying on it.

From crypto.randomUUID(), or crypto.getRandomValues() where randomUUID is unavailable. Both are the browser’s cryptographically secure generator. Math.random() is never used: its internal state can be recovered from a short run of outputs, which makes anything built from it predictable. If no secure source exists, the tool refuses to generate rather than quietly downgrading.

No. It decodes the header and payload and shows you what they claim. It does not check the signature, so nothing it shows proves a token is authentic, unaltered or issued by whoever it names. Verification requires the issuer’s key and a pinned algorithm, which belong to the system that trusts the token — not to a web page.

You can, and you should not — here or anywhere else. A live token is a credential: whoever holds it can act as you until it expires. This page decodes locally and sends nothing, but that is a claim you cannot verify at a glance on any site, so the safe habit is expired or test tokens. If you have already pasted one somewhere, rotate it.

It computes a longest-common-subsequence edit script, which gives a minimal set of additions and removals rather than a naive line-by-line comparison. Identical leading and trailing lines are trimmed first, so comparing two large files that differ in one place is fast.

The LCS algorithm needs time and memory proportional to the product of the two lengths. Past a couple of thousand differing lines that becomes an allocation a browser tab should not attempt, so the tool refuses cleanly and suggests comparing a smaller region. Files that share most of their content are trimmed first and stay fast regardless of total size.

It is a documented heuristic, and it is never silent. Anything at or above 10^11 is treated as milliseconds, because 10^11 seconds is the year 5138 while 10^11 milliseconds is 1973. The unit actually used is always displayed with the result, and you can override it.

Once the page has loaded, yes — nothing it does needs the network. There is no service worker, so the initial load still requires a connection.

Yes. The layout works from 320 CSS pixels upward, form text is 16px so mobile Safari does not zoom on focus, and controls meet the 44-pixel touch-target minimum. Editors and outputs scroll inside their own boxes, so a long line of minified JSON never widens the page.

No, and the panel says so. It is an allowlist for the editor’s own output: elements and attributes outside a fixed list are removed, event handlers cannot survive because no attribute survives unless it is listed, and only http, https, mailto, tel, ftp and relative links are kept. That makes what this editor emits safe to paste into a page you control. It is not a general-purpose XSS filter — it is a string tokeniser, not an HTML5 parser, so a hostile payload could in principle be parsed differently by a browser. The preview is a sandboxed iframe without allow-scripts, so nothing can execute there regardless.

Because the special bit is set and the matching execute bit is not. 4755 is rwsr-xr-x, a setuid program that can run; 4644 is rwSr--r--, a setuid file that nobody can execute, which is almost always a mistake. The capital letter is the system telling you the bit has nothing to act on, and a calculator that showed a lower-case s there would be hiding the one thing you needed to see.

No. It splits the string with a quote-aware tokeniser and reads the pieces. There is no eval, no shell and no child process anywhere in the codebase. Backticks, $(...) and semicolons stay literal characters. Any flag it cannot convert is named in a visible warning rather than dropped, because a compose file that silently does less than the command it came from is the worst thing this tool could produce.

Usually the time zone: cron uses the zone of the machine it runs on, and the preview uses the zone you picked, so set it to your server’s zone. The other likely cause is the day rule — when both day-of-month and day-of-week are set, cron runs when EITHER matches, which fires more often than most people expect. The generator warns when that applies.

No. Neither is enabled anywhere on ToolAcre, in any mode. No third-party script is loaded and no tracking identifier exists in the codebase.