# LocalFirstTools

> Format, convert and inspect data in your browser. Nothing is uploaded.

## About

LocalFirstTools is a privacy-first toolkit of 23 browser-only tools. All processing runs as JavaScript in the user's tab: there is no upload API, no account, no ads, and tool input never appears in any network request — verifiable in the browser's network tab. How the local-only model works: https://localfirsttools.com/how-it-works

## Tool specs

- [JSON Formatter & Validator](https://localfirsttools.com/json-formatter): JSON text -> pretty-printed (2-space) or minified JSON. Validates with the browser's JSON.parse per RFC 8259 and reports the first error's exact line and column; optional recursive key sorting. Handles files via drag-drop. Local processing.
- [JSON Minifier](https://localfirsttools.com/json-minifier): formatted JSON -> single-line minified JSON, with byte counts before/after (median 27.1% saved on a 26-doc sample corpus). Whitespace-only change; data identical. Local.
- [JSON ↔ YAML Converter](https://localfirsttools.com/json-yaml): JSON <-> single-document YAML 1.2 (yaml library). Anchors are resolved into copies; YAML comments are dropped in the JSON direction. Multi-document YAML not supported. Local.
- [JSON ↔ CSV Converter](https://localfirsttools.com/json-csv): array of flat JSON objects <-> RFC 4180 CSV. Auto-detects comma/semicolon/tab delimiters; optional type coercion (leading-zero values stay strings). Nested arrays cannot become rows. Local.
- [JWT Decoder](https://localfirsttools.com/jwt-decoder): JWT string -> decoded header + payload as formatted JSON. Does NOT verify signatures — the signature segment is displayed but never checked; decoding needs no key (RFC 7519 JWS is encoded, not encrypted). Local.
- [Base64 Encode / Decode](https://localfirsttools.com/base64): UTF-8 text <-> standard Base64 (RFC 4648, + / alphabet with = padding). Not Base64URL — JWT segments need the - _ alphabet. 4 output chars per 3 input bytes (+33.3%). Local.
- [URL Encode / Decode](https://localfirsttools.com/url-encode): text <-> percent-encoding (encodeURIComponent semantics; + is a literal plus, not a space). Non-ASCII goes through UTF-8 first: é -> %C3%A9. Local.
- [UUID Generator](https://localfirsttools.com/uuid-generator): generates version 4 UUIDs only (122 random bits, ~5.3e36 values) via crypto.randomUUID(); single or batch of 10. No v7 — v7 needs a server-side library. Local.
- [Hash Generator](https://localfirsttools.com/hash-generator): UTF-8 text -> SHA-256 (64 hex chars) and SHA-1 (40) via Web Crypto, MD5 (32) via js-md5. SHA-1 and MD5 are collision-broken — checksums only, not security. Hashes text, not file bytes. Local.
- [Case Converter](https://localfirsttools.com/case-converter): identifier or phrase -> camelCase, PascalCase, snake_case, kebab-case and CONSTANT_CASE simultaneously. All-caps acronym runs (APIKey) are not split. Local.
- [Unix Timestamp Converter](https://localfirsttools.com/timestamp): Unix timestamp (10-digit seconds or 13-digit milliseconds, auto-detected at the 10^12 boundary) <-> ISO 8601 UTC. Negative values (pre-1970) supported. Local.
- [Regex Tester](https://localfirsttools.com/regex-tester): JavaScript (ECMAScript) regex + flags + test string -> live highlighted matches and capture groups (named groups included). Not PCRE. Capped at 1,000 matches; zero-length-match safe. Local.
- [Text Diff](https://localfirsttools.com/text-diff): two texts -> line-based diff (diff library, Myers-family) with added/removed counts and optional whitespace-insensitive comparison. Line granularity only, no intra-line highlighting. Local.
- [Cron Expression Explainer](https://localfirsttools.com/cron-explainer): 5-field cron expression (or 6 with seconds) -> plain-English sentence (cronstrue) + next 5 run times in the viewer's local timezone (cron-parser). No @reboot-style extensions. Local.
- [HTML Entity Encode / Decode](https://localfirsttools.com/html-entities): text <-> HTML entities. Encoding always escapes & < > " ' (apostrophe as &#39;), optionally all non-ASCII as hex references; decoding via DOMParser handles every named and numeric entity, without executing markup. Local.
- [Slug Generator](https://localfirsttools.com/slug-generator): title -> URL slug. NFKD-normalizes, strips diacritics (café -> cafe), maps symbols to words (& -> and), collapses non [a-z0-9] runs to a hyphen or underscore, optional word-boundary truncation. Non-Latin scripts have no ASCII base form and are dropped. Local.
- [JSON Diff](https://localfirsttools.com/json-diff): compares two JSON documents structurally after parsing — reordered keys and whitespace produce zero differences; reports added/removed/changed paths in dot notation with old -> new values. Local.
- [JSON <-> XML Converter](https://localfirsttools.com/json-xml): converts JSON to XML and back and pretty-prints XML (fast-xml-parser); attributes use the @_ prefix convention; XML->JSON->XML round trips can normalize markup. Local.
- [JSON -> TypeScript](https://localfirsttools.com/json-typescript): infers TypeScript interfaces from a JSON sample; differing types across array elements become unions, missing properties become optional; input must be an object or array of objects. Local.
- [JSONPath Tester](https://localfirsttools.com/jsonpath-tester): evaluates RFC 9535-style JSONPath expressions (jsonpath-plus, safe mode — no code execution) and lists every match with its normalized path; 500-match cap. Local.
- [Query String <-> JSON](https://localfirsttools.com/query-string-json): parses percent-encoded pairs with URLSearchParams (accepts full URLs); repeated keys become arrays; values stay strings (no type guessing); nested JSON is rejected with the offending key named. Local.
- [Password Generator](https://localfirsttools.com/password-generator): draws characters with crypto.getRandomValues using rejection sampling (no modulo bias); live entropy readout = length x log2(alphabet); look-alike exclusion; length 8-64. Nothing stored or sent. Local.
- [Hex Encode / Decode](https://localfirsttools.com/hex): UTF-8 text <-> RFC 4648 §8 base16; every byte is exactly two hex chars (2x size); decode strips 0x/whitespace and rejects non-UTF-8 byte sequences rather than corrupting. Local.

Category hubs: [JSON](https://localfirsttools.com/tools/json), [Encoding](https://localfirsttools.com/tools/encode), [Generators](https://localfirsttools.com/tools/generate), [Text](https://localfirsttools.com/tools/text). Full directory: https://localfirsttools.com/tools

## Guides

Answer-first how-tos at https://localfirsttools.com/guides — including [fixing "Unexpected token" in JSON](https://localfirsttools.com/guides/fix-unexpected-token-json), [how to decode a JWT](https://localfirsttools.com/guides/how-to-decode-a-jwt), [Base64 vs Base64URL](https://localfirsttools.com/guides/base64-vs-base64url), [SHA-256 vs SHA-1 vs MD5](https://localfirsttools.com/guides/sha-256-vs-sha-1-vs-md5), [UUID v4 vs v7](https://localfirsttools.com/guides/uuid-v4-vs-v7) and [Unix seconds vs milliseconds](https://localfirsttools.com/guides/unix-seconds-vs-milliseconds).

## Comparisons

Factual comparisons at https://localfirsttools.com/compare — including [vs jwt.io](https://localfirsttools.com/compare/jwt-io), [vs JSONFormatter.org](https://localfirsttools.com/compare/jsonformatter-org) and [browser vs server JSON tools](https://localfirsttools.com/compare/browser-vs-server-json-tools).

## Contact

Tool input is never sent to LocalFirstTools. Full sitemap: https://localfirsttools.com/sitemap.xml