10 tools keep working data in the browser
JSON, JWT, Base64, Hash, URL, Markdown, QR, Password, Case, and Color perform their primary transformations client-side. No server API is used to process those tool inputs.
Z Tools
Privacy-first tools for developers and creators
Focused utilities for inspecting, converting, generating, and preparing everyday digital data. Most tools process input locally in your browser; Image Compressor is the documented server-side exception.
No account required
Zero-build browser tools
Documented processing model
Tool directory
Start with the job you need to finish
Every existing tool URL is kept stable. The label on each card tells you where processing happens.
Developer & data
{ }
JWT
64
#
%
JSON Formatter
Format, minify, sort keys, validate, and open local JSON files with byte/type summaries.
Local processingJWT Decoder
Inspect header and payload, translate time claims, and flag algorithm/security context without verifying signatures.
Local processingBase64 Encoder
Encode/decode text, local files, and Data URLs with download reconstruction and overhead feedback.
Local processingHash Generator
Hash text or local files with MD5 and SHA-family algorithms; legacy algorithms are clearly labeled.
Local processingURL Encoder
Compare component vs full-URI percent encoding with character/byte counts and malformed-input diagnostics.
Local processingContent & creator
MD
QR
Aa
IMG
Markdown Converter
Live GFM preview, sanitized HTML, and PDF/PNG/Word export from local browser content.
Local processingQR Generator & Scanner
Create URL/text/Wi-Fi/email/phone/SMS codes with correction levels, or scan a local image.
Local processingColor & Contrast
Convert HEX/RGB/HSL/HSV/CMYK and check arbitrary foreground/background WCAG ratios.
Local processingImage Compressor
Server-side PHP GD compression with bounded uploads, protected downloads, and short-lived temporary files.
Temporary server processingUtility & security
Processing model
“Privacy-first” means describing what the code actually does
Image Compressor uploads by design
Images are processed by PHP GD. Uploads use random session-bound names; downloads are token-protected and expire, and temporary image files are cleaned within 5 minutes.
Analytics are separate from tool algorithms
Z Tools keeps self-hosted access statistics for 180 days. The Privacy Policy documents the anonymized IP, request/UA, referrer host, country and event fields that are recorded.
First-party verification
Tested by Z Tools
These are outputs from the reproducible scripts shipped with this source tree, not invented benchmark numbers.
33.36%
Base64 size overhead at 10,000 bytes
A deterministic 10,000-byte payload encoded to 13,336 Base64 characters. Small payloads can have higher padding overhead.
Read the Base64 guide7 cases
JSON parser edge-case matrix
The verification set covers Unicode, trailing commas, BOM input, invalid escapes, large integers, and 100-level nesting with native JSON parsing.
Read the JSON guide21:1
Known WCAG contrast check
The reference implementation returns 21:1 for black on white and 6.3862:1 for #0B57D0 on white, matching the standard luminance equation.
Read the contrast guideBenchmark environment and limitations are recorded with the raw result files. JavaScript timing data is labeled as Node/V8 reference measurement rather than browser timing; a separate local Chrome smoke pass checks rendered controls and page errors.
Guides & research
View all selected guidesDocumentation tied to working tools
JWT decoding is not verification
How time claims, algorithms, and signatures change what you can safely conclude from a decoded token.
Choosing a hash algorithm in 2026
Separate legacy checksum compatibility from collision-resistant security use.
QR error correction in practice
What L/M/Q/H change and why payload size and correction level trade capacity for resilience.
Independent product
Small enough to document honestly
Z Tools is independently built and maintained. Public changes are recorded in the changelog; testing methods are kept with the source; bug reports and feature requests go through a server-side contact form.