Utilxo

Privacy-first developer utilities

Client-side by default — auth, crypto, markdown, regex, time, QR, network, and more. Hybrid tools show a privacy badge when a short-lived relay may be used.

Browse the catalog

10

CIBA (Decoupled Auth)

Live OpenID CIBA /bc-authorize and token grants (Poll / Ping / Push) via browser-direct or Utilxo proxy — snippets, poll simulator, notification inbox.

Client ID Metadata Document

Generate, validate, and temporarily host CIMD JSON (IETF draft) for MCP/AI agents — client_id as HTTPS URL, security checks, authorization URL builder.

DPoP Proof & Header Debugger

Generate and inspect RFC 9449 DPoP proof JWTs — ephemeral EC keys, htm/htu/ath binding, and header claim checks. Client-side WebCrypto only.

Dynamic Client Registration

Build RFC 7591 DCR registration payloads, software_statement JWTs, curl/fetch snippets, and inspect registration responses — 100% client-side.

JWT Workbench

Decode, mint, and verify JWTs — HMAC/RSA/ECDSA locally, or auto-fetch issuer JWKS via OIDC discovery.

OAuth / OIDC RP

Act as a Relying Party: Auth Code + PKCE, Implicit/Hybrid response types, form_post, Client Credentials — browser-direct first, CORS proxy fallback.

PKCE Playground

Generate high-entropy `code_verifier` and S256 `code_challenge` pairs for OAuth PKCE flows — 100% in-browser.

SAML 2.0 SP

Act as a Service Provider: build AuthnRequests (Redirect/POST), inflate/deflate Redirect bindings, and consume Assertions at /saml/acs.

Token Exchange & Delegation Studio

Test ID-JAG (Cross-App Access / XAA), RFC 8693 Token Exchange, RFC 7523 JWT Grants, and AI Agent (MCP) delegation flows.

WebAuthn & Passkeys

Passkey API client & diagnostics — built-in sandbox or 3rd-party FIDO servers, ROR /.well-known/webauthn inspection, ceremony terminal.

9

Cookie & Header Inspector

Parse Set-Cookie headers — SameSite, Secure, HttpOnly, and CHIPS Partitioned attributes.

CSP Evaluator & Builder

Audit Content-Security-Policy headers for unsafe-inline/eval/wildcards, or build a clean CSP string.

cURL to Code

Convert cURL commands into fetch, Axios, Python, Go, Node, and Java client snippets — client-side.

HAR File Analyzer

Inspect network waterfalls, timings, and payloads from HAR exports — redact secrets and export cURL, all in-browser.

HTTP & REST Client

Construct, test, and debug HTTP requests with custom headers, body payloads, and token authorization.

iFrame Studio

Test URL embedding, sandbox flags, Permissions Policy allow for WebAuthn in iframes, and cross-origin postMessage traffic.

SSE / EventSource Debugger

Dedicated Server-Sent Events debugger — connect to EventSource streams, log frames with inter-chunk latency, and pretty-print JSON (LLM/stream APIs).

Webhook Catch & Inspect

Generate temporary endpoints to catch, inspect, and debug incoming HTTP webhooks.

WebSocket Tester

Connect to WS/WSS endpoints, send frames, and inspect real-time message traffic.

9

Hash & Checksum Studio

Compute MD5, SHA-1/256/512, and SHA3 digests for strings or files in the browser.

HMAC Signature Workbench

Compute and verify HMAC-SHA256/512/1 signatures for webhook debugging — hex, Base64, timing-safe compare.

JWE Encrypt / Decrypt

Encrypt and decrypt JSON Web Encryption (JWE) payloads using WebCrypto via jose.

JWK Generator

Generate RSA, EC, and OKP key pairs as JWK / PEM using WebCrypto.

JWKS Builder

Convert public PEM/X.509 keys into a JWKS document with kid, use, and alg for local OIDC mocks.

TLS/SSL Inspector

Fetch live TLS chain details for any host — protocol, cipher, and expiry.

Universal Key Converter

Bi-directional PEM ↔ JWK / JWKS conversion plus X.509 certificate public-key extraction — RSA, ECDSA, Ed25519 via WebCrypto and jose.

X.509 Cert & CSR Generator

Generate self-signed X.509 certificates and CSRs for SAML SSO, mTLS, and local HTTPS testing.

X.509 Decoder

Parse PEM/DER certificates and inspect subject, SAN, and validity locally.

15

Base64 & Base64URL Encoder/Decoder

Convert text and files between Plaintext, Base64, Base64URL, Hex, and Data URIs 100% in your browser.

Cron Expression Studio

Convert cron expressions to plain language and preview upcoming execution times.

Diagram & Sequence Workbench

Client-side architecture canvas (Excalidraw) and Mermaid diagram editor for sequences, flows, and charts — PNG/SVG/JSON export, local auto-save.

Diff Workbench

Git-style split/unified diffs for any text — JSON, XML, YAML, JWT payloads, and more — ignore whitespace/case, inline char/word highlight, copy .patch. For JSON key-path diffs see JSON Structural Diff.

HTML Prettifier

Format and sanitize HTML markup with DOMPurify — nothing leaves your browser.

JSON Formatter

Pretty-print, minify, and validate JSON documents client-side.

JSON Structural Diff

Path-level structural JSON compare (added/removed/modified keys) with optional sorted-key mode — use Diff Workbench for Git-style text/.patch diffs.

Markdown Live Preview

Side-by-side GitHub-flavored Markdown editor with HTML copy and print-to-PDF.

Mock Data Generator

Generate realistic JSON mocks with Faker templates — names, emails, cards, geo, and more. Export JSON or CSV in-browser.

Regex Tester & Explainer

Test, visualize, debug, and explain regular expressions in plain English with instant match highlighting.

Schema Generator

Infer TypeScript, Zod, JSON Schema, and OpenAPI schemas from a JSON sample — client-side.

Text Editor

Notion-style notes in the browser — Markdown or plain text, wrap-aware line numbers, undo/redo, case & sort tools, strip clipboard gremlins, localStorage auto-save, PDF export.

Time & Epoch Studio

Convert Unix timestamps to local/UTC, measure performance with multi-stopwatches, and set timers.

UUID / ULID / Snowflake Decoder

Extract timestamps, version, and entropy from UUID v7, ULID, and snowflake IDs.

UUID & ULID Generator

Generate UUID v4/v7, ULID, and NanoID strings in bulk — entirely in-browser.

3

Protobuf Wire Inspector

Decode raw Protocol Buffer binary into field tags, wire types, and varints without a .proto file.

SQL ↔ JSON / CSV Converter

Parse INSERT INTO SQL into JSON/CSV, or generate INSERT statements from JSON arrays.

YAML ↔ JSON ↔ TOML

Bidirectional conversion between YAML, JSON, and TOML with syntax checking.

1

AI Prompt Studio

Unified client-side pipeline: draft → redact secrets/PII → count tokens → format messages → token-aware chunking, system-prompt lint, and context packing.

3

Initials & Avatar Studio

Generate customizable initial avatars with gradients and shapes. Export as SVG, PNG, or React components.

Passport Photo Cropper

Crop photos to official passport/visa ratios (US, IN, UK, EU) on canvas.

QR Code Studio

Generate scannable QR codes from text or URLs with downloadable PNG output.

Privacy-first developer tools in your browser

Utilxo is a catalog of free privacy-first developer utilities — identity and crypto, plus markdown, regex, time, QR, avatars, network inspectors, and more. Instead of pasting secrets into opaque third-party SaaS forms, most routes process data locally with WebCrypto and client-side libraries.

Popular entry points include the JWT debugger, OAuth / OIDC playground, SAML SP tester, WebAuthn passkeys, and the HTTP REST client. Hybrid tools only use short-lived server assistance when the browser cannot reach an upstream endpoint directly. Prefer full control? Configure Bring Your Own Proxy (BYOP) in workspace settings so discovery, JWKS, and token calls go through your relay instead of Utilxo cloud endpoints.

How to get started

  1. Search or filter the catalog by category (Identity, Crypto, Network, …).
  2. Open a tool and check the privacy badge for client vs hybrid runtime.
  3. Optional: for hybrid CORS relays, open header Settings → Proxy (BYOP).
  4. Keep sensitive material local — and read Privacy & Terms for the full disclaimer.

FAQ

What is Bring Your Own Proxy (BYOP)?
A workspace setting that lets you route CORS-blocked browser fetches (OIDC discovery, JWKS, token endpoints, REST, etc.) through either Utilxo's short-lived relays, your own proxy URL template, or direct-only mode with no relay at all. Configure it via the gear icon in the site header — you do not need to open each tool's advanced config first.
Do my tokens or keys leave the browser?
Client-side tools keep material local. Hybrid tools may briefly relay network requests when CORS blocks a direct call; with BYOP custom/direct modes you control whether that relay is yours or disabled. See the privacy badge on each tool.
How is Jump back in / Popular chosen?
Returning visitors see starred and recent tools first. New visitors see a curated Popular set. Rankings use counts stored only in this browser's localStorage — nothing is sent to our servers for popularity.