Introduction
Need to verify a JWT signature, parse a User-Agent string, or calculate a CIDR subnet range? Developer utilities are the practical tools that software engineers reach for during debugging, infrastructure work, and API integration. They are not ciphers or encodings in the traditional sense. They are the small calculators and validators that sit next to your code editor and save you from writing a one-off script. Every tool runs in your browser. No input is sent to a server.
What this category includes
- JWT signature verifier (HS256, RS256, ES256) that validates tokens against a provided key
- CIDR and subnet calculator for IPv4 and IPv6 ranges
- MAC address vendor lookup (OUI database) and randomizer for testing
- User-Agent string parser with bot and crawler detection
- Cron expression parser and cron-to-English translator
- Identity validators (VIN decoder, IBAN validator, Snowflake ID decoder)
How these tools work
Each developer utility tool parses a specific input format and extracts structured information. The tools use standard JavaScript libraries and built-in browser APIs.
The JWT signature verifier splits the token into its three parts (header, payload, signature), base64url-decodes each, and verifies the signature using the Web Crypto API. For HS256, it computes HMAC-SHA256 over the header and payload using the provided key and compares it to the signature. For RS256 and ES256, it uses crypto.subtle.verify() with the provided public key. This is distinct from a JWT decoder, which only reads the payload without checking authenticity.
The CIDR calculator parses notation like 192.168.1.0/24 into the network address, broadcast address, host range, and host count. For IPv6, it handles the compressed notation with double colons. The math is integer arithmetic on the 32-bit (IPv4) or 128-bit (IPv6) address space.
The MAC address lookup uses the IEEE OUI (Organizationally Unique Identifier) database, which maps the first 3 bytes of a MAC address to a manufacturer. The database is embedded in the tool so no network request is needed.
The User-Agent parser uses a pattern library to extract browser name, version, operating system, and device type. It also flags known bot and crawler User-Agents (Googlebot, Bingbot, GPTBot, and others) based on substring matching.
The cron parser tokenizes the 5-field cron expression and computes the next run time. The cron-to-English translator produces a natural-language description like "At 3:00 AM every Sunday".
The VIN decoder follows the ISO 3779 standard, splitting the 17-character VIN into WMI (world manufacturer identifier, 3 chars), VDS (vehicle descriptor section, 6 chars), and VIS (vehicle identifier section, 8 chars). It also validates the check digit at position 9 using the modulo-11 algorithm specified in the standard.
All processing is client-side.
How the underlying systems work
JWT (JSON Web Token) is defined in RFC 7519. A JWT is three base64url-encoded parts separated by dots: header, payload, signature. The header specifies the algorithm. The payload contains claims. The signature is computed over the base64url-encoded header and payload using the specified algorithm. The JWT signature verifier on this site checks the signature, which is the step most online JWT decoders skip. A decoder that does not verify the signature is unsafe for production use because anyone can forge an unsigned or incorrectly signed token.
CIDR notation was introduced in RFC 4632 to replace classful addressing. The /24 suffix means the first 24 bits are the network prefix and the remaining 8 bits are the host portion. This gives 256 addresses (254 usable after subtracting network and broadcast). IPv6 CIDR works the same way but with 128-bit addresses.
The IEEE OUI database is maintained by the IEEE Registration Authority. It assigns the first 3 bytes of every MAC address to a specific manufacturer. For example, 00:1A:11 maps to Google. The database is updated periodically.
Cron expressions originated in Unix V6 in 1975. The standard 5-field format is: minute, hour, day-of-month, month, day-of-week. Modern cron implementations (Vixie cron, systemd timers) add extensions like @daily and step values (every N units). The cron-to-English translator handles both standard and extended syntax.
VINs follow ISO 3779. The 17-character format was standardized in 1980. Characters I, O, and Q are excluded to avoid confusion with digits 1 and 0. The check digit at position 9 is computed by assigning numerical values to each character, multiplying by position weights, summing, and taking the remainder modulo 11. If the remainder is 10, the check digit is X.
How to use these tools
- Select the utility you need (JWT verifier, CIDR calculator, MAC lookup, VIN decoder, etc.)
- Paste your input (JWT token, CIDR notation, MAC address, VIN, cron expression, User-Agent string)
- For the JWT verifier, also paste the secret (HS256) or public key (RS256, ES256)
- The tool displays the parsed result, validation status, and decoded components instantly
- Copy any output you need for your debugging or documentation
Real-world examples
Debugging a Failed JWT Verification
A backend developer gets a 401 response from an API that expects an RS256 JWT. They paste the token into the JWT signature verifier, paste the server's public key in PEM format, and the tool reports "signature invalid". The step-by-step breakdown shows the header specifies RS256 but the kid in the header does not match the key they provided. They fetch the correct key from the JWKS endpoint and verification succeeds.
Calculating Subnet Ranges for a VPC
A cloud engineer planning a VPC needs to split 10.0.0.0/16 into four /18 subnets. They enter 10.0.0.0/18 into the CIDR calculator and get the range 10.0.0.0 to 10.0.63.255 with 16,384 addresses. They repeat for /18 starting at 10.0.64.0, 10.0.128.0, and 10.0.192.0 to lay out the four subnets.
Identifying a Device from a MAC Address
A network administrator sees an unknown device on the network with MAC F0:18:98:12:34:56. They paste it into the MAC address lookup, which identifies the OUI F0:18:98 as Apple. This narrows the device to an Apple product, helping them locate it on the office floor.
Comparison of methods
| Method | Complexity | Typical use |
|---|---|---|
| JWT verifier | O(n) signature check | API authentication debugging |
| CIDR calculator | O(1) arithmetic | Network planning, firewall rules |
| MAC OUI lookup | O(1) table lookup | Device identification |
| User-Agent parser | O(n) pattern match | Analytics, bot detection |
| VIN decoder | O(1) parsing | Automotive data validation |
| Cron translator | O(1) parsing | Schedule documentation |
Limitations
These tools parse and validate input. They do not modify your systems. The JWT verifier does not send your token or key anywhere, but you should still avoid pasting production tokens into a web tool. Use test tokens instead. The MAC OUI database is embedded at build time and may lag behind the latest IEEE registrations by a few weeks. The User-Agent parser handles common browsers and bots but may not identify obscure or spoofed User-Agents. The VIN decoder validates the format and check digit but does not query a vehicle database for make and model.
Frequently asked questions
What is the difference between a JWT decoder and a JWT signature verifier?
A JWT decoder reads the header and payload without checking the signature. Anyone can forge a token with any payload and a decoder will display it. A JWT signature verifier checks that the signature was produced by someone holding the secret (HS256) or private key (RS256, ES256). This is the step that proves the token is authentic. Never trust a decoded JWT without verifying its signature first.
How does CIDR notation work?
CIDR notation, defined in RFC 4632, specifies a network by an address and a prefix length. 192.168.1.0/24 means the first 24 bits are the network prefix and the remaining 8 bits are the host portion. This gives 256 addresses (254 usable). The prefix length can range from /0 (the entire internet) to /32 (a single IPv4 address). IPv6 works the same way with 128-bit addresses.
What is a VIN check digit and how is it calculated?
The check digit is at position 9 in a 17-character VIN. Each character is assigned a numerical value (letters get values 1-9, skipping I, O, and Q). Each value is multiplied by a position weight from a fixed table. The products are summed, and the remainder modulo 11 is the check digit. If the remainder is 10, the check digit is X. This detects transcription errors in vehicle identification numbers.
Can the User-Agent parser detect all bots?
It detects common bots and crawlers (Googlebot, Bingbot, GPTBot, Facebookbot, and others) by substring matching. However, bots can spoof User-Agent strings to look like real browsers. If you need reliable bot detection, combine User-Agent parsing with behavioral analysis, TLS fingerprinting, or a dedicated bot management service.
Is it safe to paste a JWT into this tool?
The tool runs client-side and does not transmit your token. However, you should avoid pasting production tokens into any web page because a compromised browser extension or dependency could intercept them. Use test tokens for debugging. If you must verify a production token, do it in your own terminal with a command-line tool.
Related categories
Conclusion
Developer utilities are the small calculators that sit next to your code editor. Use them to verify a JWT signature, calculate a CIDR subnet, identify a device from its MAC address, or decode a VIN. For encoding and decoding text formats like Base64 and hex, see Encoding & Decoding. For hashing and password tools, see Security & Hashing.