Active workspace: Personal. Open tools and saved data belong to this workspace.
Release notes
What’s new in 2.1.0
v2.1.0
V2.1 — clearer discovery, consistent controls and server privacy
Refines the 147-tool workspace with a unified introduction, compact navigation and explicit data-handling boundaries.
UI · Release details
Workspace and discovery
Unify the privacy-focused introduction and tool carousel, with random discovery every 4 seconds, circular navigation and subtle developer/security artwork.
Keep catalog categories independently scrollable and fit the desktop introduction into one screen.
Forms and navigation
Align forms, buttons, dropdowns and tool panes; give native file inputs a distinct upload appearance in both themes.
Use consistent sidebar typography, bold expanded categories and readable collapsed tool names; move release links and colored resources into one responsive footer row.
Server privacy
Disable runtime logs, tracing exports and API caching; avoid upload files, clear transient file buffers and remove mock request history.
Deliver webhooks only to an actively waiting browser without replay; explain third-party retention and hosting-level logging limits.
Dependencies and delivery
Patch Electron, fast-uri and node-forge and refresh compatible dependencies while retaining validated major versions.
Verify clean production and desktop builds, regression tests, private file relays and canonical tool routes; keep existing browser-saved data.
v2.0.0
V2.0 — project workspaces, private vaults and connected data tools
Expands the catalog to 147 tools with project isolation, encrypted storage, database clients and deeper capabilities in existing tools.
Feature · Release details
Projects and private work
Restore each workspace's last page and selected tool tab; keep saved notes, snippets, bookmarks, workflows and connections separate.
Translate snippet controls and shared editor copy actions across eight languages; retain saved snippet identity and highlighting when loading records.
Keep Personal protected; rename projects, move other projects to Deleted projects and restore them with their saved data and encrypted vaults.
Store credentials, connection settings and files in passphrase-protected AES-256-GCM vaults; export encrypted backups and use the local recovery CLI.
Inspect project/global records, encrypted vaults, session data and offline caches in the redesigned Memory & Storage inventory, with filters, previews, backups and scoped clear actions.
Align project forms and row actions, keep the current-project status beside its name, and stack project rows in narrow layouts.
Open version-specific release notes from the branding area; remember the seen release on this browser and retain an accessible icon afterward.
Databases and storage
Run SQLite locally in a browser worker, import and export databases, browse schemas and retain project-specific query text and history.
Connect to PostgreSQL, MySQL, MariaDB and Redis through an explicitly enabled, authenticated localhost runtime. Native connectors are disabled by default.
Browse S3-compatible buckets, prefixes and metadata; upload and download bounded files, confirm deletion and save connections in the encrypted vault.
Browse MongoDB collections with canonical Extended JSON, typed Firestore documents and Elasticsearch indexes, mappings and search results; keep precision-sensitive numeric data intact in raw exports.
Keep Document Data Explorer read-only, with bounded responses, query timeouts and explicit cloud credentials or isolated emulator settings.
Data, APIs and references
Convert spreadsheets with XLSX sheet selection, JSON, CSV and TSV; infer JSON Schema and generate models in nine target languages. Reject numeric values that Excel cannot preserve and keep quoted precision-sensitive values as text.
Convert in all twelve directions between JSON, YAML, TOML and XML; report incompatible mappings and precision-sensitive values before they can change silently, and retain TOML timestamp fractions as text.
Preserve exact JSON numeric spelling, negative zero, escaped strings and duplicate keys when formatting snippets, using JSON Formatter or running JSON format/minify workflow steps.
Add JMESPath and interactive JSON graphs with search, JSONPath focus, tables and image exports; expand binary Base64 and arbitrary-base number conversion.
Infer numeric schema types from original JSON tokens. Reject input numbers that would round during JSON queries, with an explicit option to preserve affected values as strings.
Build GraphQL operations from schema fields; use visual cron controls with time zones, plan across DST changes and convert units across 34 scientific and engineering categories.
Generate TOTP codes, namespaced UUIDs and ULIDs, bulk secrets, PHP/Ruby/C# API client snippets and documented Docker Compose starters.
Run HTTP collections with variable captures and assertions, call proto-defined gRPC methods and start bounded temporary localhost HTTP mocks through authenticated native transports.
Format PostgreSQL, MySQL and SQLite syntax without changing quoted values; convert HTML into Markdown and export sanitized HTML documents.
Inspect keyboard events and user agents, query RDAP registration data, run explicit email MX diagnostics and generate local gitignore starters.
Correctness and compatibility
Keep exact YAML numeric tokens when formatting snippets or standalone documents, including large integers, long decimals and negative zero.
Encode supplementary Unicode characters correctly in HTML references and UTF-16; decode one entity layer and preserve ordinary versus non-breaking spaces.
Open the CSV-to-XML entry route in XML mode; initialize timestamp clocks after hydration and reject out-of-range input without replacing the date draft.
Identify CryptoJS Keccak digests accurately in displayed and copied results; show the AES tool's actual fixed legacy AES-256-CBC format and unauthenticated-data limitation.
Repair JWE direct encryption, AES key wrapping and CBC-HMAC authentication; preserve exact decrypted UTF-8 and require correctly sized keys.
Sign and verify Unicode JWS payloads, match expected algorithms and key requirements, and generate JWK metadata consistent with the actual key.
Preserve URL percent-encoded query values and support IPv4 /0; accept JSON/YAML OpenAPI input and explicitly encode A2A Basic credentials as UTF-8/NFC.
Isolate Mermaid previews in a sandbox with strict rendering and escape document titles in exported HTML.
Keep QR results tied to the latest input and report generation failures; reject unsupported Canvas encoders before a download can receive the wrong extension.
Certificates and SSH keys
Generate real self-signed X.509 certificates and PKCS#10 requests with matching keys and validated subject alternative names; generate native Ed25519 keys when the browser supports them.
Export interoperable RSA, ECDSA and Ed25519 OpenSSH keys and SHA-256 fingerprints. Private files are unencrypted; add a passphrase locally with ssh-keygen.
Recognize PEM certificates in .crt and .cer uploads and retain the actual format of generated downloads.
Images and design
Build CSS gradients, layered shadows, elliptical radii, fluid typography, flex and grid layouts; explore color harmonies and shade scales, and create highlighted code screenshots.
Inspect EXIF and image metadata, remove supported metadata without recompressing image data, and create multi-image ICO, maskable PNG and manifest bundles.
Reference and workflow repairs
Preserve intervening snippet and bookmark edits during imports; guard binary-file reads against replacements or cancellation, and reject malformed file-vault records before saving.
Validate complete IPv6, decimal-address and port inputs; return multiple services for shared ports and copy exact port numbers or CIDRs.
Update curated HTTP, RFC, port and IP references from primary sources; separate formal RFC maturity from obsolescence and deployment advice, and include current TLS, DMARC and IPv6 documentation references.
Preserve exact model rates and context limits in pricing tables; correct YAML and EOT MIME mappings and include the generic binary media type.
Preserve physical JSONL line numbers, JSON null and original number tokens; reject precision-losing TOON conversions and preserve root arrays, scalar types and quoted strings with explicit legacy-array recovery.
Keep countdowns aligned with elapsed time, cancel stale animation callbacks, prevent zero-valued dice and preserve active game results when changing language.
Reject corrupted card-number input, retain generated batch metadata and export exact text, CSV or JSON fixtures with the correct media type. Generation does not verify an account or predict payment responses.
Reject invalid contrast inputs, compare unrounded ratios and handle deterministic palette extraction, file races, decode failures and clipboard failures without false success notices.
Keep SOAP and WSDL support boundaries explicit, preserve original XML and webhook bodies, quote generated shell arguments safely and avoid inferring an exact CORS failure cause from opaque browser errors.
Tool guidance and data disclosures
Show detailed network data disclosures collapsed by default, including the destination, sent fields, data handling and source links; distinguish direct browser requests, managed proxies, localhost connectors and model downloads.
Add missing Learn More sections to 21 tool pages with practical instructions and limits; retain authored help and route aliases that open the corresponding tool tab.
Translate generator, task and note controls and security helper findings; fix stable sample generation, Markdown table escaping, mock SQL identifiers, TypeScript inference, CSV quoting and explicit task import confirmations.
Prepare safely quoted Java keytool commands with interactive password prompts, and describe the browser tool accurately as a PKCS#12 builder and command helper.
Delivery and scope
Choose English, Hindi, Spanish, French, German, Japanese, Chinese or Arabic, including RTL navigation. Translate authored interface guidance, reference explanations, catalog descriptions and release notes while preserving code, identifiers and user data.
Bundle the production runtime and local assets in the desktop edition with a separate persistent profile and automatic native access. Current package validation covers macOS Apple Silicon with local ad-hoc signing; other platform targets and public signing need separate validation.
Publish a current canonical tool catalog, Markdown release notes, llms.txt and a custom read-only agent catalog; include a generated social preview and accurate structured counts.
Rename workspace tabs by double-clicking their names or pressing F2; use the top-corner close icon to confirm permanent deletion of the workspace and its saved content. Keep Personal protected and limit active workspaces to ten.
Default to the compact workspace while respecting saved view choices; keep Show introduction available and remove the old live demo, recent/pinned block and paste-to-find section.
Use Node.js 24 or newer for the full connector runtime and precision-preserving JSON support; keep native connector access on localhost with a separate access key.
Retain canonical category/tool URLs, self-hosted fonts and editor assets, light/dark themes and visited-page PWA caching. Network features still need connectivity.
v1.6.0
V1.6 — repeatable workflows, current protocols and a faster workspace
Adds four tools, refreshes version-sensitive references, and improves catalog performance, validation and privacy boundaries.
Feature · Release details
New tools and workflows
Save executable local workflows for decoding, JSON formatting, JSONPath, redaction, fixture comparison and SHA-256; pin workflows and opt in to draft restoration.
Preview and export redacted HAR, JSON and logs; verify GitHub, Stripe, Slack and raw HMAC-SHA256 signatures against the original UTF-8 body.
Inspect and generate W3C trace context; generate UUIDv4/v7 and inspect v7 timestamps. The catalog now contains 125 tools.
Suggest tools from an explicit local smart paste and search by common debugging tasks.
Standards and correctness
Validate JSON Schema Draft 2020-12, 2019-09 and Draft-07 with Ajv in a bounded worker; fail unknown dialects, rules and unresolved references explicitly.
Compare selected OpenAPI request and response constraints with local references, media changes and manual-review warnings for unsupported semantics; reference OpenAPI 3.2.1.
Support MCP 2026-07-28 per-request metadata and discovery plus explicit legacy initialization; support A2A 1.0 JSONRPC with labeled 0.3 and older modes.
Add reviewed model records with pricing tier/expiry notes, honest local tokenizer scope, optional direct provider counting, OAuth/JWT BCP references and current IANA HTTP names.
Publish runnable debugging fixtures, shared source/review records and a read-only weekly source monitor that requires review before dataset updates.
Workspace, privacy and delivery
Use native canonical catalog links, reserve sidebar space before hydration, remove delayed marketing entrances and lazy-load workspace overlays.
Self-host licensed fonts so production builds do not depend on Google Fonts requests.
Label data boundaries, redact credentials in exports by default and exclude API/authenticated/RSC requests from service-worker persistence.
Warm public pages and hashed assets for visited-tool offline use; offer an explicit reload for updates. Network and uncached features still require connectivity.
Add a nonroot standalone Docker deployment, configurable canonical site URL, refreshed compatible dependencies and regression fixtures for the new behavior. Existing upstream dependency advisories remain disclosed in the validation report.
v1.5.1
V1.5.1 — dependency refresh, server reliability, and route verification
Refreshes the application toolchain to current registry package versions, keeps Next.js 16.3.4 and TypeScript 7 compiling cleanly, and verifies the homepage, canonical tool routes, sitemap, certificate lookup, and managed proxy behavior end to end.
Fix · Release details
Current package baseline
Update Ant Design to **`6.6.2`** with **`@ant-design/icons 6.3.4`**, keeping the icon peer requirement aligned with Ant Design v6.
Update Next.js to **`16.3.4`**, React / React DOM to **`19.2.8`**, and TypeScript to **`7.0.2`**; opt into the documented TypeScript CLI path required by this Next.js toolchain.
Refresh Tailwind CSS / PostCSS, ESLint, Framer Motion, Mermaid, Swagger UI, XML parsing, tokenisation, formatting, UUID, YAML, Zustand, type packages, and security overrides; regenerate the lockfile for reproducible installs.
Patch the nested Babel, Browserslist, and brace-expansion dependency paths, and update the Hugging Face runtime path to **`sharp 0.35.4`**, **`onnxruntime-node 1.29.0`**, and **`adm-zip 0.6.0`**; `npm audit` now reports zero known vulnerabilities.
Server rendering and route reliability
Keep metadata, structured data, and sitemap generation on React-free server-safe tables so Ant Design client context is never evaluated while Next.js collects page data.
Preserve canonical **`/[categorySlug]/[toolId]`** URLs and redirect legacy **`/tools/[toolId]`** requests without breaking tool metadata or sitemap coverage.
Exclude reserved **`/api/*`** paths from the category/tool rewrite so certificate, proxy, webhook, and other server endpoints return JSON instead of an HTML page.
Parse server responses by content type across network-capable tools so non-JSON failures surface as actionable HTTP errors rather than `Unexpected token '<'` messages.
Validate proxy and streaming-proxy request objects before processing them, including omitted bodies and malformed method, header, and timeout fields.
Apply the managed-route disable gate and quota to webhook history deletion as well as ingestion and polling.
Enable managed network routes by default so production API and certificate tools work after deployment, while retaining public-target validation, destination blocking, bounded requests, and an explicit `MYDEVTOOLS_DISABLE_MANAGED_ROUTES=true` opt-out.
Load deployment configuration from plain `next.config.js`, include the matching `@next/swc-wasm-nodejs 16.3.4` fallback, and use the Webpack production build on Linux hosts where old glibc leaves only WASM SWC available because Turbopack requires native bindings.
Verification completed
Pass **`npx tsc --noEmit`** with no TypeScript errors.
Pass **`npm run build`** through Next.js Webpack, including registry parity (**121 registered tools / 127 tool directories / 6 allowlisted stubs**) and generation of **138 / 138** static pages.
Verify the homepage and canonical certificate-inspector page (**HTTP 200**), the legacy `/tools/certificate-inspector` redirect (**HTTP 308**), sitemap entries, public certificate lookup (**5 PEM certificates from `example.com`**), loopback-target blocking (**HTTP 400**), malformed proxy-body validation (**HTTP 400**), and public HTTPS proxying (**HTTP 200** with a 559-byte response).
Known toolchain caveat
Keep the latest TypeScript 7 baseline documented: `npm run lint` is currently blocked before source analysis because the latest `typescript-eslint 8.69.0` bundled by `eslint-config-next 16.3.4` supports TypeScript versions below 6.1, while `npx tsc --noEmit` and the production build pass cleanly.
v1.5
V1.5 — API contracts, security analysis, identity tooling, and platform hardening
Eight local-first developer tools join the catalog, while managed network routes, untrusted previews, certificate inspection, extension handoffs, release metadata, and Ant Design v6 usage receive a focused reliability and security pass. The catalog now contains 121 tools across 15 categories.
Feature · Release details
New API, contract & platform tools (8)
**OpenAPI Contract Diff** — compares two OpenAPI or Swagger documents and reports conservative breaking changes across operations, required parameters, responses, and schema requirements.
**JSON Schema Workbench** — validates JSON or YAML instances against common Draft 2020-12 schema rules, including local references, types, required properties, enums, strings, arrays, and additional-property checks.
**AsyncAPI Explorer** — summarizes AsyncAPI 2.x/3.x channels, operations, servers, messages, and core required fields without contacting a broker.
**GraphQL Schema & Operation Explorer** — validates queries, mutations, and subscriptions against pasted SDL with the official GraphQL parser; it never connects to an endpoint.
**Security Headers & CSP Analyzer** — evaluates pasted response headers for CSP, HSTS, nosniff, Referrer-Policy, and Permissions-Policy gaps locally.
**OAuth / OIDC & PKCE Playground** — reviews pasted discovery metadata, generates local PKCE S256 verifier/challenge pairs, and previews an authorization request without fetching a provider or accepting secrets.
**Docker Compose Analyzer** — inspects compose.yaml services, ports, volumes, networks, privileged containers, host networking, and healthcheck coverage; it never contacts Docker.
**WebAuthn / Passkey Playground** — decodes serialised credential metadata and clientDataJSON locally. Full registration and assertion ceremonies remain application-specific and require server-side challenge validation.
Managed network route hardening
Managed proxy, streaming proxy, certificate fetch, and webhook capture routes are disabled by default in production and require `MYDEVTOOLS_ENABLE_MANAGED_ROUTES=true` behind appropriate gateway controls.
Public-address validation and DNS pinning block loopback, private, link-local, multicast, documentation, and mixed public/private destinations before outbound connections are made.
Proxy routes now clamp request/response sizes and timeouts, use strict TLS by default, protect redirects, and remove credentials on cross-origin redirects.
Webhook capture now uses stronger session identifiers plus bounded per-session/global retention. It remains temporary in-memory development/debugging storage, not durable delivery infrastructure.
Fixed certificate inspection for hosts whose TLS client requests Node DNS lookup results in `all` mode, including `mportal.passportindia.gov.in`.
Safer content handling & clearer trust boundaries
Mermaid and SVG previews now render in sandboxed iframes; SVG optimisation strips active-content sinks before rendering or download.
Rich Text Editor input, stored documents, previews, and exports now pass through a local allowlist sanitizer.
Network-capable tool notices now state exactly what a route does and whether webhook data is temporary, instead of using a generic privacy claim.
Certificate verification defaults to enabled; certificate fetching intentionally allows invalid chains only so they can be inspected, while destination protections remain enforced.
Quality, accessibility & catalog accuracy
Replaced deprecated Ant Design `Descriptions.labelStyle`, static message usage, `List`, and `Input.addonBefore` patterns in the updated tools with context-aware v6 APIs.
Tool pages use one H1, visible trust notices before managed actions, labelled controls, and responsive layouts; catalog links and structured data now match the registered count.
Extension handoff state now matches each target schema, custom origins are validated, and stale manifest icon/permission references were removed.
Added network-policy and contract-tool regression tests. Production build, type checks, route/catalog parity, and focused browser checks passed; lint completed with no errors (existing repository warnings remain tracked separately).
Four new tool directions land fully implemented: Networking & Web (Webhook Receiver, WebSocket Tester, CORS Tester, DNS Lookup), Diff & Compare additions (Image Diff, CSV Diff), a new Image & Media category (Image Compressor, SVG Optimizer, Favicon Generator, Color Palette Extractor, EXIF Viewer), and Data Conversion additions (Mock Data Generator, TOML Converter, TOON Converter) — all 14 functional, no placeholders. The same release changes how the toolkit feels: tools hand off output to each other, every input has a Share button that round-trips to a URL fragment, the PWA manifest ships with an install button, and a Manifest V3 browser extension opens any selection in a tool. The AI category grows to 6 tools — all key-free, server-free, and local.
Feature · Release details
New category — Image & Media (5 tools, all client-side)
**Image Compressor** — Canvas re-encode with quality slider, JPEG/WebP/PNG output, optional max-dimension resize, live before/after preview.
**SVG Optimizer** — strips editor metadata (Inkscape/Sketch/Figma), collapses whitespace, rounds numeric precision with a 0–6 decimal slider, side-by-side rendered preview.
**Favicon Generator** — produces 7 sizes (16/32/48/96/180/192/512) from one source, with HTML head snippet and PWA manifest scaffolds.
**Color Palette Extractor** — k-means in RGB space at 200px downsample, configurable palette size 3–16, HEX/RGB/HSL per swatch.
**EXIF Viewer** — in-browser EXIF parser for JPEG/TIFF; groups Camera/Lens/Capture/Image/GPS tags, decodes GPS to decimal lat/lon with map link.
Networking & Web (4 tools)
**Webhook Receiver** — generates a unique inbound URL, captures any HTTP request, surfaces method/headers/query/body live. Uses a new `/api/webhook/[sessionId]` endpoint with in-memory store (1h idle TTL, 200 requests/session).
**WebSocket Tester** — real ws/wss client with connection state, text frame send, timestamped history.
**CORS Tester** — sends real fetch from browser, classifies failures as preflight vs simple-request, decodes them into plain English.
**Image Diff** — pixel-by-pixel comparison with side-by-side, overlay (with opacity slider) and difference modes; tolerance slider and changed-pixel stats.
Data Conversion (3 tools)
**Mock Data Generator** — schema builder with 15 field types, seedable Mulberry32 RNG for reproducible fixtures, JSON/CSV/SQL output.
**TOML Converter** — TOML ↔ JSON ↔ YAML with a minimal in-file TOML parser (sections, scalars, arrays of scalars).
**TOON Converter** — JSON or XML → TOON (Token-Oriented Object Notation). Tabular array detection emits CSV-like rows instead of repeating keys; live characters-saved and approximate tokens-saved badges for LLM prompt budgeting.
Generators (1 tool)
**Credit Card Generator** — Luhn-valid test card numbers across 14 brands (Visa, Mastercard, American Express, Discover, JCB, Diners Club, Maestro, UnionPay, RuPay, Elo, Hipercard, Mir, Troy, InterPayment), each with a brand-correct IIN prefix, supported length, matching CVV width, future expiry and holder name. Numbers render on a card-style face and export as plain text, CSV or JSON. Brand data and the Luhn helpers moved to a shared `src/lib/credit-card.ts` that the Credit Card Validator now imports, so detection and checksum logic live in one place.
Infrastructure
New **Image & Media** category — colour, icon, description, order, union type.
New `/api/webhook/[sessionId]` and `/api/webhook/[sessionId]/events` routes (long-poll); shared in-memory store at `src/lib/webhook-store.ts`.
`ServerProxyNotice` extended with two new route ids (`proxy-stream`, `webhook`).
All 14 tools added to `tool-url-table.ts`, `tools-registry.ts` and `seo-content.ts` — full SEO + structured data from day one.
Cross-tool pipelines
New typed `ToolPayload` contract (`kind`, `data`, `sourceToolId`, `label`) in `src/lib/tool-bridge.ts` — payloads route through `sessionStorage` with a 1-minute TTL so the handoff survives client navigation.
`SendToButton` drops into any tool's output header; the dropdown is auto-populated from the tool registry based on what the target accepts.
`ToolBridgeBanner` reads a pending payload on the receiver's mount and auto-imports (configurable). Old payloads are cleared without applying so they never surprise the user.
5 flagship tools wired as reference: **JSON Formatter, Base64, URL Encoder, Hash Generator, JWT Decoder**. ~10 lines per tool to adopt — the other 99 tools can follow incrementally.
Shareable URLs
`src/lib/shareable-state.ts` — typed `ShareSchema<T>` + `useShareableState` hook. State serialises to `JSON → deflate-raw → base64url` and lives in the URL **fragment** (never sent to a server, even for the public site).
`ShareButton` opens a modal that builds the link on demand (always reflects current input), shows char count, and warns when sensitive fields are present (JWT decoder uses this).
Schema versioning enforced — a link with `v: 2` ignored by a tool still on `v: 1`, no silent state corruption.
Same 5 flagship tools restore state on mount via the share URL.
PWA polish
**Fixed**: `/manifest.webmanifest` was referenced from `src/app/layout.tsx` but didn't exist on disk. Created the file with full metadata, 7 icon entries, 4 shortcuts (JSON / JWT / API Builder / Base64).
`PwaInstallButton` surfaces the deferred `beforeinstallprompt` event when the browser fires it and auto-hides in `display-mode: standalone`. Added to the footer.
Service worker already existed (`public/sw.js`, network-first navigation + runtime cache). No changes needed.
Browser extension (Manifest V3)
New `extension/` directory — plain JS, no bundler, so users can audit every line before installing.
Right-click any selected text → submenu with: Format JSON · Decode JWT · Base64 encode/decode · URL encode/decode · Generate hashes · Test with regex.
Reuses the same share-URL format as the main app — handoff is a single round trip with no extra protocol.
Toolbar popup with quick-launch shortcuts and a self-hosted origin override (for users running mydevtools privately).
Zero telemetry, zero `host_permissions` — the extension only sees what you select.
Honest AI, no keys required
**Semantic Search Playground** replaces the old keyword-matching `rag-search` demo with real sentence embeddings (all-MiniLM-L6-v2, WebGPU/WASM via `@huggingface/transformers`) — genuine meaning-based search, computed entirely in your browser. Model loads only on explicit click, never automatically.
**LLM Token Counter** — exact BPE token counts for GPT models via `gpt-tokenizer`, labeled estimates for Claude/Llama, plus a context-budget bar.
**Fine-Tuning Dataset Validator** — validates JSONL datasets against OpenAI or Anthropic message schemas, line by line, entirely client-side.
**Agent Card / MCP Manifest Generator** — builds a valid A2A `agent-card.json` or MCP server config with live validation, sendable straight into the existing A2A/MCP inspectors.
Deleted `code-explainer` and `text-summarizer` — both were regex/heuristic demos mislabeled as AI, unreachable from navigation since they were written.
Pipeline adoption + a live bug fix
17 of 24 declared `BRIDGE_TARGETS` were silently dropping payloads sent via "Send to" — every one is now wired or the row was removed. Formatters, validators, converters, and diff tools all participate now (~30 tools total, up from the original 5).
TOON Converter gained a real decoder (TOON → JSON/XML, not just the reverse), a direction toggle, and swapped its character-based "savings" claim for actual token counts.
A new `scripts/check-parity.js` guard runs on every build, catching registry/SEO/orphan-tool drift and unwired bridge targets before they ship again.
Cross-cutting fixes
Every tool page now shows a **Related tools** section and renders **FAQ** content inline (previously JSON-LD only) — both computed from existing registry/SEO data, zero per-page changes.
Deleted ~2,500 lines of inert `generateMetadata` exports left over in client components from before the SEO layout pattern existed.
34 pages moved off raw `navigator.clipboard` onto the shared helper with its `execCommand` fallback — copy no longer silently fails in non-secure contexts.
95 icon-only buttons across 31 pages gained `aria-label`s.
"100% Client-Side" tagline retired in favor of "Client-side by default" — accurate for the 8 tools that do hit a server route (already disclosed per-tool, just not reflected site-wide).
v1.3.1
V1.3.1 — antd v6 fixes, CORS auto-retry, Rich Text Editor UX
Sweep of antd v6 deprecation warnings, transparent CORS auto-fallback for SOAP Client and WSDL Parser, WSDL request headers support, Rich Text Editor formatting reliability and notepad UX, and a pkcs12 hydration fix.
Fix · Release details
SOAP Client — CORS auto-retry
Direct browser fetches that fail with a network/CORS error now **automatically retry through the server proxy** — no need to toggle 'Force server proxy' manually.
Fixed `Space direction="vertical"` → `orientation="vertical"` antd v6 deprecation in the SSL tab.
WSDL Parser — request headers & merged XSD
New collapsible **Request Headers** section on the WSDL input panel — configure headers in form or JSON mode, applied to every WSDL and XSD fetch.
WSDL and XSD fetches now **auto-fallback through the server proxy** on CORS failure (same pattern as SOAP Client).
**External XSD** section is now collapsed inside the WSDL input area rather than a separate tab — less clutter, optional by default.
Rich Text Editor — formatting & UX
All toolbar buttons now use `onMouseDown` with `preventDefault` to keep editor focus and selection intact — formatting commands (Bold, Italic, lists, alignment, colours) now work reliably.
Toolbar link button saves the selection on `mousedown` so the selected text is correctly linkified after the modal opens.
Editor area restyled as a **document canvas**: white paper background, increased padding, max-width constraint, and a subtle box-shadow separating it from the toolbar.
Removed 'Start typing here…' default placeholder — new documents open with an empty editor.
antd v6 deprecation fixes
`gzip-tools`: replaced static `message.success` import with `messageService` to avoid 'cannot consume context' warning; `Alert message=` → `title=`.
`ssh-key-generator`: `Alert message=` → `title=`.
`pkcs12-tool`: added `mounted` guard around `Input.Password` to suppress `data-sharkid` browser-extension hydration mismatch.
V1.3 — AI protocol tooling, Fun & Games expansion, persistence & polish
Protocol tooling for the AI era (MCP Inspector, A2A Inspector), a full Fun & Games expansion (Spin the Wheel, Magic 8-Ball, Typing Speed Test), two new persistent-text utilities (Sticky Notes, Rich Text Editor), enhanced WSDL/XSD import, and a reliability sweep fixing antd v6 deprecations and SSR hydration mismatches across the toolkit.
Feature · Release details
MCP Inspector (new tool)
Connect to any MCP server over **stdio**, **SSE**, or **HTTP** transport from the browser.
Four connection modes: **direct** (auto-fallback), **direct-strict** (no fallback), **via-server-proxy** (CORS-safe), and **via-mcp-proxy** (tunnels through `npx @modelcontextprotocol/inspector`).
Set **custom headers**, **request timeout**, **maximum total timeout**, and optionally **reset timeout on progress** for long-running tool calls.
**OAuth 2.0** PKCE flow with configurable client ID and redirect URL; **SSL/TLS** toggle and inspector proxy token fields.
**Diagnose** button runs a connectivity pre-flight and surfaces CORS, auth, and transport errors before you start calling tools.
Full tool listing, schema display, and interactive **call panel** — fill arguments, fire the call, inspect the raw result.
A2A Protocol Inspector (new tool)
Connect to any local or remote **Agent2Agent** agent by URL and inspect its **Agent Card** (name, description, capabilities, skills).
Supports both current A2A spec (`message/send` + `message/stream`) and legacy protocol (`tasks/send` + `agent.json`).
**Spec compliance checker** — validates the card against the A2A spec and surfaces missing or malformed fields.
**Streaming responses** — live-streamed via `fetch` + `ReadableStream`; task lifecycle, **contextId** tracking, and skill testing with structured input.
**Debug console** — shows every raw **JSON-RPC 2.0** request and response with syntax highlighting and copy-to-clipboard.
Persistent connection history and per-session message log.
WSDL Parser — external XSD support
New **Import XSD** tab: paste an external XSD document or load one by URL to resolve `<xsd:import>` / `<xsd:include>` references that point outside the WSDL.
Multiple XSD documents can be added to the import set; the parser resolves types across all of them before rendering the schema tree.
Spin the Wheel (new tool)
Customisable SVG spinning wheel with 2–12 entries, full-rotation Framer Motion animation, and a winner spotlight on landing.
Add, rename, or remove items freely; entries persist in **localStorage** across reloads.
12-colour palette auto-assigned to segments; winner highlight with gold border and animated reveal card.
Magic 8-Ball (new tool)
All 20 classic responses (10 positive, 5 neutral, 5 negative — same distribution as the original toy).
Animated SVG ball with radial-gradient 3D sheen and Framer Motion shake; fortune text rendered inside the triangle window.
Per-session response stats with animated progress bars and question history tracking last 8 entries.
Typing Speed Test (new tool)
Measures **WPM** (words per minute) and accuracy in real time using the standard correctChars ÷ 5 ÷ minutes formula.
Hidden textarea captures keystrokes; visible display highlights characters green (correct), red (error), purple (cursor), and faded (pending).
Four durations (15 s / 30 s / 60 s / 2 min); timer starts on first keystroke, auto-finishes when the passage is fully typed.
Results history shows last 5 tests with WPM, accuracy, and error count.
Sticky Notes & Rich Text Editor (new tools)
**Sticky Notes**: multi-board note management with colour themes and persistence in **localStorage**.
**Rich Text Editor**: WYSIWYG editing with export options, also persisted locally so content survives page reloads.
Resolved **SSR hydration mismatch** in Timer's `RingTicks` SVG: `Math.sin`/`Math.cos` coordinates rounded to 4 decimal places so Node.js and browser V8 emit identical strings.
Added `mounted` guards on antd `InputNumber`/`Input`/`Select` fields in Timer and Dice Roll to prevent browser-extension (`data-sharkid`) attribute injection from causing React hydration warnings.
Fixed MCP Inspector hydration: `localStorage` read moved from `useState` initialiser to `useEffect` so server and client see the same initial state.
v1.2
V1.2 — routing, polish, QA pass across 90 tools
Stable canonical URLs everywhere, refreshed workshop chrome aligned with landing marketing, Timer and Stopwatch in the toolkit, and a systematic smoke pass over every registry tool route. Developer ergonomics tightened (ESLint scoping for Monaco/vendor code, converters without side effects inside useMemo, React Compiler–clean fixes in QR, timestamp, URL parser).
Feature · Release details
URLs & deployment (Next.js 16)
Public paths stay **`/[categorySlug]/[toolId]`** (example: **`/formatters/html-formatter`**) via **`src/proxy.ts`** — the **`middleware`** file convention used in Next 15 does not forward to routes on this stack.
**`/tools/[id]`** still works: the proxy issues a **308** redirect to the canonical category URL for known tools.
Every tool id listed in **`tool-url-table.ts`** was checked with **`next start`**; all **90** canonical URLs returned **HTTP 200** and matching **`/tools/...`** returned **308** as expected.
Workshop UX & branding
Post-landing catalogue, **`AppShell`**, dashboards, tools, Memory, Release notes, and 404 styling use **`workspace.css`** with **`--wb-*`** tokens and **`wb-*`** classes — warm stone neutrals plus emerald / amber accents, separate from **`landing-*`** marketing styles in **`globals.css`**.
Landing page remains a branded scroll experience with hero animations, stats strip, category showcase grid, theme-aware palettes, down to narrow phones.
Top-bar version **`1.2`** aligns with **`APP_VERSION`** here; **`/release-notes`** documents this changelog.
New productivity tools
**Timer**: presets (1 min–1 hr), custom H:M:S, circular ring, completion chime via Web Audio, Pomodoro-style session label.
**Stopwatch**: 10 ms ticks, laps with best/worst highlights, totals and averages.
Reliability & housekeeping
**QR Generator**: hoist async generator with **`useCallback`** before the syncing effect so callbacks are not invoked before initialization.
**Timestamp Converter**: avoid impure **`Date.now()` / `new Date()`** directly in **`useState` initializers**; seed once in **`useEffect`** after mount.
**URL Parser**: render the literal **`//` authority separator** safely in JSX (**`{ '//' }`**) so the parser doesn’t treat it as a comment.
**ESLint**: ignore copied **`public/monaco/**`; relax **`react-hooks/set-state-in-effect`**/**`set-state-in-render`** under **`src`** for established editor-sync patterns; **`no-explicit-any`** and **`no-unescaped-entities`** are warnings until tightened tool-by-tool.
Lint scope is **`src`** only (**`npm run lint`** uses **`eslint src`**).
A polish-and-trust release. The dashboard now opens with a privacy-first overview, the catalog is searchable end-to-end, and several tools picked up real-world fixes. No paid features, no telemetry — same promise, more honest about its limits.
Feature · Release details
Dashboard overview & navigation
New 'Learn More About This App' panel — default expanded, leads with the security and privacy promise.
Full categorized catalog inside the panel: every section listed with every tool and a short description.
Removed the matrix-style scramble tagline so the privacy message reads in a single scan.
Version badge added to the topbar; clicking the Memory icon stays one click away.
This Release Notes panel itself — collapsible, sorted newest first, color-coded by change kind.
Privacy & security hardening
Removed every third-party runtime request — no Google Fonts CDN, no analytics, no telemetry, no external scripts.
Replaced the crt.sh CT log search with a local live-server certificate inspection over a direct TLS socket. Domain names you inspect never go to a third party.
Added a same-origin CORS proxy so the API Request Builder can hit any endpoint without leaking the referrer to a third party.
Honest in-browser certificate-generation messaging: Web Crypto cannot emit a valid X.509 cert, so the self-signed tab now warns and points to the matching OpenSSL command instead of claiming success.
Open source on GitHub — every privacy claim is independently auditable.
New & improved tools
Certificate suite consolidated: 10 separate cert tools merged into 4 cohesive ones (Inspector, Chain & SSL, Generator, PKCS#12).
Fixed CSR generation for ECDSA and Ed25519 — signatures now verify correctly with OpenSSL.
URL fetch lets you inspect any live server's certificate chain directly from the browser.
Expanded Learn-More copy across URL Parser, Swagger Viewer, JSONPath Tester, WSDL Parser, IP Address Tools, and MAC Address Tools — with RFC references and real-world examples.
PWA, mobile, and discoverability
Installable as a Progressive Web App with full offline support for every tool.
Every tool page is mobile-responsive end-to-end; footer padding scales with clamp() so sub-360px phones aren't cramped.
Cmd/Ctrl-K opens a global command palette that jumps to any tool with keyboard navigation.
Header search is keyboard-navigable with category grouping in the dropdown.
Storage & memory management page so you can see and clear what's persisted locally.
Certificate Validator URL layout cleaned up on small screens.
v1.0
Initial public release
First public edition of My Dev Tools — a private, offline-capable workshop of developer utilities that runs entirely in your browser. No accounts, no uploads, no tracking.
Feature · Release details
Formatting, validation & diff
Formatters for JSON, XML, YAML, HTML, CSS, JavaScript, and SQL with prettify and minify modes.
Validators for JSON, XML, HTML, XSD schema, email addresses, and credit-card numbers (Luhn).
Side-by-side diff for JSON, XML, and arbitrary text.
Data conversion
Bidirectional XML ↔ JSON, YAML ↔ JSON, CSV ↔ JSON, and CSV ↔ XML converters.
JSON to TypeScript and Java POJO code generators.
XSLT transformer with live preview.
Encoding & cryptography
Base64, URL, HTML entities, Unicode, Hex, and Gzip encoders/decoders.
Hash generation: MD5, SHA-1/224/256/384/512, SHA-3, RIPEMD-160; HMAC; BCrypt with verify.
Full JOSE suite: JWT decoder, JWS sign/verify, JWE encrypt/decrypt, JWK generator.
AES encrypt/decrypt with passphrase or key.
Certificates, keys & SSH
X.509 certificate inspection (PEM/DER), fingerprinting, format conversion, and PEM-bundle parsing.
Self-signed certificate and CSR generation with RSA/ECDSA keys.
PKCS#12 (.pfx) and Java KeyStore (.jks) tooling.
RSA, ECDSA, and Ed25519 key-pair generation; SSH key generation with optional passphrase.
API, web services & network
REST API request builder with auth, headers, body, history, and cURL export.
Swagger / OpenAPI viewer; SOAP client and WSDL parser; JSONPath and XPath testers.
URL parser; IP address tools (IPv4/IPv6); subnet calculator; MAC address lookup.
Reference tables: HTTP status codes, MIME types, port numbers, RFC standards, IP ranges.
Generators & utilities
UUID, password, QR code, and Lorem Ipsum generators.
String case converter, escape/unescape, Unix permission calculator, cron expression parser.
Markdown preview, Markdown table builder, slug generator, regex tester with live highlights.
Color picker, color-contrast checker, timestamp converter, number-base converter.
Foundations
100% client-side execution — no data ever leaves your browser.