Vaultools
Menu

Changelog

What has changed on Vaultools, newest first — new tools, fixes, corrections and security updates. If it's listed, it shipped.

  1. Improvement

    The site's own typefaces

    Headings, body text and code now use the typefaces the site was designed with (Fraunces, Inter and JetBrains Mono) instead of whatever fonts your device had installed. The font files are served from vaultools.dev itself, so they add no request to any other site.

  2. Improvement

    Related tools on every tool page

    Each tool page now ends with a short list of related tools, so it’s one click from the JWT decoder to the Base64 decoder, from the cron explainer to the timestamp converter, and so on.

  3. Improvement

    A redesigned homepage

    The homepage now groups the tools by what they work on (tokens and security, encoding, data and text, time and systems), each with an icon, and points to the new Format Identifier for when you’re not sure which tool you need. On phones, the menu now sits behind a single button instead of wrapping across the header.

  4. New tool

    Format Identifier

    Not sure what a string is? The Format Identifier tells you whether it’s a JWT, JSON, a certificate, Base64, a URL, a cron schedule, a timestamp, a UUID, a hash or a set of file permissions. It shows why each match was made, ranks them when more than one fits, and opens the right tool with your value already filled in. The value is handed over inside the same browser tab, never through the URL. It never claims to recognize encrypted data, and a new glossary entry, encoding vs encryption, explains why.

  5. Improvement

    Lighter, pausable demo recordings

    The tool demos on How it works are now short videos instead of animated GIFs: about a tenth of the download, sharper, and re-recorded with the site’s own typefaces. Each one plays when you scroll to it and has controls, so you can pause it. If your device asks for reduced motion, nothing plays until you press play.

  6. Fix

    www.vaultools.dev now works

    Typing www.vaultools.dev used to fail with a “site can’t be reached” error, because that address didn’t exist. It now redirects to vaultools.dev, keeping the page and any query string you were going to.

  7. New tool

    HTML Entity Encoder & Decoder

    The HTML Entity Encoder & Decoder escapes text for HTML, as named, decimal or hex references, and decodes entities using the same rules a browser follows. That means it points out the mistakes browsers quietly accept: missing semicolons, misspelled names, numbers read as Windows-1252 characters, and text that was encoded twice. It also searches all 2,125 named entities by name, character or code point. The glossary gained an HTML entity entry.

  8. Fix

    Clearer demo animations

    The demos on How it works that click a Copy button showed it reporting “Copy failed”, an artifact of how they were recorded rather than a problem with the tools. Those five are re-recorded and now show “Copied”. The still image each demo shows before it loads, or instead of the animation when your system asks for reduced motion, is now the demo’s finished result rather than its empty starting screen.

  9. Improvement

    CLI covers all eleven tools

    The vaultools command-line tool (version 0.2.0 on npm) now includes the certificate decoder, Base64, URL, cron, chmod and HTML entity tools, using the same code as the site, so nothing you pipe through it leaves your machine. With a Pro license it also adds three checks for CI pipelines that fail the build on a problem: certificates expiring within a set number of days, invalid schedules in a crontab, and world-writable or setuid files in stat or find output. The original CLI entry said piped input needed Pro; it never did, and that entry is now corrected.

  10. New tool

    chmod Calculator

    The chmod Calculator converts Unix file permissions between octal (755), the rwxr-xr-x form that ls -l prints, and both styles of chmod command. It explains what a mode lets the owner, group and everyone else do, with different wording for files and directories, flags risky modes such as world-writable files, and previews what a change like u+x or go-w would do. It follows GNU chmod’s rules for the umask and for directories’ setuid and setgid bits. The glossary gained a Unix file permissions entry.

  11. Security

    Removed an analytics script added by our host

    Cloudflare, which hosts this site, was adding its own visitor analytics script (“Real User Monitoring”) to every page served at vaultools.dev. We found it on 24 September while checking the site in a browser. The site’s Content Security Policy blocked the script on every page, so it never loaded or ran, and nothing about your visits or what you pasted was sent to Cloudflare or anyone else. It did show up as a blocked-script error in the browser console. The setting is now turned off, so the script is no longer added at all. Tool pages continue to send no network requests of any kind.

  12. Security

    Ad fraud check allowed on pages with ads

    Pages that show an ad now allow requests to Google’s ad traffic quality service (*.adtrafficquality.google), which the ad network uses to detect invalid clicks and impressions. The site-wide policy had been blocking it, which logged a policy error in the browser console on those pages. Tool pages are unchanged: they still send their own stricter policy that allows no advertising or third-party domains at all.

  13. New tool

    X.509 Certificate Decoder

    Paste a PEM certificate or a whole chain into the X.509 Certificate Decoder to see its subject, issuer, alternative names, expiry, key details, extensions and SHA-256 and SHA-1 fingerprints. It runs locally, and a private key pasted alongside a certificate is ignored and never displayed. It does not validate chains or check revocation, since that needs a trust store or the network.

  14. New tool

    URL Encoder, Decoder & Query String Parser

    The URL Encoder, Decoder & Query String Parser percent-encodes and decodes text in three styles (component, full URL and form), explains malformed input by position, and warns when text looks double-encoded. Its parser breaks any URL into scheme, host, port, path and fragment, and lists every query parameter, keeping repeated keys in order and marking them. The glossary gained Percent-encoding and Query string entries.

  15. New content

    Developer glossary

    A developer glossary of the terms behind the tools: JWT, Base64URL, PEM, X.509 certificates, SANs, UUIDs, SHA-256, Unix timestamps, ISO 8601, regex capture groups and JSON. Each entry has worked examples, common pitfalls, references and a link to the matching tool.

  16. New tool

    Cron Expression Explainer

    The Cron Expression Explainer turns a standard five-field cron schedule into plain English, breaks down each field, and lists the next 10 run times in your local time or UTC. It follows the day-of-month/day-of-week rule that surprises people, warns where implementations disagree, and explains Quartz- and AWS-style expressions as unsupported instead of misreading them. The glossary gained a Cron expression entry.

  17. Fix

    Corrected the CLI availability claim

    The Pro page said every tool is also available as a CLI. Only the JSON, JWT, UUID and hash, regex and timestamp tools are. The X.509 certificate decoder and Base64 tool are browser-only for now, and the batch-processing lists on the site now name the tools that support it.

  18. New content

    This changelog

    A running record of what changes on Vaultools, including fixes and corrections.

  19. New tool

    Base64 Encoder & Decoder

    The Base64 Encoder & Decoder converts text or a file to Base64 and back, with full Unicode support, an optional URL-safe alphabet and a data: URI mode. Decoding accepts either alphabet, line-wrapped input and missing padding, and reports exactly which character is wrong when the input is invalid. The glossary also gained a Base64 entry.

  20. Fix

    Real 404s, accurate dates

    • Unknown URLs now return a proper 404 page instead of the homepage with a 200 status.
    • The Privacy and Terms pages showed the day of the latest deploy as “last updated”. They now show the date the text was actually written.
    • The sitemap now carries an accurate last-modified date for every page.

  21. Fix

    Consistent page URLs

    Every internal link and canonical tag now uses the trailing-slash form of a URL (/about/), which is the form the site actually serves. Before, links pointed at the no-slash form, which redirected.

  22. New content

    FAQ and reference sections on every tool page

    Each tool page now has a reference section and FAQ beside the tool: JSON syntax errors explained, JWT claim structure and what decoding does not prove, UUID collision odds, JavaScript regex flags, and Unix time and time zone pitfalls.

  23. Security

    Stricter policy on tool pages

    Tool pages now send exactly one, stricter Content-Security-Policy, set at the edge, that does not allow advertising domains. Earlier the tool-page policy stacked on top of the site-wide one, which was harder to audit.

  24. Security

    Security headers

    Added HTTP security headers: HSTS, a Content-Security-Policy, X-Frame-Options and Permissions-Policy. A CSP matters here because it limits what a compromised script could do with the tokens and configs you paste. A build dependency (fast-uri) was also updated to patch a host-confusion vulnerability, GHSA-7p8r-x3mc-p8w7.

  25. Improvement

    Clearer homepage and page navigation

    The homepage was rewritten to read more like a developer README, and longer pages now have a sticky “On this page” sidebar on wide screens.

  26. Fix

    Corrected two overstated claims

    • Batch processing is available in most tools, not every tool: the JWT decoder has none. The Pro page and FAQs now say so.
    • The How it works page no longer claims zero network requests. It can show an ad, which is a real third-party request. That claim applies to the tool pages, where no ad or third-party script is ever loaded.

  27. New tool

    The vaultools command-line tool

    The same tools, for scripts and CI: vaultools on npm wraps the code behind the web tools. Single-value commands are free, whether the value is an argument, a file or piped in, and batch commands need a Pro license. It uses the same license as the web app.

  28. New content

    About, Privacy and Terms pages

    Added About, Privacy and Terms pages, covering why Vaultools exists, exactly what data is and isn’t collected, and the terms of use.

  29. Improvement

    Pro purchase and license improvements

    • Your license key now appears on the checkout success page and is also emailed to you.
    • Cancelling a subscription revokes its key, and switching to the one-time plan cancels an existing subscription automatically.
    • Monthly subscribers can see their next billing date.
    • Added a contact page and a cancellation policy.

  30. New tool

    Regex Tester and Timestamp Converter

    Two more tools. The Regex Tester shows matches, capture groups and a live replacement preview. The Timestamp Converter converts Unix timestamps to readable dates and back.

  31. Improvement

    Pro batch mode

    Pro adds batch mode to the JSON formatter, UUID and hash generator, regex tester and timestamp converter: process many items in one pass, still entirely in your browser. The JWT decoder has no batch mode.

  32. New tool

    The first three tools

    The first release: a JSON formatter and validator, a JWT decoder and a UUID and hash generator. Every tool runs entirely in your browser, so nothing you paste is sent to a server. A How it works page shows each tool in a short recorded demo.