Disclaimer

Last updated: August 15, 2026

The tools on DevKit Forge are provided for general development, testing, and informational purposes. This page lays out, tool by tool, the specific limits worth knowing before you rely on the output.

JSON Formatter & Validator

Validation matches your browser's native JSON.parse() exactly, so results are as reliable as your JavaScript runtime itself. It doesn't check anything beyond JSON syntax — for example, it won't tell you if your JSON doesn't match a particular schema your application expects.

Base64 Encode/Decode

Built for text input using proper UTF-8 handling. It is not intended for encoding large binary files — very large inputs may be slow or hit browser memory limits, since the entire result is held in memory and rendered as text.

URL Encode/Decode

Uses the browser's native encodeURI/encodeURIComponent functions. It does not implement the older application/x-www-form-urlencoded convention used by HTML forms (where spaces become +) — if your use case specifically needs that convention, this tool's output will differ from it.

⚠ JWT Decoder — no signature verification. This tool decodes a JWT's header and payload only. It does not verify the token's signature, which means it cannot tell you whether a token is authentic, was tampered with, or has expired according to your specific system's clock tolerance. Never use decoded-but-unverified JWT contents as the basis for an authorization decision in production code — always verify signatures server-side with the appropriate secret or public key.

Regex Tester

Uses your browser's native JavaScript regex engine (ECMAScript syntax). Regex dialects vary across languages — a pattern that works here may need adjustment for PCRE (PHP), Python's re module, or other engines with different syntax and behavior.

⚠ Hash Generator — not for password storage. MD5 and SHA-1 are cryptographically broken and unsuitable for any security purpose. SHA-256, while currently considered secure for integrity checks, is a fast general-purpose hash and is not appropriate for hashing passwords — use a dedicated slow, salted algorithm like bcrypt, scrypt, or Argon2 for that instead. These hashes are provided for checksums, data integrity verification, and general-purpose use.

General

We test each tool against known reference values where applicable (for example, the MD5 implementation is verified against standard RFC 1321 test vectors), but we cannot guarantee every tool is free of edge-case bugs. If you find one, please let us know — we take correctness seriously and will fix confirmed issues.

This disclaimer should be read alongside our Terms of Use, which includes our full "no warranty" and limitation-of-liability terms.