# Scrambl.it - Complete Documentation > Scrambl.it is a professional suite of 11 free developer and security tools that run 100% offline in the browser. Zero data transmission, no registration required, no usage limits. All processing happens client-side using Web Crypto API and Canvas API for complete privacy. Used by web developers, security engineers, DevOps engineers, system administrators and website owners worldwide. Scrambl.it solves the problem of needing quick, reliable developer utilities without compromising data privacy. Unlike most online tools that upload your data to servers, every Scrambl.it tool processes data entirely in your browser. You can even use it offline as a Progressive Web App (PWA). No account needed - just open and use. Website: https://scrambl.it Privacy Policy: https://scrambl.it/privacy All tools are free, unlimited, and require no registration. --- ## JSON Formatter & Validator URL: https://scrambl.it/tools/json-formatter ### What It Does Format, validate, beautify and minify JSON online. Includes syntax highlighting, error detection with exact line and column numbers, tree view visualization and file statistics. Supports relaxed JSON (unquoted keys, arrow syntax) with automatic conversion to strict JSON. ### Key Features - JSON formatting with customizable indentation (2 spaces, 4 spaces, tab) - JSON validation with detailed error messages showing exact line and column - JSON minification for production deployment - Syntax highlighting with color-coded data types - Tree view visualization with expand/collapse and type icons - File statistics: lines, bytes, nodes, depth - Copy formatted/minified output to clipboard - Download formatted JSON as file - Relaxed JSON support (Ruby/PHP/JS style with unquoted keys and arrow syntax) - Unicode and special character support - 100% offline processing ### When to Use - Formatting API responses for debugging - Validating JSON configuration files - Minifying JSON for production - Debugging malformed JSON with exact error location - Converting relaxed JSON (from Ruby/PHP) to strict JSON - Inspecting deeply nested JSON structures with tree view - Preparing JSON for documentation ### Technical Details - Handles deeply nested objects and arrays - Detects syntax errors, unclosed brackets, unclosed strings, trailing commas, invalid characters, malformed objects - Supports all JSON data types: strings, numbers, booleans, null, objects, arrays - Tree view shows type icons for each node ### FAQ **What is a JSON formatter?** A JSON formatter transforms compact, hard-to-read JSON into clean, indented, human-readable format. It validates JSON syntax and highlights errors with exact line and column numbers, making debugging fast and easy. **How do I validate JSON?** Paste your JSON into the input area and click "Format & Validate". The tool instantly checks for syntax errors and shows detailed error messages with the exact line and column number where the error occurs. **What is the difference between formatting and minifying?** Formatting adds whitespace, indentation and line breaks for human readability. Minifying removes all unnecessary whitespace to reduce file size for production use. Both produce valid JSON. **Can it handle large JSON files?** Yes, the formatter can handle large JSON files limited only by your browser's available memory. It works well with deeply nested structures and large arrays. **What errors does it detect?** Syntax errors, mismatched brackets, unclosed strings, trailing commas, invalid characters, malformed objects and arrays. Each error includes the exact line and column number. **What is relaxed JSON?** Relaxed JSON allows unquoted keys and arrow syntax (like Ruby hashes). The formatter automatically converts relaxed JSON to strict, standard JSON format. --- ## Hash Generator URL: https://scrambl.it/tools/hash-generator ### What It Does Generate cryptographic hashes for text and files using industry-standard algorithms. Create HMAC signatures for API authentication. Batch process multiple texts. Verify and compare hashes. Supports SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32, xxHash, MD5 and SHA-1. ### Supported Algorithms **Industry Standard (recommended for security):** - SHA-256 (256-bit, 64 hex chars) - Most widely used, recommended default - SHA-384 (384-bit, 96 hex chars) - SHA-512 (512-bit, 128 hex chars) - Highest security SHA-2 **Modern Algorithms:** - SHA-3-224 (224-bit) - SHA-3-256 (256-bit) - Latest NIST standard (2015) - SHA-3-384 (384-bit) - SHA-3-512 (512-bit) - BLAKE2b (256-bit) - Faster than SHA-3 - BLAKE2s (256-bit) - Optimized for 32-bit - BLAKE3 (256-bit) - Extremely fast, more secure than SHA-2/SHA-3 **Fast Checksums (NOT for security):** - CRC32 (32-bit) - Error detection, file integrity - xxHash (32-bit) - Ultra-fast non-cryptographic hash **Legacy (NOT recommended for new projects):** - MD5 (128-bit) - Cryptographically broken, collision attacks exist - SHA-1 (160-bit) - Deprecated, collision attacks demonstrated ### Key Features - Text hashing with any supported algorithm - File hashing for any file size (limited by browser memory) - HMAC generation with hex or text key input - HMAC truncation and custom formatting - Multiple output formats: hex (upper/lowercase), Base64, Base64url - Batch processing (one text per line, all hashed at once) - Hash verification and comparison tool (visual match/no-match) - Test examples with known correct hash values - Full UTF-8 and Unicode support - 100% offline - uses Web Crypto API ### When to Use - Verifying file integrity after download - Creating HMAC signatures for API authentication and webhooks - Generating content fingerprints for deduplication - Verifying blockchain transactions - Creating digital signatures - Batch hashing multiple values for database operations - Comparing hashes to detect file tampering ### Algorithm Selection Guide - **General purpose:** SHA-256 (most compatible, widely supported) - **Maximum security:** SHA-512 or SHA-3-512 - **Modern and fast:** BLAKE3 (fastest secure hash) - **API/webhook signatures:** SHA-256 HMAC or SHA-512 HMAC - **File checksums (non-security):** CRC32 or xxHash - **Legacy system compatibility:** MD5 or SHA-1 (avoid for security) ### Important Security Notes - MD5 is cryptographically broken - do NOT use for security - SHA-1 is deprecated - collision attacks have been demonstrated - Never use raw hashes for password storage - use Argon2, bcrypt or scrypt instead - CRC32 and xxHash are NOT cryptographic - use only for checksums and speed ### FAQ **What is a hash generator?** A hash generator creates a unique fixed-length fingerprint (digest) from any input data using cryptographic algorithms. The same input always produces the same hash, but you cannot reverse a hash back to the original data. Used for file integrity verification, digital signatures, API authentication and blockchain. **Is MD5 secure?** No, MD5 is cryptographically broken. Collision attacks allow creating two different inputs with the same MD5 hash. Use SHA-256 or SHA-512 instead for any security-related purpose. **Which algorithm should I use?** SHA-256 for most use cases - it is the industry standard. SHA-512 for highest security requirements. SHA-3 or BLAKE3 for modern alternatives. CRC32 or xxHash only for fast non-security checksums. **How do I verify file integrity?** Generate a hash of the file using the file hashing feature, then compare it with the expected hash value using the built-in verification tool. A match confirms the file has not been tampered with. **What is HMAC?** HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to create authenticated signatures. Used for API authentication, webhook verification, JWT token signing and message integrity. Unlike plain hashes, HMAC proves the sender knows the secret key. **Can I hash large files?** Yes, the tool can hash files of any size, limited only by your browser's available memory. Processing happens entirely in your browser. **What is the difference between CRC32, xxHash and SHA-256?** CRC32 is for basic error detection (not secure). xxHash is for ultra-fast non-cryptographic hashing. SHA-256 is for security-critical applications. Choose based on whether you need speed or security. **What is BLAKE3?** BLAKE3 is the latest in the BLAKE family of hash functions. It is extremely fast (faster than MD5 on modern hardware), more secure than SHA-2 and SHA-3, and parallelizable. Excellent choice for modern applications. --- ## Password Generator URL: https://scrambl.it/tools/password-generator ### What It Does Generate cryptographically secure random passwords with customizable length (4-128 characters) and character requirements. Uses the Web Crypto API (CSPRNG) - the same cryptographic random number generator used by professional password managers. ### Key Features - Password length: 4 to 128 characters - Character types: uppercase (A-Z), lowercase (a-z), numbers (0-9), symbols (~!@#$%^&*()_+-={}[]|:;"'<>,.?/) - Exclude similar characters: i, l, 1, L, o, 0, O (prevents visual confusion) - Exclude ambiguous characters: { } [ ] ( ) / \ ' " ~ (prevents typing issues) - Real-time password strength meter - Entropy calculation in bits - One-click copy to clipboard - Cryptographically secure using Web Crypto API (crypto.getRandomValues) - 100% offline generation ### Strength Levels - **Weak:** Less than 40 bits entropy - **Fair:** 40-60 bits entropy - **Good:** 60-80 bits entropy - **Strong:** 80-100 bits entropy - **Very Strong:** 100+ bits entropy ### Recommended Password Lengths - **General accounts (social media, forums):** 12-16 characters minimum - **Important accounts (email, banking):** 16-20 characters - **High-security (admin, root, master passwords):** 20-32 characters - **API keys, database passwords:** 32-64 characters - **Maximum security:** 64-128 characters ### When to Use - Creating passwords for new accounts - Generating strong master passwords for password managers - Creating database passwords - Generating Wi-Fi passwords - Creating temporary access passwords - Generating passwords that meet specific complexity requirements ### Best Practices - Use at least 16 characters with all character types enabled - Never reuse passwords across different accounts - Store passwords in a password manager (Bitwarden, 1Password, LastPass, KeePass) - Enable two-factor authentication (2FA) wherever possible - Change passwords immediately if a breach is detected ### FAQ **How secure are the generated passwords?** Extremely secure. The generator uses the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG), the same technology used by professional password managers. The randomness is true cryptographic randomness, not Math.random(). **What makes a password strong?** Four factors: length (12+ characters minimum), character variety (uppercase, lowercase, numbers, symbols), unpredictability (cryptographic randomness, not dictionary words), and uniqueness (never reused). A password with 80+ bits of entropy is considered strong. **What length should I use?** Minimum 12 for general use. 16+ for important accounts (email, banking). 20+ for high-security (admin, root). 32+ for database and API keys. Longer is always better. **Why exclude similar characters?** Characters like i, l, 1, L, o, 0, O look very similar in many fonts. Excluding them prevents confusion when typing passwords manually. This slightly reduces entropy but significantly improves usability. **Can I use these for my accounts?** Yes, these passwords are production-ready for any account. Always store them in a password manager and never reuse them. Enable 2FA for additional security. --- ## Base64 Encoder & Decoder URL: https://scrambl.it/tools/base64-encoder-decoder ### What It Does Encode text and binary data to Base64 format and decode Base64 strings back to their original form. Full UTF-8 Unicode support including emoji and non-Latin characters. ### Key Features - Base64 encoding with full UTF-8 support - Base64 decoding with error handling - Handles Unicode text including emoji, CJK characters, Arabic, Hebrew, etc. - Instant conversion - Copy to clipboard - Separate encoder and decoder sections - 100% offline processing ### How Base64 Works Base64 encoding converts binary data to text using 64 characters: A-Z (26), a-z (26), 0-9 (10), + and /. Every 3 bytes of input become 4 Base64 characters. Padding with = is added when input length is not a multiple of 3. This means Base64 always increases data size by approximately 33%. ### Common Use Cases - **Email attachments (MIME):** Binary files encoded for text-based email protocols - **Data URIs in HTML/CSS:** Embed small images directly in code (`data:image/png;base64,...`) - **JSON and XML:** Store binary data in text-only formats - **HTTP Basic Authentication:** Username:password encoded as Base64 - **JWT tokens:** Header and payload are Base64url encoded - **API request/response bodies:** Binary data in JSON APIs - **Database storage:** Binary data in text columns ### Base64 vs Base64URL - **Base64:** Uses + and / characters. Standard encoding. - **Base64URL:** Uses - and _ instead. Safe for URLs, filenames and query parameters. Used in JWT tokens. ### Important Notes - Base64 is encoding, NOT encryption. Anyone can decode Base64. Never use it to protect sensitive data. - Base64 increases data size by ~33%. A 100KB file becomes ~133KB in Base64. - Always remove whitespace from Base64 strings before decoding. ### FAQ **What is Base64 encoding?** Base64 is a binary-to-text encoding scheme that converts binary data into a string of 64 ASCII characters (A-Z, a-z, 0-9, +, /). Every 3 bytes of input produce 4 Base64 characters. It is used whenever binary data needs to be stored or transmitted as text. **When should I use Base64?** Use Base64 for: embedding binary data in JSON/XML, HTTP Basic Auth headers, data URIs in HTML/CSS, email attachments (MIME), JWT tokens, storing binary data in text databases, and passing binary data in URL query parameters (use Base64URL variant). **Can I decode JWT tokens with this?** You can decode the Base64-encoded parts of a JWT token (header and payload) to read their contents. However, this does not verify the JWT signature. For signature verification, use a dedicated JWT library. **Why does Base64 increase file size?** Because 3 bytes of binary data are encoded as 4 Base64 characters (each 1 byte). This is a 33% size increase. A 100KB image becomes approximately 133KB when Base64 encoded. --- ## API Key Generator URL: https://scrambl.it/tools/api-key-generator ### What It Does Generate cryptographically secure API keys, authentication tokens and UUID v4 identifiers with multiple format options. Uses the Web Crypto API CSPRNG for production-ready key generation. ### Key Formats - **Alphanumeric:** A-Z, a-z, 0-9 (62 characters). Most versatile, URL-safe, works everywhere. - **Hexadecimal:** 0-9, a-f (16 characters). Compact binary representation, common in cryptography. - **Base64:** A-Z, a-z, 0-9, +, / (64 characters). Higher density encoding, common in APIs. - **UUID v4:** RFC 4122 compliant, 36 characters (xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx). Globally unique identifiers. ### Key Length Recommendations - **32 characters:** Minimum for production REST APIs - **48 characters:** Recommended for sensitive applications, webhook secrets - **64 characters:** High-security applications, database tokens - **128 characters:** Maximum security - **36 characters (UUID):** Standard for unique identifiers, database primary keys ### Key Features - Customizable key length: 8 to 128 characters - Four format options: alphanumeric, hex, Base64, UUID v4 - Cryptographically secure random generation (Web Crypto API) - One-click copy to clipboard - Instant generation - 100% offline - keys never leave your browser ### When to Use - Generating API keys for REST APIs - Creating webhook secrets for signature verification - Generating database authentication tokens - Creating session tokens - Generating service-to-service authentication keys - Creating unique identifiers (UUID v4) for database records ### Security Best Practices - Store keys in environment variables, never in source code - Use secret managers: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault - Never commit keys to Git repositories - Rotate keys regularly (every 90 days recommended) - Always transmit keys over HTTPS - Monitor key usage for anomalies - Set key expiration dates - Use separate keys for different environments (dev, staging, production) ### FAQ **What are API keys?** API keys are secret tokens used for authentication and authorization in web APIs. They verify the identity of the requesting application, control access levels, track usage for billing, and enforce rate limits. **How secure are the generated keys?** Extremely secure. The generator uses the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG). The keys are production-ready and suitable for any security-critical application. **Which format should I choose?** Alphanumeric for most APIs (URL-safe, universal compatibility). Hexadecimal for cryptographic applications. Base64 for higher density. UUID v4 for globally unique identifiers and database primary keys. **How should I store API keys securely?** Use environment variables or dedicated secret managers (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault). Never hardcode keys in source code. Never commit them to Git. Use .gitignore and .env files. --- ## URL Encoder & Decoder URL: https://scrambl.it/tools/url-encoder-decoder ### What It Does Encode special characters in URLs using percent-encoding (RFC 3986) for safe web transmission. Decode percent-encoded URLs back to readable text. Full UTF-8 Unicode support. ### How URL Encoding Works URL encoding (percent-encoding) converts special characters to a percent sign followed by two hexadecimal digits. For example: space becomes %20, & becomes %26, = becomes %3D. This is necessary because URLs can only contain a limited set of ASCII characters. ### Safe Characters (not encoded) A-Z, a-z, 0-9, hyphen (-), underscore (_), period (.), tilde (~) ### Common Encoded Characters - Space: %20 - !: %21 - ": %22 - #: %23 - $: %24 - %: %25 - &: %26 - =: %3D - ?: %3F - @: %40 - +: %2B ### Key Features - URL encoding using encodeURIComponent (encodes ALL special characters) - URL decoding using decodeURIComponent - Full UTF-8 Unicode support - Separate encoder and decoder sections - Copy to clipboard - 100% offline processing ### When to Use - Encoding query parameter values - Encoding form data for submission - Preparing API endpoint URLs - Encoding OAuth signatures - Encoding filenames with special characters - Encoding email addresses in URLs - Encoding non-ASCII characters (Unicode) in URLs ### FAQ **What is URL encoding?** URL encoding (percent-encoding) converts special characters to a safe format for URLs. Characters like spaces, &, =, ? and # have special meaning in URLs, so they must be encoded as percent + hex digits (%20, %26, %3D) when used as data rather than URL structure. **When should I use URL encoding?** Whenever you place user input or special characters in a URL: query parameter values, form data, API endpoints, file names, OAuth signatures. Always encode individual values, not the entire URL structure. **What is the difference between encodeURI and encodeURIComponent?** encodeURI preserves URL structure characters (:, /, ?, &, =, #). encodeURIComponent encodes ALL special characters including URL structure characters. This tool uses encodeURIComponent which is safer for encoding individual values. **Should I use + or %20 for spaces?** Both represent spaces. + is used in query strings (application/x-www-form-urlencoded). %20 is used in URL paths and is more universal. This tool uses %20. --- ## HTML Encoder & Decoder URL: https://scrambl.it/tools/html-encoder-decoder ### What It Does Escape HTML special characters to their entity equivalents for safe display in web pages. Prevents XSS (Cross-Site Scripting) attacks by converting dangerous characters to harmless entities. Also decodes HTML entities back to their original characters. ### Characters Encoded - & becomes &amp; - < becomes &lt; - > becomes &gt; - " becomes &quot; - ' becomes &apos; ### Entity Types - **Named entities:** &lt; &gt; &amp; (human-readable, limited set) - **Decimal numeric entities:** &#60; &#62; (work for any Unicode character) - **Hexadecimal numeric entities:** &#x3C; &#x3E; (hex format) ### Key Features - HTML entity encoding for all dangerous characters - HTML entity decoding (named, decimal and hex entities) - XSS attack prevention (as part of defense-in-depth) - Full Unicode support - Separate encoder and decoder sections - Copy to clipboard - 100% offline processing ### When to Use - Displaying user-generated content safely in HTML - Showing HTML/XML code examples on web pages - Escaping special characters in blog posts and comments - Preventing XSS in web applications (as one layer of defense) - Encoding characters for email HTML templates - Displaying search results containing HTML markup ### Important Security Note HTML encoding for element content is ONE layer of XSS defense. For comprehensive protection, also use: Content Security Policy (CSP), input validation, context-specific encoding (different for HTML attributes, JavaScript, CSS, URLs), and auto-escaping template engines. ### FAQ **What are HTML entities?** HTML entities are special codes that represent reserved characters in HTML. They start with & and end with ;. For example, &lt; represents <, &gt; represents >, and &amp; represents &. They allow you to display these characters as text instead of having them interpreted as HTML markup. **How does HTML encoding prevent XSS?** By converting dangerous characters to harmless entities. The string <script>alert('XSS')</script> becomes &lt;script&gt;alert('XSS')&lt;/script&gt; which displays as text instead of executing as code. **When should I use HTML encoding?** Whenever you display user-generated content, code examples, form input, search results, or any text that might contain HTML special characters. Encode on output (when rendering), not on input (when storing). --- ## Hex Encoder & Decoder URL: https://scrambl.it/tools/hex-encoder-decoder ### What It Does Convert text to hexadecimal representation (base-16) and decode hexadecimal strings back to readable text. Each character is converted to its hex byte value. ### How Hexadecimal Works Hexadecimal (base-16) uses 16 symbols: 0-9 for values 0-9 and A-F for values 10-15. Each hex digit represents 4 bits (a nibble). Two hex digits represent one byte (8 bits, values 0-255). For example, the letter 'A' has ASCII value 65, which is 41 in hexadecimal. ### Key Features - Text to hexadecimal encoding - Hexadecimal to text decoding - Handles whitespace in hex input (spaces, line breaks) - Case-insensitive decoding (accepts both FF and ff) - Copy to clipboard - Separate encoder and decoder sections - 100% offline processing ### Common Use Cases - **Cryptographic hashes:** Displaying SHA-256, MD5 hash values - **Color codes:** CSS colors (#FF5733 = Red:255, Green:87, Blue:51) - **Memory addresses:** Debugging (0x7FFFFFFF) - **MAC addresses:** Network device identification (00:1A:2B:3C:4D:5E) - **Binary file analysis:** Inspecting file contents byte by byte - **Network protocol debugging:** Analyzing packet data - **Character encoding investigation:** Checking byte representations ### Hex vs Base64 - **Hex:** 16 characters, 2 chars per byte (100% size increase). More readable for hashes and addresses. - **Base64:** 64 characters, 4 chars per 3 bytes (33% size increase). More compact for data transfer. ### FAQ **What is hexadecimal?** Hexadecimal is a base-16 numbering system using symbols 0-9 and A-F. Each hex digit represents 4 bits, and 2 hex digits represent 1 byte (values 0-255). It is the standard format for displaying binary data, memory addresses, color codes and cryptographic hashes. **When should I use hex encoding?** For displaying cryptographic hashes (SHA-256, MD5), CSS color codes (#FF5733), debugging binary files, MAC addresses, IPv6 addresses, network packet analysis, and any situation where you need a human-readable representation of binary data. **What is the difference between hex and Base64?** Hex uses 16 characters and doubles the data size (2 hex chars per byte). Base64 uses 64 characters and increases size by 33% (4 chars per 3 bytes). Use hex when readability matters (hashes, addresses). Use Base64 when compactness matters (data transfer). --- ## Regex Tester URL: https://scrambl.it/tools/regex-tester ### What It Does Test regular expression patterns against text with real-time match highlighting, capture group extraction, all JavaScript regex flags and built-in pattern presets for common validation tasks. ### Key Features - Real-time pattern testing with instant results - Match highlighting with color-coded display - Capture group extraction and numbered display - All JavaScript regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll), u (unicode), y (sticky) - Built-in presets: email, URL, phone, IPv4, date (YYYY-MM-DD), hex color, username, hashtag - Match count and position tracking - Pattern save/load (local storage, up to 10 patterns) - Multi-line text support - Quick reference guide built in ### Built-in Pattern Presets - **Email:** Standard email validation pattern - **URL:** HTTP/HTTPS URL matching - **Phone:** Phone number formats - **IPv4:** IP address validation (0-255 octets) - **Date:** YYYY-MM-DD format - **Hex Color:** #RGB and #RRGGBB formats - **Username:** Alphanumeric with underscore/hyphen - **Hashtag:** Social media hashtag format ### When to Use - Testing regex patterns before deploying in code - Validating email, URL, phone number, IP address formats - Extracting data from log files - Building find-and-replace patterns - Parsing structured text data - Validating form inputs - Learning regex interactively with instant feedback - Debugging complex patterns with capture group visualization ### Regex Quick Reference **Basics:** . (any char), * (0+), + (1+), ? (0 or 1), ^ (start), $ (end), | (or) **Character classes:** [abc] (a, b or c), [^abc] (not a, b, c), [a-z] (range), \d (digit), \w (word char), \s (whitespace) **Quantifiers:** {n} (exactly n), {n,} (n or more), {n,m} (n to m), *? +? (lazy versions) **Groups:** (pattern) (capturing), (?:pattern) (non-capturing), (?pattern) (named group) **Assertions:** (?=...) (lookahead), (?!...) (negative lookahead), (?<=...) (lookbehind), (?bold", the greedy .+ matches "b>bold