About R3X Tools
20 developer tools across 7 categories. No account, no ads, no tracking.
What it is
A toolbox for the things that interrupt real work: a payload that will not parse, a token whose claims you need to read, a webhook that is not arriving, a cron expression you are not certain about. Each tool does one job, states what it does with your input, and gets out of the way.
There is no sign-up because there is nothing to sign up for, and no analytics because the site does not need to know who you are to format JSON.
What runs where, and why it matters
14 of the 20 tools run entirely in your browser. They have no endpoint to send anything to — you can watch the network panel while you use them. That is the honest answer for anything you would paste a secret into: a JWT, a .env file, a production payload.
The other 6 cannot work that way, and say so on their own pages. A browser is not allowed to read a cross-origin API response, cannot receive an inbound webhook, and cannot be a URL another machine calls. Those tools run on a server, and the pages that use them say “runs on R3X infrastructure” rather than claiming a privacy property they do not have.
How it is built
Next.js and React, TypeScript throughout, and no runtime dependencies beyond those. Every editor, parser, diff, tokenizer and generator on this site is written for it rather than pulled from a package, which is why a tool page loads in a little over 100 kB of JavaScript and why nothing here breaks when an unrelated dependency publishes a new major.
Every server-side tool goes through one outbound HTTP client with one URL policy: HTTP and HTTPS only, a conservative port list, every resolved address checked against the reserved ranges, the connection pinned to the address that was checked, and every redirect re-checked from scratch. Timeouts, response size ceilings and rate limits are enforced on all of them. The HTTP API reference publishes the exact numbers.
What it will not do
The security tools are defensive. Nothing here scans ports, probes for vulnerabilities, guesses paths or sends more than one ordinary request to a target. The header checker fetches a page once, exactly as a visitor would, and grades what comes back.
Nothing stored on a server outlives its purpose: webhook captures expire after an hour, mock definitions and their logs after a day. There is no archive and no way to extend either. Privacy has the detail.