Frequently asked questions

No. Every tool on hexnook works immediately, with no account, no email, and no usage limits.

No. Formatting, minifying, and validating all happen with JavaScript's own JSON.parse/JSON.stringify, running entirely in your browser tab. Nothing you paste is ever sent to a server.

Yes. Text is encoded via TextEncoder/TextDecoder before Base64 conversion, so multi-byte UTF-8 characters (accents, Korean, emoji, etc.) round-trip correctly — a naive btoa()/atob() call would corrupt them.

Not for security purposes — MD5 is cryptographically broken and shouldn't be used for passwords or integrity checks against a malicious actor. It's included here because it's still common for legacy checksums and cache keys.

JavaScript's native RegExp engine (ECMAScript regex), running in your own browser — the same engine your browser's console or a Node.js script would use.

No — the token is decoded entirely in your browser using base64url and JSON.parse. It's never sent to any server, which matters since a JWT's payload is only base64-encoded, not encrypted, and often contains sensitive claims.

No — conversion between HEX, RGB, and HSL is plain math computed locally, and the color picker is your browser's own native <input type="color"> control. Nothing is sent to a server.

Version 4 (random) — the most commonly used version, generated with crypto.randomUUID(), built directly into your browser.

No. Every password is generated with crypto.getRandomValues() entirely inside your browser tab — never transmitted, logged, or stored anywhere — and disappears the moment you navigate away or reload the page.

The number of seconds (or milliseconds) elapsed since January 1, 1970 00:00:00 UTC — the "epoch" — used throughout logs, APIs, and databases as a compact, timezone-agnostic way to represent a point in time.

Line diff highlights entire lines that were added or removed. Word diff breaks the comparison down to individual words, which is useful for spotting small edits inside an otherwise unchanged line.

Component mode uses encodeURIComponent/decodeURIComponent, which escapes every character with special meaning in a URL — including & = ? / : , — so it's safe for a single query-string value. Full URI mode uses encodeURI/decodeURI, which leaves those structural characters alone since they're expected to appear in a complete URL.

Yes — tables, task lists (- [ ]/- [x]), strikethrough (~~text~~), and fenced code blocks all render correctly, in addition to standard Markdown syntax.

Yes — HTML comments are removed during minification, along with all redundant whitespace between and inside tags, to produce the smallest valid output. Content inside <pre>, <textarea>, <script>, and <style> tags is left untouched so nothing you see or run changes.

Whitespace, comments, and redundant syntax (like unnecessary units on zero values or duplicate semicolons) — the visual result is identical, just far smaller to transfer.

Yes — minify mode mangles (shortens) local variable and function names in addition to removing whitespace and comments, which is standard practice for production JavaScript and produces meaningfully smaller output than whitespace removal alone.

Placeholder text derived from a scrambled passage of Cicero's 1st-century BC Latin text "de Finibus Bonorum et Malorum." It's used in design and typesetting because its Latin-like word shapes don't distract a viewer with readable meaning, letting them focus on layout.

The classic 5-field format: minute, hour, day of month, month, day of week (e.g. 0 9 * * 1-5 means 9:00 AM every weekday). Nicknames like @daily, @hourly, and @weekly are also supported.