My bookmarks bar has gone through a lot of cleanups. Most tools I save once and never open again. The ones below survived because I keep reaching for them during normal work: sketching a system before I build it, poking at an API, figuring out why a regex matches the wrong line, or checking what a new npm package will cost me.
Everything here runs in the browser. A few are Toolghar tools, because I built them to scratch my own itch, and I'll be upfront about where they are the right pick and where something else is better.
#Quick comparison
| # | Tool | What I use it for | Cost | Runs locally in the browser? |
|---|---|---|---|---|
| 1 | Excalidraw | Architecture sketches, flow diagrams | Free (paid Plus plan exists) | Yes, drawings stay local unless you share |
| 2 | Postman | Testing and saving API requests | Free for one user | Desktop app or web |
| 3 | RegExr | Writing and debugging regex | Free | Yes |
| 4 | JSON Crack | Visualizing large JSON | Free tier | Yes for basic use |
| 5 | DevDocs | Offline docs search | Free, open source | Yes, with offline cache |
| 6 | Bundlephobia | Checking npm package size | Free | No, server-side analysis |
| 7 | Squoosh | Compressing individual images | Free, open source | Yes |
| 8 | Toolghar Hash Generator | MD5/SHA hashes of text | Free, no sign-in | Yes |
| 9 | Toolghar CSV/JSON/Excel converters | Moving data between formats | Free, no sign-in | Yes |
| 10 | Toolghar Password Generator | Random passwords and secrets | Free, no sign-in | Yes |
#1. Excalidraw
Excalidraw is a whiteboard with a hand-drawn look. I use it at the start of almost every feature: boxes for services, arrows for requests, a few notes about what can fail. The sketchy style matters more than it sounds. Nobody argues about pixel alignment when the diagram looks like it was drawn on a napkin, so conversations stay on the design.
The limitation: it's not a diagramming tool for formal documentation. If you need something that stays tidy as it grows to 60 boxes, or you want diagrams stored as code in the repo, look at Mermaid or a proper diagram tool instead. For thinking out loud, Excalidraw is the one I open.
#2. Postman
If you build or consume APIs, you've probably used Postman already. It lets you build requests, save them into collections, set environment variables (dev, staging, prod) and write small test scripts that check status codes or response fields. Having a saved collection for a project means I'm not rebuilding the same auth header in curl every morning.
One thing changed this year that you should know about. In March 2026 Postman restructured its plans, and the Free plan is now meant for a single user. Shared team workspaces moved to paid plans, according to Postman's own community announcement. For solo work it's still fine. For a small team that used to share collections for free, it's worth checking the current pricing page before you rely on it.
It's also heavy. For a single GET request, curl or a REST client extension in your editor is faster.
#3. RegExr
Regular expressions are one of those things I can write but not always read a week later. RegExr helps with both. You paste sample text, type a pattern, and it highlights matches live. Hover over any part of the pattern and it explains what that token does.
My habit: I paste real log lines or real user input into the text box, not tidy examples. That's where regex bugs show up.
The catch is that RegExr focuses on JavaScript and PCRE flavors. If you're writing a pattern for Python, Go or a database engine, small differences in syntax can bite you, so test it in the target language too. Regex101 is a good second opinion when you need a different flavor.
#4. JSON Crack
JSON Crack turns a JSON document into an interactive graph. It's the tool I open when a third-party API sends back a deeply nested response and I need to understand its shape before writing types for it. Seeing the tree laid out makes it obvious which objects repeat and where the arrays are.
It's great for exploring, less great for editing. Very large files get slow in the graph view, and for everyday formatting I still use my editor.
#5. DevDocs
DevDocs puts documentation for a long list of languages and frameworks (MDN, React, Node, Python, Docker and many more) behind one fast search box. You pick which docs you want, and it can cache them for offline use. I use it mostly for MDN lookups, because typing a method name into DevDocs is quicker than a web search that lands me on a forum thread from 2014.
The limitation is freshness and depth. DevDocs mirrors official reference docs, so it won't have guides, tutorials or the newest framework features the day they ship. When I need the "why" and not only the "what", I go to the official site.
#6. Bundlephobia
Before I add a dependency to a frontend project, I check it on Bundlephobia. It shows the minified and gzipped size of an npm package, how long it would take to download on a slow connection, and sometimes suggests lighter alternatives. It has talked me out of pulling in a full date library when I only needed to format one timestamp.
Two caveats. The numbers are for the whole package, so tree-shaking in your own build may make the real cost smaller. And the service can be slow or fail on packages with unusual build setups. When that happens, bundlejs is a decent fallback that bundles the package in your browser.
#7. Squoosh
Squoosh is an image compressor from the Chrome team that runs entirely in the browser. The part I like is the split-view slider: you drag it across the image and compare the original with the compressed version at the same time, while it shows the file size. It supports modern formats like WebP and AVIF, and you can tweak quality settings per codec.
The downside is that it works on one image at a time. If I have a folder of screenshots to shrink for a blog post, I use Toolghar's image compressor instead, and I'll use the image resizer first when the source images are far bigger than they'll ever be displayed. Squoosh wins when I care about getting one hero image exactly right.
#8. Toolghar Hash Generator
This is one of mine. The hash generator takes any text and shows MD5, SHA-1, SHA-256 and SHA-512 hashes at once, updating as you type. It runs in your browser, so the text isn't sent to a server.
Where I use it: checking that two config values really are identical, generating a quick checksum to compare against a value in a database, or verifying what a hashing function in my code should return for a known input when I'm writing a test.
Know what it isn't. It hashes text, not uploaded files, so for verifying a downloaded ISO you should use sha256sum (Linux/macOS) or Get-FileHash (PowerShell). And MD5 and SHA-1 are there for compatibility with older systems. Don't use either of them, or any fast unsalted hash, for storing passwords. Use bcrypt, scrypt or Argon2 through your framework.
#9. Toolghar CSV, JSON and Excel converters
Data rarely arrives in the format I want. Someone sends a spreadsheet, the frontend wants JSON, and the client wants the results back in Excel. I built three small converters for exactly this:
- CSV to JSON parses a CSV (paste it or upload a file), uses the first row as keys, and gives you JSON to copy or download.
- JSON to Excel takes a JSON array of objects and downloads an .xlsx file with one column per key.
- Excel to JSON goes the other way when someone hands you a spreadsheet, and lets you switch between sheets if the workbook has more than one.
They all run client-side, which matters when the data contains customer details you shouldn't be pasting into random websites.
A couple of honest limits. The CSV converter detects types automatically, so a value like 00123 can come out as the number 123. If you have zip codes or IDs with leading zeros, check the output. JSON to Excel expects a flat array of objects. Nested objects won't be spread into neat columns, so flatten them first if you need that. For anything bigger than a quick one-off conversion, a short script with a proper library is the better option.
#10. Toolghar Password Generator
The password generator creates random passwords with the length and character sets you choose. It uses the browser's crypto.getRandomValues, which is a cryptographically secure source, not Math.random, and nothing is stored or sent anywhere.
I mostly use it for things that aren't really human passwords: a local database password in a .env file, a test account, or a throwaway secret for a staging webhook. It's quicker than opening a terminal to run openssl rand.
If you need to remember and reuse passwords across sites, a password manager is the better tool, since it generates and stores them in one step. And for production secrets, generate them where they'll live (your secrets manager or CI settings) so they never pass through a clipboard at all.
TIP
[!TIP] Two smaller Toolghar tools that sit next to these in my bookmarks: Markdown to HTML for turning README snippets into HTML with a live preview, and the QR code generator for getting a local dev URL onto my phone without typing it. The full list is on the developer tools page.
#How I'd use this list
Don't bookmark all ten today. Pick the two or three that match problems you hit this week. If you're debugging an API, that's Postman and JSON Crack. If you're cleaning up a slow frontend, Bundlephobia and Squoosh. If you shuffle data between teams, the converters. A short bookmarks bar is one you'll actually use.
If there's a small utility you keep searching for and can't find a good version of, you can request a tool.