Changelog

Toolsy ships roughly weekly. Every entry below is a real change pushed to production. Want to suggest a tool or report a bug? hello@toolsy.website reaches a human.

New tools

Five new tools — JSON ecosystem completion + accessibility

New tools

Batch B: 6 reference + developer tools

  • Unix Timestamp Converter — auto-detects seconds vs ms vs μs vs ns; live current-timestamp display
  • HTTP Status Code Reference — 60+ codes with explanations, use cases, class filtering, search
  • JWT Tester & Decoder — decode + HMAC verify (HS256/384/512) via Web Crypto, secret stays in browser
  • User-Agent Parser — browser/OS/device/engine + bot detection, ua-parser-js client-side
  • IPv4 Converter — dotted decimal ↔ integer ↔ hex ↔ binary ↔ octal ↔ IPv6-mapped ↔ reverse DNS
  • Auto-ban honeypot — bots probing /wp-admin, /.env, /.git, phpMyAdmin, web shells now get 403 + instant IP block
New tools

Batch A: 4 high-traffic developer utilities

New tools

JSON ecosystem: TypeScript + Diff

  • JSON to TypeScript Interface — smart array merging for optional fields (not unions), singularized array names
  • JSON Diff — semantic comparison ignoring key order; three output formats (summary, RFC 6902 Patch, RFC 7396 Merge Patch); 100% client-side
New tools

Six new high-traffic tools

  • Morse code translator (text ↔ morse, with audio playback at the traditional 600 Hz CW tone)
  • Random phone number generator — 8 countries with real number-plan rules
  • Random US ZIP code generator using real USPS prefix ranges
  • Random birthday generator with age range filter and 5 date formats
  • Random food / meal generator (200+ international dishes)
  • Find and replace with regex, case sensitivity, whole-word matching
Design

Visual identity refresh

  • Refined indigo + violet accent system; multi-layer shadows
  • New hero with stats row, animated live indicator, gradient text accent
  • Tool cards with accent-border slide-in on hover, subtle lift
  • Glass-blur sticky navigation
  • Page-load fade-in animations (respects prefers-reduced-motion)
Fix

HTML editor: external images now render in preview

  • Switched preview iframe from doc.write() to srcdoc — null-origin context no longer inherits the parent page's CSP
  • Removed allow-same-origin from the iframe sandbox (better isolation, no functional loss for preview)
  • Auto-injects so links in the preview open in a new tab
  • Auto-injects to satisfy image hosts that check Referer
  • Visible "image failed to load" indicator with the URL in the tooltip when a remote asset is blocked
Feature

Editor keyboard shortcuts

  • Ctrl/Cmd+F to open Find, Ctrl/Cmd+H to open Find & Replace
  • Ctrl/Cmd+G and F3 to find next; Shift+Ctrl/Cmd+G and Shift+F3 for previous
  • Ctrl/Cmd+D duplicates the current line or selection
  • Ctrl/Cmd+L deletes the current line
  • Esc closes the find panel from anywhere on the page
Fix

HTML preview initial width

  • Preview iframe now starts at the correct full Desktop width instead of falling back to the browser default (~300px)
  • CSS default + inline width attribute both set, so it works whether JS has run or not
Feature

Three-button theme switcher

  • Replaced the cycling theme button with explicit Light / Dark / System buttons
  • Active mode is highlighted in the accent color — direct selection instead of click-loop guessing
  • Choice persists in localStorage only
New tools

Four developer tools added

  • TOTP generator (RFC 6238, compatible with Google Authenticator)
  • Fake data generator (30+ field types, output as JSON / CSV / SQL INSERT)
  • Base32 encoder/decoder
  • HTTP headers inspector with security-header audit
Fix

Converter pages now render with the site layout

  • Programmatic converter pages (JSON ↔ YAML, hex ↔ decimal, etc.) were missing the layout wrapper — no nav, no footer, no theme button, default browser typography. Now wrapped correctly.
  • Wraps in partials/layout with pre-rendered SEO and ad blocks
Security

AES key derivation hardened

  • Replaced unsalted SHA-256/MD5 key stretching with PBKDF2
  • 100,000 iterations, per-encryption random salt stored in the output bundle
  • Brings the tool in line with modern industry standards
Fix

Vercel serverless filesystem compatibility

  • Analytics middleware now auto-detects Vercel and writes to /tmp instead of ./data
  • All filesystem operations wrapped in try/catch — failures cannot crash a request
  • Self-disables after 5 consecutive write errors, returns to normal once permissions clear

Looking for what's coming next? See the roadmap.