DEV Community: Ameen Usman

What a JSON converter drafts from the first object

Ameen Usman — Sun, 01 Nov 2026 05:55:29 +0000

I had an API payload in one window and a blank TypeScript file in the other. The payload was a list of people. Each object carried an id, a name, a role, and a meta object with an active flag. I was ready to type the interface by hand and assume the second person would have the same keys as the first. That assumption is the useful part to check. The JSON converter at https://kepttools.com/json-converter reads the paste in the browser and drafts the interface from the first object only. The same text can also become a Laravel array, a PHP DTO, or CSV. The blocks below are that sample, run through the converter, not a tidied rewrite of it.

The Sample button uses this array:

[
  {"id": 1, "name": "Ada", "role": "engineer", "meta": {"active": true}},
  {"id": 2, "name": "Linus", "role": "founder", "meta": {"active": false}}
]

Laravel keeps both people, and it keeps meta nested as a PHP array:

[
    [
        'id' => 1,
        'name' => 'Ada',
        'role' => 'engineer',
        'meta' => [
            'active' => true,
        ],
    ],
    [
        'id' => 2,
        'name' => 'Linus',
        'role' => 'founder',
        'meta' => [
            'active' => false,
        ],
    ],
]

TypeScript stops at Ada. Linus never adds a field. Meta becomes its own interface because the value is an object:

export interface Root {
  id: number;
  name: string;
  role: string;
  meta: Meta;
}

export interface Meta {
  active: boolean;
}

The PHP DTO is one class, always named DataTransferObject, and it is also Ada only. Meta is array, not a nested class:

<?php

declare(strict_types=1);

class DataTransferObject
{
    public int $id;
    public string $name;
    public string $role;
    public array $meta;

    public function __construct(array $data = [])
    {
        $this->id = $data['id'] ?? null;
        $this->name = $data['name'] ?? null;
        $this->role = $data['role'] ?? null;
        $this->meta = $data['meta'] ?? null;
    }
}

CSV keeps the top-level keys and puts meta in a single cell. The nested object is JSON text, with quotes doubled:

id,name,role,meta
1,Ada,engineer,"{""active"":true}"
2,Linus,founder,"{""active"":false}"

A shorter array makes the same cut obvious. [{"id":1,"name":"Ada"},{"id":2,"email":"linus@example.com"}] still becomes two Laravel rows, so email survives there. The interface and the PHP class keep id and name only. CSV's header is id,name,email: Ada's row ends on an empty cell, and the next row leaves name empty.

Two limits sit on top of that sample. If the root is an array, TypeScript and the PHP DTO never look past the first object, so a key that exists only later is missing from the draft. CSV does look at later rows when it builds the header, but a nested object still occupies one cell, not a new column per inner key. Invalid JSON clears the output and shows the parse error. { leaves the box empty with Expected property name or '}' in JSON at position 1 (line 1 column 2). An empty array is valid JSON and still not CSV: the output is cleared and the message is CSV conversion expects an array of objects.

One tip before you paste the draft into a project: open the second object and look for a key the first object does not have. Root will not list it. Add that field yourself, or convert a single object that already contains every key you mean to keep. The PHP constructor also assigns null when a key is absent, including into public int $id, so treat the class as a draft and rename DataTransferObject.

If the paste is hard to read, indent it first at https://kepttools.com/json-formatter and then convert. A trailing comma is enough to wipe the output.

Full guide with the FAQ and the converter: https://kepttools.com/guides/json-to-typescript-php-dto-laravel

What cron expression runs every 5 minutes?

Ameen Usman — Sat, 31 Oct 2026 05:18:12 +0000

A cleanup job was supposed to run every five minutes. The crontab was saved at 10:03. The log showed 10:05, then 10:10. That is not a late start. The expression is tied to the clock, at minutes 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, and 55. Saving the file does not start a countdown. Classic cron also does not hold the next start while the previous process is still running, so a six-minute command overlaps itself. What follows is the five-field form used by Vixie cron and cronie, not a systemd timer and not Quartz.

Five fields, then the command

A standard line is five time fields and then the command. None of them is a seconds field.

Field	Range	A star means
Minute	0–59	Every minute
Hour	0–23	Every hour
Day of month	1–31	Every day of the month
Month	1–12	Every month
Day of week	0–7	Every day of the week

On Vixie cron and on cronie, Sunday is both 0 and 7. Monday is 1 and Friday is 5, so 1-5 is Monday through Friday. Some other schedulers accept only 0 for Sunday. Read crontab(5) on the host before using 7. Prefer numbers to names such as MON or JAN.

The fields use the daemon’s timezone, so 0 0 * * * is midnight there, not necessarily UTC. Honor CRON_TZ only if that host’s crontab(5) says so.

Every 5, 10, 15, and 30 minutes

Each line below is aligned to the clock, and each one includes minute 0.

*/5 * * * *     # 0, 5, 10, 15, 20, 25, 30, 35, 40, 45, 50, 55
*/10 * * * *    # 0, 10, 20, 30, 40, 50
*/15 * * * *    # 0, 15, 30, 45
*/30 * * * *    # 0 and 30

The edit time is not stored. A line installed at 10:03 still waits for 10:05, then 10:10.

5-59/5 * * * * starts the range at 5, so minute 0 is left out. Use it only when you mean to skip the top of the hour. For a plain every-five-minutes job, keep */5 * * * *.

Drop the step when you want an hour or a day instead.

0 * * * *       # every hour, at minute 0
0 0 * * *       # every day at 00:00
0 9 * * *       # every day at 09:00
0 9 * * 1-5     # Monday through Friday at 09:00

0 * * * * fires 24 times a day, 0 0 * * * once at midnight, and 0 9 * * 1-5 on weekdays at 09:00 because day-of-month stays a star. The either-day rule starts only when both day fields are restricted. A day field that starts with *, including */2, is not restricted. See why cron runs on the wrong day.

How a step is counted

A step is a range plus /n. In the minute field, * means 0-59, so */5 is 0, then every fifth minute through 55. Twelve runs an hour.

In the hour field, 0 */2 * * * is minute 0 of every second hour: 00:00, 02:00, 04:00, and so on through 22:00.

Day of month starts at 1, not 0. On Vixie cron and cronie, * in that field is 1-31, so 0 0 */5 * * is midnight on the 1st, 6th, 11th, 16th, 21st, 26th, and 31st. It is not the dates divisible by 5 (the 5th, 10th, 15th, 20th, 25th, and 30th). If the daemon is not cronie, test that list. A cron expression generator shows the five fields. It does not simulate one daemon’s calendar, and it does not install the job.

Mistakes that move the run

Copy the five fields, not the sentence beside them. Crontab does not read “every five minutes.”

Do not add a seconds field in front. The other fields shift right. Quartz uses six fields, or seven with a year, and seconds come first. Spring uses that six-field form. EventBridge’s six fields are minutes, hours, day-of-month, month, day-of-week, and year, with no seconds field. Quartz and EventBridge both use ? in a day field. A five-field line matches neither shape.

Traditional Vixie cron does not skip a run because the previous process is still going. If the work must not overlap, take a lock in the command, for example with flock, and leave the schedule alone. systemd timers and queue workers can differ. This warning is about classic cron.

Cron’s PATH is often shorter than a login shell. Call the program by its absolute path. A stored “next run” in an API is often a Unix timestamp, not an expression. Read that number on the Unix timestamp converter. Do not paste it into the minute field.

*/5 cannot mean “five minutes from now.” Sleep in a process, or use a queue delay. The daemon still starts the command once, when the minute begins, not again at second 10 or 20.

Try it for one cycle

Point a throwaway line at a file you can delete.

*/5 * * * * date >> /tmp/cron-every-5.log

Wait until two lines are written. The minutes should be five apart, and each minute should be divisible by 5. Then delete the line. Some hosts log the start with journalctl -u cron. Others still use syslog. Use the log that machine keeps.

Full guide with the FAQ and a cron generator: https://kepttools.com/guides/cron-every-5-minutes

How to encode a URL and escape HTML in the browser

Ameen Usman — Thu, 29 Oct 2026 05:13:54 +0000

A query string and an HTML page do not escape text the same way.

This string is fine in a sentence:

<Hello World> & "KeptTools"?q=1

Put it in a URL without encoding, and & starts a new parameter. Put it in HTML without escaping, and < starts a tag. Those are two different jobs.

I use a small encoder for both. It runs in the browser, so the string is not uploaded.

https://kepttools.com/url-html-encoder

URL encoding

URL encoding turns characters that have a special meaning in a URL into % sequences.

The tool uses encodeURIComponent, which is the right function for a query value or a path segment. The sample becomes:

%3CHello%20World%3E%20%26%20%22KeptTools%22%3Fq%3D1

< is %3C, a space is %20, & is %26, " is %22, and ? is %3F.

encodeURI is the other common function, and it is not the same. It leaves &, ?, and = alone, because those characters structure a full URL. Use that when you already have a complete address. Use encodeURIComponent when the text is one value you are about to drop into a query string.

Do not run encodeURIComponent on a whole URL. It will also encode https:// and the ?, and the link will break.

HTML escaping

HTML escaping is for text that should be shown, not parsed.

The same sample, on HTML Encode, becomes:

&lt;Hello World&gt; &amp; &quot;KeptTools&quot;?q=1

< becomes <, > becomes >, & becomes &, and " becomes ". A browser then displays the characters instead of treating them as markup. An apostrophe is escaped as '.

This is the step you want before you insert user text into HTML. URL encoding does not do it. %3C is not the same thing as <.

Decoding

Each mode has a reverse.

URL Decode turns the % sequences back into characters. A broken sequence, such as a % that is not followed by two hex digits, does not decode. The page reports that the encoding is invalid.

HTML Decode turns the entities back into <, >, &, and quotes.

What stays on the machine

Paste the text, or load the sample, pick URL Encode, URL Decode, HTML Encode, or HTML Decode, and copy the result. Nothing is sent to a server.

If you are building a link, encode the value. If you are showing the value on a page, escape it for HTML. Do one, then the other, when you need both.

How to decode a JWT in the browser

Ameen Usman — Wed, 28 Oct 2026 04:33:04 +0000

A JWT looks secret. It is not. The header and the payload are only Base64url text. Anyone who has the token can read the claims. The signature is the part that proves the token was issued by someone who holds the key, and that check does not happen by decoding it.

This is the distinction I keep having to make while debugging login. A readable exp or sub is useful. It is not proof the token is valid.

What the three parts are

A JWT is three pieces separated by dots:

header.payload.signature

The header names the algorithm, usually HS256 or RS256. The payload holds the claims: sub, name, role, iat, exp, and whatever else the issuer put there. The signature is the third part. A decoder shows it. It does not check it.

Base64url is not encryption. Changing - and _ back to + and /, padding with =, and running a Base64 decode gives you JSON. No secret is required for that step.

A token you can read by eye

The sample on the KeptTools JWT decoder is shaped like a real token, with a placeholder in the signature slot so you can see the three parts:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IktlcHRUb29scyBVc2VyIiwiaWF0IjoxNzA5ODAwMDAwLCJleHAiOjE3Mzk4MDAwMDAsInJvbGUiOiJkZXZlbG9wZXIifQ.signature-placeholder

The header decodes to:

{
"alg": "HS256",
"typ": "JWT"
}

The payload decodes to:

{
"sub": "1234567890",
"name": "KeptTools User",
"iat": 1709800000,
"exp": 1739800000,
"role": "developer"
}

iat and exp are Unix timestamps in seconds. 1709800000 is the issued-at time. 1739800000 is the expiry. Compare exp with the current time before you treat the session as active. An expired token still decodes.

What decoding does not tell you

A decoded payload does not mean:

the signature matches the header and payload
the token came from your server
the token has not been edited
the session is still valid

Signature checks belong on the server that holds the HMAC secret or the public key. For HS256, that secret must never be in frontend code. For RS256, the browser can hold a public key, but verification is still a separate step from reading the JSON.

If you only need to see why a request is failing, decoding is enough. If you are deciding whether to trust the token, it is not.

Do it without uploading the token

Paste the token into a page that decodes it locally, or do the same two Base64url decodes in your own console. Either way, a production access token or a refresh token should not be sent to a server you do not control.

I use the decoder at https://kepttools.com/jwt-decoder for this. The token stays in the tab. The page shows the header, the payload, and the signature string. It does not verify the signature, and it does not load analytics on that page.

Paste a token, or load the sample. Read alg in the header and exp in the payload. Then verify the signature in the app that issued the token.

Turn PDF pages into JPG images in your browser

Ameen Usman — Mon, 26 Oct 2026 10:26:08 +0000

A PDF page is often the wrong format for a slide, a chat message, or a blog image. Uploading the whole document just to export one page is a poor trade.

PDF to JPG does that conversion in the browser. The file stays on your device. Nothing is uploaded.

How to export the pages

Open the PDF.
Choose all pages, or enter a range such as 1-3, 5.
Pick High, Medium, or Low quality.
Convert, preview the pages, then download one JPG or a ZIP of all of them.

A 5-page deck on High comes back as five images. Preview them before you download the ZIP.

The limit shown on the page is 40 pages and 25 MB. A password-protected PDF has to be unlocked first.

What the JPG is

Each page becomes a flat image. Text that you could select in the PDF cannot be selected in the JPG. Use this when you need a picture. Keep the original PDF when you still need selectable text.

Where it runs

The page is drawn in the browser and saved as a JPG from there. I do not receive the file.

Tool: https://kepttools.com/pdf-to-jpg

Merge, split, and compress PDFs in your browser

Ameen Usman — Sun, 25 Oct 2026 07:55:38 +0000

I kept avoiding random PDF websites for contracts, invoices, and reports. Those files should not leave the laptop just to merge two exports or pull out one page.
So I added PDF tools to KeptTools. They run in the browser. Nothing is uploaded.

Merge a few PDFs into one

Open Merge PDF.

Add two or more PDFs.
Put them in the order you want. Remove any you do not need.
Merge and download one PDF. Example: add report-a.pdf and report-b.pdf, put A first, then download kepttools-merged.pdf with every page in that order. You can merge up to 20 files, 25 MB each. Password-protected PDFs have to be unlocked first. ## Pull pages out of a long PDF Open Split PDF.
Choose one PDF.
Enter ranges, or split every page.
Download one PDF, or a ZIP when there is more than one result. Ranges look like 1-3, 5 or 1-3, 7-10. Page numbers start at 1. Example: a 10-page PDF with 1-3, 7-10 comes back as two files in a ZIP. Pages 1–3 in one, pages 7–10 in the other. ## Shrink the file, keep the text Compress PDF recompresses images inside the PDF. Light, Medium, and Strong change image quality. The text stays real text, so you can still select it. A text-only PDF may barely get smaller. That is an honest result, not a broken tool. Use it when the PDF has photos or scans and you need a smaller file for email. ## Turn pages into images, or images into a PDF PDF to JPG exports pages as JPG. Pick all pages or a range, choose quality, preview, then download one image or a ZIP. After this step the page is a picture, so the text is no longer selectable. JPG to PDF does the other direction. Add JPG, PNG, or WebP images, reorder them, then set page size (A4, Letter, or fit), orientation, and margins. Fit inside keeps the photo proportions. Stretch can distort them. ## What stays on your machine The file is read in the browser and the result is downloaded from there. I do not receive the PDF. If you try one, tell me whether you needed merge, split, or compress first.

Unix Timestamp Converter That Runs in Your Browser

Ameen Usman — Sat, 24 Oct 2026 07:48:52 +0000

I still paste Unix timestamps into random converters more often than I want to admit.

created_at: 1729000000

exp: 1735689600

The number is fine. The worry is the same every time: does this page upload what I paste?

What I needed

A tiny converter that:

accepts epoch seconds or milliseconds
shows UTC (ISO) and local time
lets me copy the ISO string
has a Use now button for the current timestamp
does the work in the browser

So I added one to KeptTools.

Try it

👉 Unix Timestamp Converter

Example:


text
1729000000
→ 2024-10-15T13:46:40.000Z

Cron Generator Online: Build Expressions in Your Browser

Ameen Usman — Tue, 20 Oct 2026 15:45:13 +0000

Cron Generator Online: Build Expressions in Your Browser

Cron schedules are simple… until you’re staring at five fields and guessing.

I built a Cron Expression Generator inside KeptTools so you can:

pick a preset (hourly, daily, weekdays 9am, etc.)
edit minute / hour / day / month / weekday
read a plain-English summary
copy the expression into crontab

Example:

Preset: Weekdays 9am
Expression: 0 9 * * 1-5

Browser-only

Processing stays in your browser. Nothing is uploaded.

Try it: https://kepttools.com/cron-generator

Full toolkit (JSON, JWT, regex, and more): https://kepttools.com

If you use cron a lot, what preset do you want added next?

I built KeptTools so your JWT, SQL, and Base64 never leave the browser

Ameen Usman — Mon, 19 Oct 2026 15:50:32 +0000

I built KeptTools so your JWT, SQL, and Base64 never leave the browser

Most “free online tools” are convenient until you paste something you shouldn’t.

A JWT from staging.

A SQL dump with real emails.

A Base64 string that still holds a secret.

If that page uploads your paste, you’ve already shared more than you meant to.

The problem

I kept needing small utilities:

format / validate JSON
format SQL
decode a JWT
encode / decode Base64
generate hashes
tweak images

…but I didn’t want to trust random sites with the paste.

So I built KeptTools — a set of browser-only developer tools.

How it works

Processing runs in your browser.

Nothing you paste is uploaded for processing.

On the more sensitive pages (JWT, Base64, hash, password generator):

no analytics
no ads
no third-party scripts

Tip: open DevTools → Network while you use those pages. You should not see a request carrying your paste.

What’s included

KeptTools currently covers everyday work like:

JSON formatter / converter
SQL formatter
JWT decoder
Base64 encode / decode
Hash generator (MD5, SHA-1, SHA-256, SHA-512)
URL & HTML encode / decode
Regex tester
Image convert / compress / crop / background tools
and more

All free to use: https://kepttools.com

Why I’m sharing this

I’m not claiming this replaces your local CLI or IDE.

I’m claiming something simpler:

If a tool can run in the browser, it shouldn’t need your paste on a server.

If you try it, I’d love blunt feedback:

Is the privacy angle clear on first visit?
Which tool would you use weekly?
What’s missing?

Thanks for reading — and if you try it, open Network and verify it yourself.

How to prove an online JWT tool isn’t stealing your token

Ameen Usman — Sun, 18 Oct 2026 15:28:56 +0000

Most free JWT decoders ask you to paste a token.

That’s a trust problem. Tokens can include emails, roles, and session data. If the page uploads it, you just gave secrets to someone else’s server.

Here’s the fastest way to check any tool:

Use the Network tab

Open DevTools (F12)
Open Network
Paste a sample token
Watch for requests

If decoding fires a request with your token, leave.

A privacy claim is marketing. An empty Network tab is evidence.

Try a local decoder

I built a browser-only JWT decoder here:

https://kepttools.com/jwt-decoder

No account. Nothing uploaded. Open Network while you decode and confirm it yourself.

If you try it, tell me bluntly: is the privacy story clear in 5 seconds?

That API Timestamp Looks Like Nonsense — Here’s How I Read It in the Browser

Ameen Usman — Fri, 16 Oct 2026 06:20:24 +0000

If you work with APIs long enough, you eventually get a field like this:

1729000000

Is that seconds? Milliseconds? Yesterday? Next week?

I got tired of guessing — and tired of pasting values into random websites.

So I added a Unix timestamp converter to KeptTools. It runs in the browser. Nothing is uploaded.

👉 https://kepttools.com/timestamp

What it does

Paste a Unix timestamp
See UTC and local time
Copy the ISO value
Or tap Use now for the current epoch

Example:

Input: 1729000000
UTC: 2024-10-15T13:46:40.000Z

Useful when you’re reading created_at, writing a test, or checking an expiry field.

Why browser-only matters here

Timestamps themselves aren’t always sensitive.

But the habit is: once you start pasting API payloads into third-party sites, it’s easy to paste a token next.

I want the everyday tools on the same page as the privacy promise: work happens on your device.

Other tools in the suite

If timestamps are only one part of your day:

Full set: https://kepttools.com

Quick question

When an API returns epoch time, do you usually:

convert it in code,
use a browser tool, or
guess from the length?

Tell me in the comments — I’m iterating based on real workflows.

I Got Tired of “Free Tools” That Upload My Files — So I Built Browser-Only Ones

Ameen Usman — Thu, 15 Oct 2026 11:57:59 +0000

Most “free online tools” ask you to paste text or upload a photo.

What they don’t always make clear: that content often leaves your device.

For JSON with client data, a JWT, a draft you’re not ready to publish, or a passport-style photo — that’s a bad trade.

So I built KeptTools: a small set of developer and image tools that run in the browser. No account. No “upload to process.”

👉 https://kepttools.com

What “browser-only” means here

When you open a tool page:

The work happens on the page (JavaScript in your browser)
You can format, convert, crop, or decode without creating an account
Closing the tab ends the session — nothing is stored as “your file” on our servers for processing

A few tools download a small model the first time (for example, portrait background replacement). That download is the model, not your photo.

What’s live

Developer tools

JSON formatter / validator
JSON converter (CSV, Laravel, TypeScript, PHP, and more)
SQL formatter
JWT decoder
Base64, hash, URL/HTML encode
Regex tester, cron generator, UUID/slug

Image tools

PNG/JPG → WebP
Compress
Crop
Image → SVG
Change background (white / blue / custom / transparent)

Text utilities

Word counter
Case converter (camelCase, snake_case, kebab-case, …)
And more on the site

Why I care about this

I use these utilities every week. I don’t want a random site keeping a copy of:

a token
a production-ish JSON blob
an ID photo

Privacy shouldn’t be a premium feature for basic tools.

Stack (short)

Laravel + Vite + Tailwind + Alpine. Tools are client-side where it matters.

What I’d love feedback on

Is “browser-only / no upload” a strong enough reason to switch tools?
Which tool would you open first from the homepage?
What’s missing that would make you bounce?

If you try something and it feels unclear, tell me — I’m iterating from real use.

Site: https://kepttools.com