The utilities you keep pasting into a random website
The Developer Utilities API returns 20+ deterministic developer and AI-agent tools as clean JSON.
21 active endpoints, on 1 and 2 credit tiers.
- POST/dev-utils/v1/hash
- POST/dev-utils/v1/uuid
- POST/dev-utils/v1/encode
- POST/dev-utils/v1/jwt_decode
- POST/dev-utils/v1/password
- POST/dev-utils/v1/cron
- POST/dev-utils/v1/slugify
- +14 more
What Developer Utilities endpoints does ReefAPI ship?
21 live read endpoints. Read-only data API: no writes, no account actions, no dashboard access on the target site.
Developer Utilities API
3 of 21 endpoints, ready to run
A digest in hex, base64 and base64url at once, with the bit length and the input size — and HMAC when you pass a key.
{ "ok": true, "meta": { "api": "dev-utils", "endpoint": "hash", "mode": "live", "latency_ms": 41.9, "record_count": 1, "cache_hit": false }, "data": { "algo": "sha256", "hex": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9", "base64": "uU0nuZNNPgilLlLX2n2r+sSE7+N6U4DukIj3rOLvzek=", "base64url": "uU0nuZNNPgilLlLX2n2r-sSE7-N6U4DukIj3rOLvzek", "length_bits": 256, "hmac": false, "input_bytes": 11 } }
How the Developer Utilities API works
Developer Utilities is a normal ReefAPI surface — the same four rules that hold for every other engine on the key.
No OAuth app, no request signing, no per-site account. One key covers all 184 engines.
Every route is a POST with a JSON body. Parameters are validated against the published schema before anything is charged.
Credits, not seats. Failed and blocked calls are never charged, and cache hits cost nothing.
One envelope everywhere. meta carries latency_ms, record_count and the endpoint that answered.
Taking the paste-into-a-random-site step out of the loop
The reason these tools matter is not that they are hard. It is that the convenient versions are websites, and the things people paste into them are session tokens and production secrets.
{"token": "…"}Decodes header and payload and interprets the time claims. The response carries an explicit warning that the signature is unverified until you pass the key.
{"expression": "0 9 * * 1-5", "tz": "Europe/Istanbul"}Returns the English description and the next real run timestamps in that zone — which is how you catch the schedule that fires an hour off after a DST change.
Twenty-one tools on one endpoint with one key, inside the same audit trail as the rest of your calls, instead of a browser tab whose logging policy you have never read.
curl -X POST https://api.reefapi.com/dev-utils/v1/hash \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"input":"hello world","algo":"sha256"}'{
"ok": true,
"data": { … },
"meta": {
"api": "dev-utils",
"endpoint": "hash",
"mode": "live",
"latency_ms": …,
"record_count": …
},
"error": null
}Every action and the vocabulary it accepts
These are local computations, not fetches — a measured hash call returned in 2.2 ms and nothing leaves for a third-party site. What people actually need before writing a call is the exact list of values each action recognizes, so here it is.
| Action | Accepted values | Worth knowing |
|---|---|---|
| hash | md5 · sha1 · sha224 · sha256 (default) · sha384 · sha512 · sha3-256 · sha3-512 · blake2b · blake2s · crc32 · adler32 | hmac_key switches to a keyed HMAC digest; not valid for crc32/adler32 |
| uuid | v4 · v7 · v1 · v3 · v5 · ulid · nanoid | up to 100 per call; v3/v5 are deterministic and always return exactly 1 |
| encode | base64 · base64url · hex · url · url-component · url-form · html · unicode-escape · json-string | direction is encode or decode; url-component matches JS encodeURIComponent, url-form uses + for spaces |
| format | JSON · YAML · XML · SQL | pretty-print, minify or validate — string level, not files |
| convert | JSON · YAML · CSV · XML | string level, 512 KB ceiling |
| case_convert | camel · pascal · snake · kebab · constant · dot · title · sentence · upper · lower | reports the input casing it detected as well as converting |
| base_convert | any base 2–36 | 0x, 0b and 0o prefixes are detected, so from_base is optional |
| color | hex · rgb() · hsl() · CSS3 color name | returns every other format plus luminance and the nearest named color |
| qr | SVG · base64-PNG data URI · terminal ASCII | all textual output — nothing binary to handle |
| text_analyze | 97 languages detected | readability scores and profanity flags, algorithmic, no model involved |
| mock_data | 70+ Faker locales | preset bundles or a field-by-field schema |
| batch | up to 100 mixed calls | any combination of the actions above in one request |
Parameter names differ per action and most carry aliases, so hash accepts input, text, value or data for the same thing. When a name is wrong the response is an explicit MISSING_PARAM naming the parameter it wanted — passing user_agent to the user_agent action returns 'missing: input', because the payload parameter there is input.
What these compute, and the one place the response argues with you
Measured across the tools. The JWT row is the deliberate design decision.
Decoding a token without a key returns the header and payload alongside trust set to unverified, signature_checked false, and a warning saying in as many words not to trust these claims until the signature is verified with the issuer's key. Every convenient decoder on the web presents the same payload as a plain result, and treating a decoded payload as an authenticated one is a real and common vulnerability. Pass a key and it actually verifies.
Alongside the plain-English reading you get the actual next run instants in the timezone you name. A description tells you what you already thought it said; the timestamps are what reveal the off-by-one on day-of-week or the hour that moves under daylight saving.
A digest returns hex, base64 and base64url in the same response with the bit length and the input byte count. That removes the second conversion step that is itself a common source of mistakes, particularly between base64 and its URL-safe variant.
These run locally on our side and return in around a tenth of a second. Nothing is fetched, nothing is looked up, and the input is not sent anywhere else — which is the actual reason to use an API for this rather than a web page.
Hashing, UUIDs in several versions, encodings, JWT, passwords, cron, slugify, regex testing, formatting, unit and data conversion, QR codes, colour conversion and mock data generation. The point is not any single one; it is not having eleven dependencies and four browser tabs for the small stuff.
What people build with Developer Utilities
The jobs this data is most often used for.
endpoints
credits per call
AI agents call these deterministic tools (hash, uuid, jwt_decode, cron) instead of guessing the result.
Developer tools use encode, convert and format to normalize data inside a workflow.
Automation pipelines use slugify, regex_test and password to handle common string operations reliably.
What Developer Utilities data costs
The cheapest call here is 1 credit, so $15/mo (Pro) buys 10,000 of them — $1.50 per 1,000 credits. Credits roll over and never expire, and failed or blocked calls are not charged.
Full pricing →- 1,000 free credits on signup, no card
- One key, all 184 APIs, one credit pool
- Failed and blocked calls are never charged
- Credits roll over and never expire
Call it in two lines
Sign up, get 1,000 credits and one key that works on every engine. Then this is the whole protocol.
curl -X POST https://api.reefapi.com/dev-utils/v1/hash \
-H "x-api-key: $REEF_KEY" \
-H "content-type: application/json" \
-d '{"input":"hello world","algo":"sha256"}'import requests
r = requests.post(
"https://api.reefapi.com/dev-utils/v1/hash",
headers={"x-api-key": REEF_KEY},
json={
"input": "hello world",
"algo": "sha256"
},
)
print(r.json()["data"])Have a question? We got answers.
The questions people actually ask before wiring up Developer Utilities.
Get a free key →Can jwt_decode read a token without the signing key?▾
Yes, that is the point — header and payload are base64url, not encrypted. A measured decode of the standard HS256 sample returned header {alg: HS256, typ: JWT}, the payload, and claims with iat expanded to both unix 1516239022 and ISO-8601 2018-01-18T01:30:22+00:00. Note what signature_valid is in that case: null, not false. null means the signature was never checked; false would mean it was checked and failed. The response also carries trust: 'unverified' and an explicit warning string so an unverified decode cannot be mistaken for an authenticated one in a log.
Does this API sign or issue JWTs?▾
No. jwt_decode is decode-and-optionally-verify only. Pass verify_key with the HMAC secret for HS* or a PEM public key for RS*/ES*/PS* and the algorithm is taken from the token header against a whitelist — alg=none always fails verification rather than trivially passing, which is the classic JWT vulnerability. There is no signing action, deliberately: a signing key should never travel to somebody else's API.
What is the difference between UUID v4, v7 and ULID here?▾
v4 is pure random and sorts arbitrarily, which fragments a database index. v7 and ULID both embed a millisecond timestamp so ids generated close together sort close together; the response flags this as time_ordered: true. A measured batch of three v7 ids came back as 01a04005-30ca-74ca-…, 01a04005-30ca-72fa-… and 01a04005-30ca-72da-… — the shared leading segment is the timestamp. v1 is also timestamped but uses a random multicast node id, so the host MAC address never leaks into your ids. v3 and v5 are deterministic: same namespace plus name always yields the same UUID, so count is fixed at 1.
What does slugify do with Turkish, Chinese or Cyrillic text?▾
It transliterates to ASCII rather than dropping the characters. A measured call on 'Ürün Değerlendirmesi 2026 — 東京' returned slug 'urun-degerlendirmesi-2026-dongjing', and the response also exposes the intermediate transliterated form 'Urun Degerlendirmesi 2026 - DongJing' so you can see what happened. Turkish diacritics fold to their base letters, the em dash becomes a hyphen, and CJK is romanized. If a slug looks wrong, read transliterated first — the problem is almost always in that step, not the slug step.
Are cron next-run times timezone-correct?▾
Yes, and the offsets are in the output rather than implied. A measured call on '0 9 * * 1-5' with timezone Europe/Istanbul returned the description 'At 09:00, Monday through Friday', a fields breakdown of each of the five positions, and next_runs as fully-offset timestamps: 2026-08-27T09:00:00+03:00, 2026-08-28T09:00:00+03:00, then 2026-08-31 — correctly skipping the weekend. Any IANA zone name works, and the explanation is available in 15 locales.
Why does a crc32 hash return different fields than sha256?▾
Because a checksum and a cryptographic digest are different objects. A measured crc32 of 'hello world' returned hex '0d4a1185', decimal 222957957, base64 'DUoRhQ==', hmac false and input_bytes 11 — decimal is there because CRC values are conventionally compared as integers. The SHA and BLAKE families instead return length_bits and no decimal. Read the algo field before you index into the response, and never treat crc32 or adler32 as security primitives; they detect accidental corruption, not tampering.
How do I convert a number between bases without knowing the input base?▾
Pass the prefix. A measured base_convert of '0xFF' to base 2 returned output '11111111' and reported from_base 16, which it detected from the 0x — 0b and 0o work the same way. The response is not just the requested base either: it returns decimal '255', binary, octal and hex together plus bits: 8. Values are arbitrary precision, so a 300-digit integer converts without overflow, and decimal comes back as a string for that reason.
Can I tell a crawler apart from a real browser with user_agent?▾
Yes — the parse runs against the uap-core database and sets is_bot. A measured parse of Googlebot's own string returned browser {family: 'Googlebot', version: '2.1'}, device {family: 'Spider', brand: 'Spider', model: 'Desktop'}, os.family 'Other' with a null version, and is_bot true. The 'Other' os family is normal for crawlers rather than a parse failure — a bot string usually declares no operating system, so treat null version fields as absent data, not an error.
What is the Developer Utilities API?▾
Developer Utilities API is a ReefAPI endpoint group for developer utilities It returns live JSON through POST requests under /dev-utils/v1.
Is the Developer Utilities API free to try?▾
Yes. ReefAPI starts with 1,000 free credits, no card required. Developer Utilities calls use the same shared credit balance as every other ReefAPI engine.
Do I need a Developer Utilities login or account?▾
No login to Developer Utilities is needed for the API response. You call ReefAPI with your x-api-key header, and the playground can run live examples before you create a production key.
How fresh is the Developer Utilities data?▾
The page example is captured from a live hash call, and production requests fetch live data through ReefAPI rather than a static sample.
How many credits does the Developer Utilities API use?▾
Developer Utilities actions currently cost 1-2 credits per successful call. Failed or blocked calls are free, and all APIs draw from one credit pool.
Can I call Developer Utilities from an AI assistant or MCP client?▾
Yes. Connect ReefAPI once through MCP and your assistant can call dev-utils actions with the same key, credit pool and JSON envelope used by normal REST requests.
18 Developer Tools APIs on the same key
One key, one credit pool, one response envelope. If you are pulling Developer Utilities, you are one call away from the rest of the category — no second contract, no second integration.
Need something this API does not do?
Name the endpoint, the field, or a source we do not carry yet. We ship new APIs every week and you would be first to get the key. Real people read every message and reply the same day.
Try it on your own data before you pay anything
The call above is the real endpoint, not a recording. A free key gives you 1,000 credits, the other 183 APIs, and the same envelope everywhere.
Endpoints, parameters and credit costs on this page are read from the live catalog and cannot drift from what the API accepts. Field notes were captured on 2026-08-30.