Hunt IPs, API keys, emails, and URLs across thousands of logs or code files — extract matches or replace in place. SREs scrub 5,000 logs before sharing — local JS RegExp, 2 free batches a day.
Runs on JSZip
Content reviewed October 2026 · About Toolzum
Convert TTF/OTF to WOFF2 subset to only your used characters and cut 50–200 KB fonts to 2–15 KB. Performance engineers fix the render-blocking font in one batch — local opentype.js, 2 free batches a day.
Decode QR codes from uploaded images. Scan any QR code image and extract the embedded text or URL. Point it at screenshots, photos, or documents — decoded URLs and text copy out instantly. Runs locally, free, no signup.
Inspect JSON API payloads for structure, size breakdown, and key depth — spot sensitive fields before sharing logs before production incidents.
Stamp text or logo watermarks across dozens of photos with 5 positions and 10–100% opacity control. Photographers protect 200 wedding proofs before sharing — always exports PNG (<name>-watermarked.png) — local Canvas work, 2 free batches a day.
Turn a CSV of URLs or text into styled QR PNGs in one batch — event badges, inventory labels, menus. Free tier generates 5 QR a day; Pro runs up to 100 per batch — local qrcode work.
Extract to harvest matches into one findings file (all leaked keys, all error lines); replace to rewrite files in place (redact secrets, update domains). Preview matches first — a 5,000-file replace is instant and permanent.
Start with (?i)(api[_-]?key|secret|token)\s*[:=]\s*['"]?\S+ for keys and \b[\w.-]+@[\w.-]+\.\w+ for emails. Run extract-only first, eyeball 20 hits for false positives, then tighten before any replace pass.
Any text: .txt, .md, .csv, .log, .json, .yaml, .js, .py, .sql, .html. Binaries and archives skip automatically — never run replace across a folder containing .git internals or production .env files you haven't backed up.
No — matching runs locally in your browser with the JS RegExp engine; sensitive logs never leave your device. Only result saves count as Pro downloads — scrub before sharing, not after.
Mode defaults to extract and flags default to g: extract joins every matchAll hit with newlines into <name>-extracted.txt, replace runs text.replace into <name>-replaced.txt. The picker accepts 10 extensions: .txt, .csv, .md, .json, .html, .xml, .log, .js, .ts and .css.
Regex Tester
Provides an interactive environment where users can write a regular expression pattern, test it against sample strings, and view real-time match. Code never leaves your device — formatting and validation run locally in your browser.
Secret Scanner
Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords.