15 offline developer tools built into Traceptor — no browser tab, no tracking

The reflex is instant. You need a QR code, so you open a tab. You need to check a regex, so you open a tab. You need to decode a JWT or sign an HMAC request, so you open a tab — and paste your secret key into a text field on a domain you’ve never audited. These tools are free, convenient, and almost certainly logging your input.

Traceptor’s Developer Toolbox is a tab in the Mac app that ships 15 fully offline tools. Nothing leaves your machine. No account, no API call, no analytics ping. Open the Toolbox from the sidebar, pick a tool, and close it when you’re done — the sensitive data you just processed never touched a network socket.

Image coming soon

The tools that handle sensitive data

These four tools are the ones where going online is genuinely dangerous. Treat them as a personal policy: if the input contains a key, a token, or a password, use the local tool.

HMAC / SHA

Signs and verifies HMAC signatures using CryptoKit on-device — HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512. Output in Hex or Base64. There are two sections: Compute (given a message and a secret key, produce the signature) and Verify (given a message, key, and a candidate signature, confirm it matches). Your signing key never leaves the process.

Hash

Drop or paste any text and get MD5, SHA-1, SHA-256, and SHA-512simultaneously, in one view. Toggle uppercase output if your target system expects capital hex digits. Uses CryptoKit’s Insecure.MD5, Insecure.SHA1, SHA256, and SHA512— the same primitives your production code uses.

Codec

Encodes and decodes across seven categories: Base64, URL, Hex, HTML entities, Unicode escape sequences, Hash, and JWT Decode. Auto-detection figures out the input format so you don’t have to. The JWT decoder splits the header, payload, and signature without sending the token anywhere.

JSON → Code

Paste a JSON payload and generate Swift, Kotlin, or Java model classes in one click. Swift output supports Codable, struct vs. class, optionals, CodingKeys, and access levels (internal / public / private). Kotlin options include @SerializedName, nullable types, and Moshi support. Java options include @SerializedName, getters/setters, and Lombok annotations. Root class name is configurable; snake_case → camelCase conversion and Swift keyword escaping are automatic. Paste the response from your API session in Traceptor’s proxy, click Generate, done.

Asset generation

These tools save the design-handoff round-trip. Generate, preview, and export without leaving your development environment.

App Icon

Drop a single high-resolution image and generate icons for iOS, Android, macOS, and Windowsin one pass. iOS output covers every size Apple requires: 20, 29, 40, 60, 76, 87, 120, 152, 167, and 1024 px, with a Contents.jsonfile ready to drop into Xcode. Android output targets mdpi, hdpi, xhdpi, xxhdpi, xxxhdpi, and the 512 px Play Store icon. macOS covers 16 through 1024 px. Windows covers 16 through 512 px. Optional: set corner radius (0–200 px slider) and choose a background fill color before exporting.

QR Code

Encode any text or URL as a scannable QR code. Instant, local, exportable. No third-party QR service sees your deep-link schema, your internal staging URL, or your Wi-Fi password.

SVG Editor

A split-pane editor: raw SVG source on the left, a live WebView preview on the right that updates as you type. Syntax highlighting covers tag names, attribute names, attribute values, comments, entities, and CDATA blocks in distinct colors. Background options: Grid, Dark, Light, Black, White. Zoom from 10% to 800% in 25% steps. Open and save SVG files from disk; export PNG; copy SVG to clipboard. Debounced XML validation via XMLParser surfaces errors before you save.

Image coming soon

Lottie Viewer

Drop a .json or .lottie file (or paste raw JSON) and preview the animation instantly. Playback controls: play/pause, a frame scrubber, and speed presets at 0.25×, 0.5×, 1×, and 2×. Loop modes: Loop, Once, and Bounce (auto-reverse). Inspector tabs show:

• Info— filename, dimensions, frame rate, start/end frame, and total duration
• Layers— layer name, type, and frame range for every layer in the animation
• JSON— raw source, fully copyable

Renders on a checkerboard background so transparency is immediately visible. No Lottie cloud account, no upload to a preview service.

Code and text utilities

Regex

Enter a pattern in one field and a test string in another. Matches highlight in real time, with each result showing its position as [location, length] and a copy button. Toggles for Ignore Case and Multiline (anchorsMatchLines). Invalid patterns surface an error immediately rather than silently matching nothing.

Diff

Two text inputs, one view. Traceptor compares them line by line using an LCS-based algorithm and highlights additions, deletions, and unchanged lines. Useful for comparing API response snapshots, config files, or any two blobs of text you’re debugging across environments.

Color

Open macOS’s native color picker and get the value converted to HEX, RGB (rgb(r, g, b)), HSL (hsl(h, s%, l%)), and CMYK simultaneously. HEX input field with an Apply button so you can go the other direction. Includes the full Flat UI color palette (American and extended). The card background updates to a gradient that follows your selected color so you can see it in context.

UUID

Generates universally unique identifiers. No entropy pool on a remote server, no version ambiguity — just a fresh UUID whenever you need one for a test fixture, a migration, or a seed file.

Project validation

AASA Validator

Universal Links fail silently when your apple-app-site-association file is malformed or missing a section. Enter a domain (with or without https://) and Traceptor fetches and validates the AASA file, checking the applinks, webcredentials, and appclips sections, and shows the raw JSON alongside the validation result. Example domains like apple.com, github.com, airbnb.com, and notion.so are included so you can see a well-formed file before testing your own.

Resource Onboarding

Drop a project folder and a candidate image to check whether that image is already in the project before you add it. Three match types:

• Exact— SHA-256 byte-for-byte match
• Near-duplicate— perceptual dHash similarity, so a lightly resaved JPEG or a differently-compressed PNG still counts as a duplicate
• Same-name— filename collision after stripping density suffixes like @2x or -xhdpi

Works with Xcode projects (scans .xcassets imagesets) and Android projects (scans res/ density folders). Supported formats include PNG, JPEG, SVG, PDF, WebP, HEIC, GIF, TIFF, BMP, Android Vector XML, and Lottie JSON.

Video Compress

Compress or convert a video file without uploading it to a cloud service. Supports MP4, MOV, AVI, MKV, and WebM input; outputs MP4 or MOV. Controls:

• Quality preset— Low, Medium, High, Highest
• Resolution— Original, 4K (2160p), 1080p, 720p, 480p, or Custom
• Frame rate— Original, 60, 30, 24, or 15 fps
• Audio bitrate— 64, 128, 192, 256, or 320 kbps AAC, with a Remove Audio option

Uses H.264 via AVAssetWriter and handles rotation via preferredTransformso portrait videos don’t come out sideways. The common alternative is uploading to a web compressor that buffers your entire video on a server. Your screen recordings and demo videos are better kept local.

How to open the Developer Toolbox

The Toolbox is a tab in Traceptor’s main window sidebar, listed under the workspace section. Click the tab and the tool grid appears. Select any tile to open that tool in the right pane. All tools are available on both the free and Premium tiers — no paywall on the Toolbox.

The real case for offline tools

Convenience is how most sensitive data leaks — not through dramatic breaches, but through the thousand small decisions where speed beats caution. A developer pastes a production JWT into a decoder to check the expiry. Someone drops an API key into a base64 tool to see what it encodes to. A team shares a Lottie file via a preview service that logs every upload.

None of these feel like security incidents. They’re just habits. The fix isn’t better security training; it’s making the local path the path of least resistance. When the tool is already open in the app you’re already using, “open a browser tab” stops being the default.