Frequently asked questions

BytesBench is a free set of tools for everyday developer work: JSON, encoding, security, images, and AI text. Every tool runs in your browser. It is not affiliated with ByteBench.dev or ByteBench.io. More about BytesBench.

Yes, every tool is free, and there's no account or sign-up. Open a tool and start using it.

No. The tools process your text and files with code that runs on your device. Nothing you paste or open is uploaded, logged, or saved, and BytesBench sets no cookies. A few tools download reference data, such as the AI Token Counter's tokenizer vocabulary, which is the same for everyone and never includes your input. See the privacy policy.

Open your browser's developer tools, go to the Network tab, and use a tool. You'll see the page's own files load, and no requests carrying what you typed or opened.

Once a tool page has loaded, it keeps working if your connection drops. Reloading the page or opening another tool needs a connection.

Current versions of Chrome, Edge, Firefox, and Safari, on desktop and mobile. A few image features depend on the browser: for example, only Safari opens iPhone HEIC photos, and AVIF can be saved only in browsers that support it.

Yes. Share tool sends or copies the tool's address. It never includes your text, files, or results.

Ads on the home page help keep the tools free. Pages where you use a tool have no ads or third-party scripts, so nothing else on the page can read what you type. The privacy policy has the details.

Email info@neilaops.ai. Mention the tool, your browser, and what happened, but don't send private data.

Every hidden character has an exact Unicode code, so plain code finds all of them, instantly and for free, and never rewrites your words. Sending text with hidden instructions to another AI could even trigger those instructions.

Unicode tag characters (U+E0000 to U+E007F) are invisible copies of normal letters. Attackers use them to hide instructions for AI models inside text that looks harmless to people. This tool decodes and shows that text, then removes it.

No. With "Keep characters that real text needs" on, it keeps the joiners in emoji like 👩‍💻, flag emoji, emoji style selectors like ❤️, and the joiners that Persian, Arabic, and Indic scripts need.

No. Hidden characters and curly quotes come from many editors, not just AI, and their absence proves nothing. This tool only removes characters; it doesn't judge the writing.

Not yet. Letters from other alphabets that look identical to Latin ones (like Cyrillic "а") are visible characters, and are out of scope for this version.

No. It's a parser that knows the mistakes AI models make, so it's instant, free, and gives the same result every time. It never rewrites your values.

Open strings and brackets are closed, and any value that was only partly written is dropped rather than guessed. A warning tells you data is missing, so ask the model to continue or raise its output limit.

No. Numbers keep their exact digits, even IDs too large for JavaScript, and keys stay in their original order. Only formatting mistakes are changed, and each one is listed.

Text that isn't JSON-like at all, such as prose in the middle of an object. You'll see exactly where it stopped so you can fix that spot by hand.

Use the model's structured output or JSON mode with a schema when your API supports it, and give an example of the exact shape you want. The AI JSON Schema Builder turns an example into a schema for OpenAI, Claude, or Gemini. This tool is the safety net for everything else.

As of 30 September 2026, from each provider's documentation:

• OpenAI strict mode needs an object at the top level, "additionalProperties": false on every object, and every property in required. It allows up to 5,000 properties and 10 levels of nesting, and doesn't support allOf, not, or if/then/else. (OpenAI docs)
• Claude needs "additionalProperties": false, and doesn't support recursion, number or length bounds, or minItems above 1. One request may have at most 24 optional fields and 16 fields with several types. (Claude docs)
• Gemini documents a smaller set of keywords and only the date-time, date, and time formats. (Gemini docs)

OpenAI strict mode requires every property to be listed in required. To keep a field optional, its type also allows null, and the model sends null when it has no value.

No. One sample can't show the real limits, and several providers reject those keywords. Add enums and descriptions by hand where they matter; descriptions help the model most.

Types, required and extra properties, enums, formats, number and length bounds, patterns, arrays, anyOf/oneOf/allOf, and local $refs. Anything it doesn't check is listed, so a pass never hides a skipped rule.

No. Samples are often real customer data, so everything runs in your browser and nothing is uploaded, saved, or put in share links.

The two OpenAI tokenizers, o200k_base (GPT-5, GPT-4.1, GPT-4o, o-series) and cl100k_base (GPT-4, GPT-3.5 Turbo), are counted with OpenAI's published vocabulary and match OpenAI's own tiktoken library token for token.

Anthropic and Google don't publish their tokenizers for offline use. Exact counts come from their APIs: Claude's count_tokens endpoint and Gemini's countTokens. The estimates here follow each provider's own guidance and say how they're calculated.

OpenAI hasn't published GPT-6's tokenizer, and OpenAI's tiktoken library doesn't support it yet. The page shows the o200k_base count as a guide until it does.

No. The page downloads the tokenizer vocabulary from this site once, then counts on your device. Your text never leaves the browser tab.

Context windows come from each provider's documentation, checked on the date shown under the table, with links to the sources. Providers change models often, so check the source before relying on a limit.

AI tools write their answers in Markdown, a plain-text format where ** means bold and # means heading. The chat app shows it formatted, but the copy button gives you the raw Markdown, and Docs, Word, and email don't understand it.

Anything that accepts formatted text: Google Docs, Microsoft Word, Gmail, Outlook, Notion, Apple Notes, and most rich-text editors. Tables get inline borders, so they keep their lines in Docs and email.

For places that don't accept formatting, such as form fields, chat apps, or text messages. You get the same content, with bullets as "•" and tables as aligned columns, and no Markdown symbols.

Math written in LaTeX stays as text, because Docs and Word won't turn it into equations. Images become links, so the page never loads a picture from someone else's server.

Answers that used web search can carry leftover markers such as 【4†source】 or invisible "cite turn" codes that show up as boxes. They're removed by default, and the count is shown.

No. The conversion runs in your browser, and nothing is uploaded, saved, or put in share links.

No. Formatting and validation happen in this page’s browser session. BytesBench does not save the content or put it in a share link.

The most common causes are single quotes, a missing comma or colon, an unclosed bracket, or a trailing comma. The validation message points you toward the likely fix.

JSON permits the text, but parsers generally keep the last value for a repeated key. Avoid duplicates when every value matters.

The first editor version treats Text as the source of truth. Use the Tree and Table views to explore and search, then make edits in Text and refresh the views.

It closes every expandable object and array in the Tree view. Expand all opens them again so you can scan the full structure.

Search can match every row, JSON path, value text, or JSON type. Matching rows are highlighted in Tree and filtered in Table.

No. Both documents are parsed before comparison, so spaces, line breaks, and object key order are ignored.

Array order and position are significant. An item at $.items[1] is compared with the item at the same position in the other document.

You can share the tool link, but document content is never placed in the URL. Copy or download the report locally when you need to send the result.

No. The input is parsed and serialized again, so the result represents the same JSON value. Only presentation whitespace outside strings is removed.

No. Minification only makes JSON smaller and easier to send. It does not hide, secure, or compress the contents cryptographically.

JSON requires double quotes, commas between values, and closed braces or brackets. Comments and trailing commas are not standard JSON.

No. Your browser decodes, resizes, and saves the images itself. Nothing is sent to a server.

No. The new image is drawn fresh, so camera details, GPS location, and dates from the original are not copied into it. The photo keeps the way it was rotated when you took it.

Converting a small, already-compressed JPG to PNG makes it larger, because PNG doesn't throw away detail. For photos, choose JPG or WebP, lower the quality, or reduce the size. Bigger results are flagged.

Only in browsers that can read HEIC, such as Safari on a Mac or iPhone. In other browsers you'll see a message. On an iPhone, Settings → Camera → Formats → Most Compatible saves new photos as JPG.

The result is the first frame as a still image. Converting animations isn't supported yet.

No. Your browser draws the SVG and saves the image itself. Nothing is sent to a server, so it also works offline once the page has loaded.

For security, browsers don't load outside files, such as linked images, web fonts, or stylesheets, when they convert an SVG. The page warns you when your SVG links any. Embed them in the SVG as data URLs, or convert text to outlines in your design app.

Text is drawn with the fonts installed on your device. If the SVG names a font you don't have, a fallback font is used. Convert text to outlines (paths) before exporting for an exact match.

1× matches the SVG's own size. 2× is a good default for websites and apps on high-DPI screens. For print or large displays, choose an exact width; up to 16,384 pixels per side and 100 megapixels in total.

Yes. An SVG drawn as an image can't run scripts or load anything, so even an SVG from an unknown source is converted without running its code.

No. The file is rebuilt without its metadata, and the picture data is copied exactly. Quality, size in pixels, and colors stay the same.

Phones often save photos sideways, with a flag that says how to turn them. Removing the flag would make portrait photos show sideways. It's a single number and says nothing about you.

No. Everything runs in your browser. Coordinates are shown as text and never sent to a map service.

This tool cleans JPG, PNG, and WebP without changing the picture. For other formats, use the Image Converter: converting to JPG or WebP leaves all metadata behind.

Some images carry a signed record of how they were made or edited (C2PA), and AI image tools often save the prompt and settings in PNG files. Both are listed, and both are removed when you clean the file.

For most sites, yes: it's the small set that covers current browsers, iPhones, and Android. favicon.ico still matters because some tools and older browsers request /favicon.ico directly.

Browsers cache favicons for a long time. Check in a private window, or add a version to the link, for example /favicon.svg?v=2.

A square SVG with a simple shape. Fine detail disappears at 16 pixels, so a bold mark or a single letter reads best in a browser tab.

No. The icons are drawn in your browser and saved straight to your device.

Each result is drawn next to the original and compared pixel by pixel. At the default precision, typical icons and logos come out identical. Lower precision makes files smaller and can shift edges slightly; the comparison shows how much.

IDs that gradients, clip paths, links, or accessibility labels point to are kept. If the SVG has a style sheet or script, all IDs are kept, because they might be used there.

Only if you want the SVG to scale to its container, for example in a responsive layout. The viewBox keeps its shape. Leave them on for fixed-size icons.

No. Optimizing and the visual check both run in your browser.

No. Base64 changes how bytes are represented; anyone can decode it. Do not use it as a security or privacy measure.

Yes. BytesBench converts text as UTF-8, so accented characters, symbols, and non-Latin scripts round-trip safely.

Yes. Whitespace is ignored while decoding, but the decoded value must be valid UTF-8 text.

It encodes the full input as one URL component. Use it for query values or path segments; it does not parse a URL into separate parts.

Plus signs are encoded as %2B so they remain literal plus signs when decoded.

The input may contain an incomplete percent escape such as %2. Check that every percent sign is followed by two hexadecimal characters.

No. BytesBench only decodes the header and payload and displays the signature text. Verification requires the correct algorithm, trusted key, and application context.

They are common NumericDate claims: expiration time, issued-at time, and not-before time. BytesBench displays their raw values and UTC timestamps when they are numeric.

Usually no. Signed JWT payloads are encoded, not encrypted, so do not place secrets or sensitive data in them unless your system explicitly uses an encrypted token format.

Unix time counts elapsed seconds since January 1, 1970 at 00:00:00 UTC, without counting leap seconds. Negative values represent earlier dates.

One second is 1,000 milliseconds. This tool does not guess the unit from the number's length, so early dates and negative values remain unambiguous. Millisecond inputs must be whole numbers.

Use a four-digit year and an explicit timezone: YYYY-MM-DDTHH:mm:ssZ or YYYY-MM-DDTHH:mm:ss±HH:mm. Up to three fractional-second digits are supported. For example, 2026-01-01T05:30:00+05:30 is midnight UTC. Date-only values, ambiguous local times, and leap-second inputs are rejected.

Your browser uses your device's timezone and daylight-saving rules for the local result. ISO input must include Z for UTC or a numeric offset to identify one instant even during a daylight-saving transition.

Each character is picked with your browser's cryptographically secure random generator (crypto.getRandomValues), with every allowed character equally likely. The tool never falls back to a weaker source.

No. They are generated in this tab and disappear when you leave or reset. There is no download button, so passwords aren't left in a file on your device.

For most accounts, 16 characters with all types is very strong. Use at least 12 if a site limits length, and prefer a password manager to remember them.

Characters like l, 1, and I are easy to confuse when you have to read or type a password by hand. Avoiding them slightly reduces strength, which the entropy estimate shows.

It estimates how many guesses an attacker would need: each extra bit doubles the number. It is calculated as length × log₂(number of possible characters).

Not directly: browsers don't let web pages read a site's certificate, and looking it up on a server would mean sending your domain elsewhere. Use the openssl s_client command above to copy the certificates, then paste them here.

That each certificate was really signed by the next certificate's key and hasn't been altered. It's checked with your browser's built-in cryptography (Web Crypto). Algorithms it can't verify, such as RSA-PSS, are marked "not checked", never "passed".

Revocation (OCSP and CRLs) and whether the root is in browsers' trusted list. Both need network access or a root store, so this page states them as not checked rather than guessing.

Browsers only accept the names in the Subject Alternative Name list. A certificate with a hostname in its CN but no matching SAN fails in Chrome, Firefox, and Safari, so this checker follows the same rule.

The key is never decoded, shown, stored, or sent anywhere; the page removes it before reading the certificates. Still, treat any key you've pasted somewhere as sensitive, and only share certificates.