A web-operations workbench for checking URLs, redirects, headers, DNS, sitemap, robots, tokens, and API responses, with Blog and Play notes preserved.
What this site is now
bobob.app is a web-operations workbench first. The main surface helps check URL status, redirect chains, response headers, DNS records, canonical/meta signals, robots rules, sitemap entries, tokens, and API payloads in practical task flows.
Representative writing
The public blog intentionally shows a smaller representative set: complete posts with paragraphs, tables, checklists, build logs, production notes, and clear dates when the topic depends on current information. Short notes stay reachable as archive pages, but they are not promoted in the public blog list, feed, or submitted sitemap.
Play experiments
The Play section contains small static games and interactive experiments built for direct use in the browser. Each public entry is meant to have a playable surface, result or sharing path, related reading when it fits, and enough surrounding context to explain why the experiment exists.
Practical tools
The developer utilities remain available under /tools, but the priority is no longer a generic tool shelf. High-utility pages are maintained as deployment, search, security-header, token, API, and data-debug workflows with local-first behavior, examples, diagnostics, and related next steps.
How pages stay useful
New public pages should help a visitor decide or do something concrete. A post should add original judgment, a build record, a comparison, a checklist, or a useful mistake report. A Play page should expose the game surface quickly. A tool page should show the working input and output before reference material.
Local-first workflow
Most tools run directly in your browser so input can stay on your device. Tools that require public network checks, such as DNS lookup and HTTP status checks, use small server routes and reject private or local hosts.
Accessibility and navigation
The site keeps keyboard-reachable controls, predictable navigation, search, Blog and Play indexes, trust links, and tool routes so visitors can move from the home page or a search result to complete pages instead of empty or unfinished routes.
International coverage
Default English pages stay unprefixed. Localized routes keep translated trust pages, legal pages, tool labels, examples, FAQ, and guide leads where those surfaces are published, so visitors are not sent to pages made only from raw English registry text.
Public discovery surface
The submitted discovery surface is kept intentionally narrow: home, global search, trust pages, Blog index, representative Blog posts, Blog category hubs, Play index, Play pages, /tools, and selected operations-first tool pages. Canonical routes, feeds, sitemap entries, redirects, and public verification files are maintained so crawlers and visitors can reach complete pages.
Review workflow before copying
Formatter, validator, generator, network, and SEO tool pages are still written around a review loop: paste or enter a safe example, inspect diagnostics and warnings, compare the result with the target runtime or platform, then copy only the part that still fits the task.
Web operations workbench
All tools live under www.bobob.app so navigation, indexing, and related workflows stay consistent. Formatting, decoding, and generation run in the browser whenever practical. New tools require metadata, locale support, examples, FAQs, guides, related links, and smoke checks.
Format, minify, validate, inspect, and copy a safe API response report for JSON payloads without sending them to a server.
Use cases
- Format compact API responses before copying them into code or docs
- Copy an API response report with structure, diagnostics, useful JSON paths, and safe sharing checks
Starting points for this utility
- {"status":"ok","items":[1,2,3]}
- {"user":{"id":123,"roles":["admin"]},"active":true}
Common failure cases
Trailing commas, comments, or single quotes make browser JSON parsing fail.
Before copying
Validate first, then choose formatted or minified output for the next tool.
Test JavaScript regular expressions, inspect matches, and keep common patterns close by.
Use cases
- Validate JavaScript regular expressions
- Inspect capture groups and match positions
Starting points for this utility
- ^[^\s@]+@[^\s@]+\.[^\s@]+$
- https?:\/\/[^\s"'<>]*[A-Za-z0-9/#]
Common failure cases
A pattern works in PCRE or Python but fails in the JavaScript RegExp engine.
Before copying
Run one positive sample and one negative sample before copying the pattern.
Decode JWT header and payload segments locally, compare expected claims, and copy an auth handoff report.
Use cases
- Decode JWT header and payload segments while debugging API authentication
- Check exp, iat, nbf, iss, aud, scope, and subject claims before sharing a token
Starting points for this utility
- eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature
- Expected aud=bobob-api with scope read:tools
Common failure cases
Decoded JWT content is readable but not signature-verified by this browser tool.
Before copying
Check exp, nbf, iss, aud, scope, and tenant claims before trusting the token.
Encode, decode, inspect, and copy a safe payload report for Base64, Base64URL, image data URLs, JSON payloads, and JWT segments locally in the browser.
Use cases
- Decode copied Base64 payloads from logs
- Copy a Base64 payload report with variant, decoded shape, warnings, and safe handoff checks
Starting points for this utility
- hello world
- SGVsbG8sIEJvYiE=
Common failure cases
URL-safe Base64 and standard Base64 can differ by padding and character set.
Before copying
Choose encode or decode mode deliberately before pasting the value.
Build, explain, preview, and copy a safe schedule report for five-field cron expressions.
Use cases
- Build common recurring schedules
- Explain five-field crontab expressions
Starting points for this utility
Common failure cases
Five-field crontab syntax is different from Quartz cron with seconds or year fields.
Before copying
Confirm whether your scheduler expects five, six, or seven fields.
Generate UUID v4 values in bulk for fixtures, traces, and test data.
Use cases
- Generate identifiers for fixtures and local development.
- UUID Generator for code workflows
Starting points for this utility
- 5 UUIDs
- 20 UUIDs for fixtures
Common failure cases
UUID v4 values are unique identifiers, not secrets or sortable timestamps.
Before copying
Choose the count you need and keep one UUID per line when copying bulk output.
Generate MD5, SHA-1, SHA-256, SHA-512, HMAC signatures, and a safe signature report locally.
Use cases
- Generate repeatable hashes for checksums and debugging
- Create HMAC SHA-256 signatures for webhook tests
Starting points for this utility
- hello world
- release-artifact-v1.2.3
Common failure cases
Hashes are not encryption and should not be used as password storage by themselves.
Before copying
Normalize the input text exactly as the target system will read it.
Generate strong random passwords or memorable passphrases with a safe handoff report.
Use cases
- Create local test credentials or temporary account secrets
- Generate a memorable passphrase for systems that allow long values
Starting points for this utility
- 24 characters, symbols enabled
- 32 characters, no ambiguous characters
Common failure cases
A generated password can still leak through clipboard history, screenshots, or chat logs.
Before copying
Set length and character classes to match the target system policy.
Generate downloadable QR codes with URL, Wi-Fi, email, and vCard payload builders plus scan diagnostics and a safe scan report.
Use cases
- Create QR PNGs for public URLs
- Build Wi-Fi QR payloads without hand-editing separators
Starting points for this utility
- https://www.bobob.app
- WIFI:T:WPA;S:Guest Network;P:example-password;;
Common failure cases
Long URLs, Wi-Fi payloads, or contact data can produce dense QR codes that scan poorly.
Before copying
Use the payload builder for Wi-Fi, email, and vCard values instead of hand-editing separators.
Look up public DNS records, inspect A/AAAA, CNAME, MX, TXT, SPF, DMARC, and NS signals, and copy a deployment report.
Use cases
- Inspect public A and AAAA records for deployment readiness
- Run A, AAAA, CNAME, NS, TXT, and DMARC deployment checks together
Starting points for this utility
- bobob.app deployment checklist
- bobob.app, A
Common failure cases
Public DNS resolvers can show cached records while a migration is still propagating.
Before copying
Query the exact record type you need, such as A, CNAME, MX, TXT, or NS.
Check HTTP status, request-profile reachability, redirect diagnostics, final URL, response headers, pasted header blocks, CSP drafts, and a copyable public URL report.
Use cases
- Inspect status codes and response headers
- Trace public redirect chains and final URLs
Starting points for this utility
- https://www.google.com
- http://bobob.app
Common failure cases
Private, localhost, and reserved URLs are rejected by the server route.
Before copying
Check status code, final URL, content type, and cache headers together.
Convert HEX, RGB, and HSL colors and inspect WCAG AA/AAA contrast diagnostics.
Use cases
- Convert color tokens between HEX, RGB, and HSL
- Check foreground and background contrast for AA and AAA thresholds
Starting points for this utility
- #2563eb on #ffffff
- rgb(24,24,27) on #fafafa
Common failure cases
A passing contrast ratio can still fail if the real UI uses smaller text or different weight.
Before copying
Check the exact foreground and background pair used in the UI.
Format SQL queries for readable reviews and debugging.
Use cases
- Pretty-print compact SQL and copy a query review report before running it.
- SQL Formatter for code workflows
Starting points for this utility
- select id,name from users where active=1 order by created_at desc
- select count(*) from orders where created_at >= '2026-01-01'
Common failure cases
Formatting makes SQL readable but does not prove the query is safe or efficient.
Before copying
Review the formatted query against the original before running it.
Format CSS rules and inspect selectors, at-rules, custom properties, color tokens, and minified size.
Use cases
- Review copied CSS snippets before sharing.
- Check selectors and custom properties after formatting.
Starting points for this utility
- .card{display:flex;color:#111}
- @media (min-width:768px){.grid{grid-template-columns:repeat(3,1fr)}}
Common failure cases
Formatting does not change selector specificity or cascade behavior.
Before copying
Confirm selectors, media queries, and custom properties stayed attached to the right block.
Format JavaScript snippets and inspect functions, imports, exports, async usage, browser APIs, and copy risks.
Use cases
- Format pasted JavaScript before reviewing it.
- Check functions, imports, exports, and async usage in a snippet.
Starting points for this utility
- function hi(){console.log('bob');}
- const total=items.reduce((sum,item)=>sum+item.price,0)
Common failure cases
Formatting is not linting, compiling, type checking, or security review.
Before copying
Do not run untrusted JavaScript just because it became readable.
Read the blog