Guide
The developer sites directory gathers 151 places you genuinely open while writing code, in ten groups: documentation and specifications (MDN, Can I use, RFCs, the official docs of each language), package registries and CDNs (npm, PyPI, Maven, Docker Hub, jsDelivr), online sandboxes (CodePen, StackBlitz, the TypeScript Playground, Compiler Explorer), status pages (GitHub, Cloudflare, npm, AWS), online tools (this site’s JSON / regex / JWT / hash / cron utilities and a dozen more, plus explainshell, Excalidraw and Mermaid), icons / fonts / colour, API testing and debugging (Hoppscotch, Bruno, webhook.site, ngrok), Git and collaboration (hosting platforms, commit conventions, licence choice), learning and community, and performance, security and debugging.
Updated 2026-09-292 sources8 min read
The developer sites directory gathers 151 places you genuinely open while writing code, in ten groups: documentation and specifications (MDN, Can I use, RFCs, the official docs of each language), package registries and CDNs (npm, PyPI, Maven, Docker Hub, jsDelivr), online sandboxes (CodePen, StackBlitz, the TypeScript Playground, Compiler Explorer), status pages (GitHub, Cloudflare, npm, AWS), online tools (this site’s JSON / regex / JWT / hash / cron utilities and a dozen more, plus explainshell, Excalidraw and Mermaid), icons / fonts / colour, API testing and debugging (Hoppscotch, Bruno, webhook.site, ngrok), Git and collaboration (hosting platforms, commit conventions, licence choice), learning and community, and performance, security and debugging.
Three things set it apart from a bookmark folder. First, every entry has a one-line editor’s note — what the site is good at, when to use it and what to watch out for ("the free tier limits size", "getting heavier and login-bound", "images are uploaded") — not the site’s slogan. Second, every entry marks four practical attributes: free, sign-in required, has an API and this-site/local, with matching filter toggles. Third, anything toolun can do locally is linked here first (no upload, no login), and external sites with an equivalent get a "this site can do it" note — especially for JWT decoding, regex testing, cron parsing and image compression, which touch sensitive data.
Searching "api" returns a group of results:
Searching “jwt” hits both an on-site and an off-site entry, and shows how they relate:
API testing & debugging
Hoppscotch Open-source Postman alternative in the browser: quick and login-free. Free · No sign-in
Bruno Offline-first open-source API client; collections are plain files for Git. Free
httpbin A request echo service: see exactly what headers and body you send. Free · API
Webhook.site A throwaway URL that receives any request and shows it live. Free
Apifox All-in-one API platform (design, debugging, mock, docs). Free · Sign-inOnline tools
JWT Decoder /tool/dev-jwt Decodes Header / Payload locally, shows expiry in human terms, token never leaves the browser. On-site
jwt.io jwt.io Auth0's JWT debugger plus a library list per language; for sensitive tokens use the offline version here. Do it here → dev-jwtAn entry has to satisfy three things. Opened often: it answers a need developers hit repeatedly (read docs, install packages, try code, send requests, check status, find icons) rather than merely being something you have heard of. Describable: the editor can say in one line how it differs from its peers; if two sites are indistinguishable, only one stays. Still alive: every entry was checked for reachability and maintenance on 2026-09-09, and abandoned sites or ones that moved behind a paywall were removed. Each group is kept to 10–30 entries — beyond that a directory degrades into a search engine result page.
Tools for JWTs, regexes, JSON and hashes are often fed real tokens, user data and internal endpoint structures. Pasting any of that into an off-site tool means the data left your machine — most such sites claim “client-side processing only”, and you cannot verify it. Every toolun tool runs locally in the browser, works offline and has inspectable code, so the same capability is linked here first; the off-site entries remain because they offer something the site does not (jwt.io's per-language library list, regex101's multiple engine dialects, Squoosh's per-format comparison), and their reviews say when you should still go there.
npm, PyPI and Maven are the only authoritative sources for a package: version history, dependencies and install commands all come from the registry page. jsDelivr and UNPKG expose files from those registries as plain URLs, handy for referencing a single file in a web page or quickly reading a package's source. The directory prefers official registries; corporate networks or restricted environments can run their own mirrors, but publishing and version lookups should still go through the official registry.
Most status pages follow the Atlassian Statuspage pattern: green Operational, yellow Degraded, orange Partial Outage, red Major Outage, with 90-day history bars per component below and a timeline of open incidents. A sensible troubleshooting order: check Downdetector first (user reports arrive fastest) → then the official status page (to confirm the scope and the expected recovery) → then subscribe to RSS or email instead of refreshing. Official pages often lag by ten minutes or more and can stay green while the service is down — which is why this site's API connectivity test lets you fire a request at the few addresses you depend on and see the answer yourself.
CodePen and JSFiddle run your HTML / CSS / JS in an iframe: simple and fast, but front-end only. CodeSandbox originally ran full Node projects in cloud containers, while StackBlitz compiles the Node runtime to WebAssembly and runs it in the browser through WebContainers — sub-second starts, usable offline. The official language playgrounds (TypeScript, Rust, Go) are backed by server-side compilation or a WASM compiler, and the share link is the code itself, which makes them the standard way to attach a reproduction to an issue.
Icon sets and fonts are mostly MIT (Lucide, Heroicons, Tabler), CC0 (the glyph part of Simple Icons — trademark rights in a brand mark stay with the brand) or OFL (all of Google Fonts). OFL allows commercial use and web embedding but forbids selling the font files on their own, and a modified version must be renamed before distribution; Font Awesome's free tier is triple-licensed under CC BY 4.0 + SIL OFL + MIT, and the Pro icons cannot be used in a free-tier project. For the licensing detail of design assets see the design and creative resources directory.
The "Package registries & CDNs" group: look up versions and install commands for npm and PyPI, and reference package files straight from jsDelivr; then grab gitignore.io and the GitHub CLI under "Git & collaboration".
Pick by stack in “Online sandboxes”: StackBlitz or CodeSandbox for React / Vue, the TypeScript Playground for a pure type problem, DB Fiddle for SQL, Compiler Explorer for C++.
“API testing and debugging”: first watch what the other side actually sent with webhook.site, then expose your local service with ngrok or Cloudflare Tunnel to receive the real callback, and finally replay the request in Hoppscotch / Bruno.
Walk the “Performance, security and debugging” group from top to bottom: PageSpeed Insights, SSL Labs, Security Headers, CSP Evaluator.
Either a better site already covers the niche (only one entry per describable difference stays), or it had gone quiet, moved behind a paywall or become unreachable in the 2026-09 check, or it is a niche tool tied to one language ecosystem and so outside the general scope.
The directory favours services that work globally: mirrors that only serve one region's network conditions are out of scope. Versions, docs and signatures of a package always come from the official registry; restricted networks can run their own mirror or follow the official registry's mirror and self-hosting docs.
This batch does not take submissions (to avoid turning into a link marketplace). Site changes are handled in the next review batch.
In this browser's localStorage only — nothing is uploaded and nothing crosses devices.
The directory data loads statically with the page; search, filtering and bookmarks happen locally in the browser, this page sends no request to any server, and it does not record which outbound link you clicked. External links open in a new tab with rel="noopener noreferrer", so the destination never receives this page as its Referer; what happens after that is governed by their privacy policy. The on-site tools (entries marked “On-site”) also run in the browser and upload nothing.
Updated 2026-09-29
151 developer sites covering docs and standards, package registries, sandboxes, status pages, online tools, design assets, API testing, Git collaboration, learning, performance, and security
rel="noopener noreferrer"dead links were checked on 2026-09-09.The de facto standard reference for the web platform, fully translated into Chinese, with compatibility tables always at hand.
Google's guide to web best practices and performance, and the official home of Core Web Vitals.
Check which browsers support a CSS/JS feature; a must-read before writing compatibility code.
Dozens of language and framework docs aggregated into one searchable, offline-capable box; switching is instant.
See which stage a new JavaScript syntax is at here, not in rumours.
The living standard for HTML; parser behaviour and entity tables follow it.
Index of the CSS module specs, for precise property definitions and value syntax.
Original texts for HTTP, TLS, JSON, URI and more; HTTP semantics live in RFC 9110.
API docs that switch by version, with a stability level marked on every method.
The official handbook from the basics to type gymnastics, best read alongside the Playground.
The 2023 rewrite centres on Hooks, and the Chinese edition keeps pace.
The Chinese official docs set the bar for framework documentation, interactive tutorial included.
A complete standard-library reference, with the Chinese edition continuously translated by the community.
Rust's official introductory book; its ownership chapter is clearer than most blog posts.
One Go concept per page with a runnable example; the basics take half a day.
A single well-commented code file gives you a quick tour of a language's syntax.
Learning roadmaps for frontend, backend, DevOps and more: what to learn and in what order.
160 commands plus option tables, goal-based lookup and a practice terminal, all on this site.
149 Git commands with danger levels and diagrams, plus a practice simulator.
Every status code's meaning, typical scenarios, client/server handling and misuse on one page.
The JavaScript package registry: versions, weekly downloads and dependency trees.
The Python package index: release history and supported Python versions.
Look up Java/Kotlin dependency coordinates and copy the Gradle or Maven snippet directly.
The Rust package registry; every crate links to its generated docs on docs.rs.
Official images carry the Docker Official Image mark; browse tags and Dockerfiles.
Go module docs and versions; the import path is the address.
The PHP Composer package registry.
The Ruby gem registry.
The .NET package registry, with target-framework compatibility.
Look up the brew package name and dependencies for software on macOS or Linux.
How much an npm package adds to your bundle; check before installing.
Compare download curves of similar packages; pick by trend, not by stars.
A free CDN for npm and GitHub files; reference any file inside a package by URL.
Access any file inside an npm package by URL; handy for reading source.
Write and see HTML/CSS/JS instantly; community pens are great CSS animation material.
Run a full frontend project online and import a GitHub repo to reproduce a bug.
WebContainers run Node projects in the browser and start faster than CodeSandbox.
The oldest frontend fiddle: lightweight, no login.
A cloud IDE in dozens of languages, good for teaching and small experiments.
Tweak types, inspect the compiled output, switch compiler options, and share code as a link.
Compile and run Rust online, and inspect MIR and assembly.
Go's official sandbox; the standard way to paste a reproduction in an issue.
Line-by-line source and assembly for C/C++/Rust and more, to see what the compiler really did.
Run SQL in the browser and import CSV; practise SQL without installing a database.
Create tables and run queries in MySQL, PostgreSQL or SQLite, and share a link to reproduce SQL problems.
Vue's official single-file-component sandbox, with compiled output.
Svelte's official sandbox, with the tutorials and examples inside.
See what new syntax compiles down to in ES5.
Step-by-step regex explanation and debugging, with several engine dialects.
JupyterLab in the browser (WebAssembly-based); try Python data analysis without installing anything.
Check here first when Actions queue up or pushes fail; RSS available.
Status by data centre; it turns yellow first when half the internet is having a bad day.
When every npm install times out, confirm the registry is not the problem.
Service health per AWS region, with a history of past events.
Check when deployments hang or edge functions throw errors.
Confirm whether a spike of API 429/5xx errors is on the platform side.
Crowd-sourced outage reports; often reacts faster than the official status page.
Health status and past incidents for Alibaba Cloud products by region.
This site: fire requests at a list of addresses to see status codes and latency, and rule your own network in or out.
Format, minify, validate and unescape, with errors pinpointed to line and column.
Convert between JSON, YAML, XML and CSV in all directions.
Match highlighting, capture groups, replacement preview and a common-syntax cheat sheet.
Decode header and payload locally, see expiry in human terms; the token never leaves the browser.
Encode and decode text or files, URL-safe variants included.
MD5, SHA family and HMAC, including file checksums.
Convert between Unix timestamps and dates across time zones.
Explain a cron expression in plain language and preview the next 10 runs.
Encode, decode and edit query parameters in a table.
Convert HEX/RGB/HSL and check colour scales and contrast.
Format JS, CSS, HTML and SQL.
Convert between HTML entities, JSON strings and Unicode escapes.
Work out network, broadcast and host ranges from a CIDR, and split subnets as needed.
Tick permissions to get 755/644 and the symbolic notation.
Turn a docker run command into compose.yaml.
Auth0's JWT debugger and library list; for sensitive tokens prefer this site's offline decoder.
A plain-English cron interpreter with plenty of examples.
Paste a complex shell command and get each argument explained against the man page.
Static analysis for shell scripts that catches the classic quoting and expansion traps.
Turn a code snippet into a pretty image for social media.
Raycast's code-screenshot tool, with a more modern look.
Hand-drawn-style whiteboard for architecture diagrams; stored locally, exports SVG/PNG.
Write flowcharts, sequence diagrams and class diagrams as text; they also render in Markdown.
Dozens of conversions: JSON to TS types, SVG to JSX, CSS to Tailwind and more.
Generate type definitions in many languages from a JSON sample.
Google's browser-side image compression with per-format comparison; this site's compressor handles batches.
Batch-check status codes and redirect chains for a list of URLs.
Feather's community continuation: 1500+ line icons with React and Vue packages (this site uses it).
From the Tailwind team: solid and outline sets in a clean style.
5000+ icons, one of the broadest free outline icon sets.
An Iconify-based icon search that looks a single word up across dozens of sets.
3000+ brand-logo SVGs with brand colours; essential for social sign-in icons.
The oldest icon font: 2000+ free icons, Pro behind a paywall.
A free open-source font library; self-host via Fontsource when you need reliability.
Google Fonts packaged for npm and self-hosting, with no third-party CDN.
A privacy-friendly Google Fonts mirror; API-compatible, just change the domain.
Hit space for a random palette, lock the colours you like and keep going.
Apply a palette to a sample page to see how it really looks, not just how it looks on paper.
Turn one colour value into a Tailwind-style 50–950 scale.
A 12-step scale system designed for accessibility, with paired light and dark modes.
Check whether foreground/background contrast passes WCAG AA or AAA.
Badge generator for READMEs: versions, downloads, CI status.
This site: one image in, a full favicon and manifest icon set out.
The most feature-complete API client; strong for teams but increasingly heavy and login-bound.
An open-source Postman alternative that runs in the browser: quick and login-free.
An offline-first open-source API client; collections are plain files you can commit to Git.
From Kong, with good GraphQL and gRPC support.
A request echo service: see exactly what headers and body your client sent.
A fake REST API (posts, users, comments) to stand in for a backend while building a frontend demo.
A throwaway URL that receives any request and shows it live; invaluable for debugging callbacks.
Expose a local port as a public HTTPS address; essential for testing WeChat or payment callbacks locally.
Free tunnelling with your own domain, with fewer limits than ngrok's free tier.
A desktop mock server; stand up a fake API for frontend integration in minutes.
Intercept requests in the browser or Node to mock them, sharing one set of handlers between tests and development.
Write OpenAPI docs, preview them live and generate client code.
Send HTTP requests online and generate client code in several languages, no client to install.
An all-in-one API platform (design, debugging, mock, docs); the free team tier is enough.
The centre of the open-source world; most projects, issues and Actions live here.
Ships with the full CI/CD and DevOps stack, and can be self-hosted.
A self-hosted Git service that runs from a single binary, light enough for a Raspberry Pi.
Enter languages, frameworks and editors to generate a merged .gitignore.
How to choose an open-source licence; one table explains the differences between MIT, Apache and GPL.
The official spec for feat: / fix: / chore: commit messages.
The semantic-versioning spec, in Chinese; the behaviour of ^ and ~ follows it.
A convention for how to write a CHANGELOG.
Open PRs, read issues and run Actions from the terminal without switching to a browser.
Man pages and Pro Git (Chinese edition): the final word on any Git command.
Search the error message directly; most questions were answered a decade ago.
A friendly English-language developer blogging platform.
The tech world's daily headlines; the comments are often meatier than the article.
Completely free programming courses and certifications, with a complete Chinese edition.
Exercises in 70+ languages with human mentor feedback, free.
Solve katas, climb the ranks and learn from other people's best solutions.
Real design files to implement, for practising project-style frontend work.
Hundreds of short JS/CSS/Python snippets, ready to copy.
Design patterns with clear illustrations and examples in many languages, Chinese included.
A collection of design, rendering and performance patterns for modern web apps.
A programmer community where the non-technical threads on careers and hardware are just as lively.
A Chinese beginner-tutorial site: good for syntax lookup, but go to the official docs for depth.
A weekly tech digest plus ES6 and Bash tutorials; a model of Chinese technical writing.
Runs Lighthouse and pairs it with real-user Core Web Vitals data.
Pick a region, device and connection to get a loading waterfall that is closer to reality than Lighthouse.
Grades a site's TLS configuration and finds weak cipher suites and certificate-chain problems.
Check security response headers such as CSP, HSTS and X-Frame-Options.
Mozilla's site security score, with remediation advice.
Paste a CSP policy and see which directives are doing nothing.
Bundle an import online and see the compressed size; more flexible than Bundlephobia.
How to read the Performance panel and memory snapshots; the official tutorials are the most systematic.
Which CSS works in HTML email, with support tables per client.
DNS resolution results from many locations; change a record and watch it propagate.
The top ten web security risks: a starting point for a security self-check.
This site: browser, screen, WebGL and 30+ capability checks, with a one-click report to copy for testers.