The developer sites directory gathers 159 places you genuinely open while writing code, in ten groups: documentation and specifications (MDN, Can I use, RFCs, the official docs of each language), package registries and mirrors (npm, PyPI, the Tsinghua / Alibaba / USTC mirrors, Docker Hub), online sandboxes (CodePen, StackBlitz, the TypeScript Playground, Compiler Explorer), status pages (GitHub, Cloudflare, npm, AWS), online tools (this site's JSON / regex / JWT / hash / cron utilities and a dozen more, plus explainshell, Excalidraw and Mermaid), icons / fonts / colour, API testing and debugging (Hoppscotch, Bruno, webhook.site, ngrok), Git and collaboration (hosting platforms, commit conventions, licence choice), learning and community, and performance, security and debugging.

It differs from a bookmark-style directory in three ways. First, every entry has a one-line review written by the editor — what the site is good at, when to reach for it, where the traps are (“unstable over a direct connection, consider self-hosting”, “getting heavier and now wants a login”) — not the vendor's own slogan. Second, each entry carries four practical labels — free / login required / works in China / has API — with matching filter toggles; “works in China” is only applied conservatively, to sites confirmed to open directly. Third, work that toolun can do locally is linked to the on-site tool first (no upload, no login), and an off-site tool of the same kind is marked “Do it here” — especially for anything touching sensitive data, such as JWT decoding, regex testing, cron parsing or image compression.

1. 01Search— type a site name, a use or a tag (“mirror”, “mock”, “tunnel”, “icon”, “contrast”); every field is matched fuzzily.
2. 02Filter— combine “Free”, “No login”, “Works in China” and “On-site / local”; click a group chip to see one group only.
3. 03Bookmark— the star in the top-right corner of a card pins it to “My bookmarks” at the top of the page (in this browser's localStorage).
4. 04Read the badges— the labels along the bottom of a card: “On-site” runs in the browser; “Do it here” jumps to the matching toolun tool; “Login required”, “Foreign phone” and “API” mean exactly what they say.
5. 05Open— external links open in a new tab, on-site tools open in the current one.

Searching “mirror” returns:

Searching “jwt” hits both an on-site and an off-site entry, and shows how they relate:

Package registries and mirrors
  npmmirror (Taobao mirror)   Full npm mirror in China, synced every 10 minutes; one npm config set registry line.   Free · Works in China
  Tsinghua Open Source Mirror   Mirrors of PyPI, Ubuntu, Anaconda, Homebrew and dozens more...                     Free · Works in China
  Alibaba Cloud mirrors         Covers Linux distributions, language packages, container images...                   Free · Works in China
  USTC Open Source Mirror       Long-running mirror; Arch, Debian and Rust crates sync promptly.                     Free · Works in China
  jsDelivr                     Free CDN for npm and GitHub files, with nodes in China.                             Free · Works in China

Online tools
  JWT Decoder   /tool/dev-jwt   Decodes Header / Payload locally, shows expiry in human terms, token never leaves the browser.   On-site
  jwt.io        jwt.io          Auth0's JWT debugger plus a library list per language; for sensitive tokens use the offline version here.   Do it here → dev-jwt

Inclusion criteria: opened often, describable, still alive

An entry has to satisfy three things. Opened often: it answers a need developers hit repeatedly (read docs, install packages, try code, send requests, check status, find icons) rather than merely being something you have heard of. Describable: the editor can say in one line how it differs from its peers; if two sites are indistinguishable, only one stays. Still alive: every entry was checked for reachability and maintenance on 2026-09-09, and abandoned sites or ones that moved behind a paywall were removed. Each group is kept to 10–30 entries — beyond that a directory degrades into a search engine result page.

Why the on-site tools come before the off-site ones

Tools for JWTs, regexes, JSON and hashes are often fed real tokens, user data and internal endpoint structures. Pasting any of that into an off-site tool means the data left your machine — most such sites claim “client-side processing only”, and you cannot verify it. Every toolun tool runs locally in the browser, works offline and has inspectable code, so the same capability is linked here first; the off-site entries remain because they offer something the site does not (jwt.io's per-language library list, regex101's multiple engine dialects, Squoosh's per-format comparison), and their reviews say when you should still go there.

How mirrors work, and how to pick one

The origins for npm, PyPI, apt and Docker Hub live overseas, and a direct connection from China is slow or times out. A mirror syncs the full dataset from the origin on a schedule (npmmirror every 10 minutes, most TUNA sources within 6 hours), and you point your package manager's registry at it; package contents and signatures are unchanged. Pick these first: university mirrors (TUNA, USTC — non-commercial and comprehensive) and vendor mirrors (Alibaba Cloud, npmmirror — plenty of bandwidth). npm config set registry https://registry.npmmirror.com and pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple are the two commands people run most, and each mirror publishes per-system setup notes on its help page. Remember that a mirror only covers downloads: npm publish and pip upload still have to point at the origin.

How to read a status page

Most status pages follow the Atlassian Statuspage pattern: green Operational, yellow Degraded, orange Partial Outage, red Major Outage, with 90-day history bars per component below and a timeline of open incidents. A sensible troubleshooting order: check Downdetector first (user reports arrive fastest) → then the official status page (to confirm the scope and the expected recovery) → then subscribe to RSS or email instead of refreshing. Official pages often lag by ten minutes or more and can stay green while the service is down — which is why this site's API connectivity test lets you fire a request at the few addresses you depend on and see the answer yourself.

The two technical routes to a sandbox

CodePen and JSFiddle run your HTML / CSS / JS in an iframe: simple and fast, but front-end only. CodeSandbox originally ran full Node projects in cloud containers, while StackBlitz compiles the Node runtime to WebAssembly and runs it in the browser through WebContainers — sub-second starts, usable offline. The official language playgrounds (TypeScript, Rust, Go) are backed by server-side compilation or a WASM compiler, and the share link is the code itself, which makes them the standard way to attach a reproduction to an issue.

Licensing icons and fonts

Icon sets and fonts are mostly MIT (Lucide, Heroicons, Tabler), CC0 (the glyph part of Simple Icons — trademark rights in a brand mark stay with the brand) or OFL (all of Google Fonts). OFL allows commercial use and web embedding but forbids selling the font files on their own, and a modified version must be renamed before distribution; Font Awesome's free tier is triple-licensed under CC BY 4.0 + SIL OFL + MIT, and the Pro icons cannot be used in a free-tier project. For the licensing detail of design assets see the design and creative resources directory.

Coverage

— sites a general web or back-end developer uses day to day; it does not enumerate every language ecosystem (each language keeps only its official docs and package registry), and it excludes services behind a paywall, platforms that need an enterprise account, and pure marketing “tool aggregator” sites.

Reviews are the editor's view

— the one-line verdicts reflect hands-on use in 2026-09 and carry subjective judgement; your team may weigh the trade-offs between rival tools differently.

Labels

— “Free” means a usable free tier exists, not a particular quota; “Login required” means the core features need an account; “Works in China” is conservative, and no label does not equal unusable.

What it does not do

— no submission process, no ranking, no click tracking; once you follow a link, the destination site is in charge.

Updates

— dead links and changed labels are checked in batches, and the date of the check is written into the page.

The directory data loads statically with the page; search, filtering and bookmarks happen locally in the browser, this page sends no request to any server, and it does not record which outbound link you clicked. External links open in a new tab with rel="noopener noreferrer", so the destination never receives this page as its Referer; what happens after that is governed by their privacy policy. The on-site tools (entries marked “On-site”) also run in the browser and upload nothing.

• MDN Web Docs（访问日期：2026-09-09） — the de facto reference for the web platform and the anchor of this page's “Documentation and specifications” group.
• Tsinghua Open Source Mirror usage help（访问日期：2026-09-09） — mirror setup instructions, split by operating system and package manager.
• Choose a License（访问日期：2026-09-09） — the open-source licence comparison table; MIT / Apache / GPL differences on one page.
• Atlassian Statuspage: Understanding status pages（访问日期：2026-09-09） — where the look and the status levels of most status pages come from.