Portfolio | Jean Pierre Kolb

JPKCom Developer Tools

At jpkc.com/tools/ I provide a comprehensive collection of over 40 free, browser-based developer tools. The tech stack is built on PHP 8.3, Bootstrap 5, jQuery 4, and modern JavaScript. Most tools process your input entirely in the browser — texts, files, and keys never leave your machine.

Some tools require access to external resources for certain functions (e.g. DNS lookups, SSL certificate checks, SEO analysis, loading from a URL). These requests go through a hardened proxy on the server. Alternatively, you can switch on Expert Mode in seven tools and use my local proxy — see the proxy section below.

Code and Text

Beautify: Beautify JavaScript, CSS, and HTML with all js-beautify options, make JSON and JSONP readable, and safely unpack P.A.C.K.E.R. code without eval.
Cheat Sheets: 220 command-line cheat sheets — git, Docker, nginx, SSH, tar, curl, ImageMagick, and more. Search one sheet or all of them, copy commands with one click, and link straight to sections.
Coder: Encode and decode HTML entities, URLs, Base64, JSON, Unicode, hex, Punycode, and Quoted-Printable, verify JWT signatures, and create data URIs.
Compiler: Compile SCSS and Sass to CSS with Dart Sass, minify and beautify HTML, JavaScript, and CSS. Split-view editors with upload, download, and copy.
Convertor PRO: Convert text between 13 encodings (HTML entities, Unicode, UTF-8, hex, NCRs, and more) and data between JSON, YAML, TOML, XML, and INI — lossless, with exact numbers.
CSV Editor: Open, edit, and export CSV files. Spreadsheet editor with delimiter and encoding detection, export to CSV, JSON, and Markdown — everything stays in your browser.
JSON Editor: Modern JSON editor with tree, table, and code views: format, validate with JSON Schema, repair, sort, and query — big numbers stay exact. Load from a URL.
Lorem Ipsum: Placeholder text in Latin, English, or German as plain text, Markdown, or HTML — with exact length by paragraphs, sentences, words, or characters.
Markdown Editor: Markdown editor with live preview, line-synced scrolling, GFM, Mermaid diagrams, KaTeX math, a table dialog, snapshots, loading from a URL, and export to HTML or PDF.
Playground: HTML, CSS/SCSS, and JavaScript editor with live preview and an optional in-browser PHP 8.4 mode (php-wasm). Bootstrap/jQuery toggles, save slots, and export.
Regex Debugger: Test JavaScript regular expressions: live matching with groups, replace and split, a plain-English explanation of the pattern, code export for JavaScript, PHP, and Python, and a pattern library.
Source Viewer: Code viewer and editor with syntax highlighting for 100+ languages, a sandboxed HTML preview, minify and beautify, URL loading, and HTML-to-Markdown conversion.
WP Code Generator: Generate WordPress 7.x code: plugins, block themes, blocks, patterns, the Abilities API, REST routes, hooks, CPTs, settings pages, and 40 snippets — with ZIP download.
WYSIWYG Editor: Rich text editor based on TipTap with Markdown import/export, tables, math, syntax highlighting, snapshots, and an HTML source view. Print or save as PDF.

Design and Graphics

Colors: Color toolkit for web developers: picker, gradients, layered CSS shadows, and image palettes — with WCAG contrast checks, color-blindness simulation, and Tailwind output.
Fonts: Test and compare fonts: search all Google Fonts, check system fonts, preview local font files, and build fluid clamp() sizes and type scales.
GeoPattern: Turn any text into a geometric pattern — 16 pattern types, custom color, export as SVG or PNG in any size, as a CSS background, and as data URIs.
Graphic Editor: Crop, resize, and convert images in your browser: PNG, JPEG (MozJPEG), WebP, and AVIF with real file sizes, a metadata view, and a background color for JPEG.
PDF Tools: Create, view, annotate, merge, and split PDFs in your browser: forms, highlights, passwords, bookmarks, page selection, and Markdown, HTML, or images to PDF.
Periodic Table (PSE): Interactive periodic table (English and German) with all 118 elements: details, state of matter at any temperature, property heatmaps, and a molar mass calculator.
Placeholder Generator: Placeholder images by URL — PNG, WebP, or JPEG, retina-ready, with custom colors and text that always fits — plus SVG and data URIs. Presets for social media, banners, and devices.
Trianglify UI: Low-poly triangle backgrounds in any size — palettes or your own gradient, sparkle and shadow styles, wireframe, export to PNG, JPEG, WebP, or SVG, and shareable links.

AI and SEO

llms.txt Generator: Generate and check llms.txt files (spec v2): live validation with the reference parser, serving snippets for nginx and Apache, content-type and link checks. The standard helps AI language models understand web content.
Meta Tags Generator: Generate head tags for SEO, hreflang, Open Graph, X Cards, icons, and JSON-LD, plus security headers for nginx and Apache. Live preview and checks for missing or ignored tags.
robots.txt and Sitemap: Generate robots.txt per RFC 9309 (wildcards, AI crawler presets, live URL test) and sitemaps or sitemap indexes. Live checkers fetch both files from any URL, validate them, and compare them with each other.
SEO and GEO Analyzer: SEO and GEO analysis of any page: HTTP headers, SSL, redirects, meta tags, links, images, structured data, content, accessibility, robots.txt, llms.txt, and AI readiness.

Security and Utilities

Cryptor: AES-256-GCM text encryption in your browser: PBKDF2 with 600,000 iterations, password and passphrase generator, open format with code samples for Node.js, Python, and PHP.
DNS, SSL, Redirect, and URL: Check DNS records and mail security (SPF, DKIM, DMARC), inspect SSL/TLS certificate chains even when broken, trace redirects, parse URLs, and count SPF lookups.
Cron Job Helper: Build and validate cron expressions, preview the next runs in any time zone (DST-aware), create safe curl/wget web crons, and set up cron jobs for WordPress, TYPO3, Drupal, Laravel, Symfony, Docker, and DDEV.
Docker/Podman Composer: Convert docker run and podman run commands to Docker Compose YAML and back: all run flags, networks, volumes, environment, and correct $ quoting, plus a start script.
IP Tools: IPv4 and IPv6 subnet calculator, IP range to CIDR, address format converter, ULA generator, IANA special-purpose ranges, and your current IP address.
Generator: Generate passwords and EFF passphrases, salts, WordPress security keys, WLAN keys with QR code, .htpasswd lines (bcrypt/APR1), and TOTP codes — all in your browser.
Hash Generator: Hash text and files with MD5, SHA-1/2/3, Keccak, BLAKE2/3, RIPEMD-160, and CRC32, create HMAC and SRI hashes, and hash and verify bcrypt, Argon2id, and PBKDF2.
Info Tools: What your browser reveals: browser and OS via Client Hints, IP address and request headers, screen and media features, time zone and clock offset, capabilities and permissions — plus a plain-text IP API.
Mail Header Analyzer: Analyze email headers in your browser: route and sending IP, SPF/DKIM/DMARC per server, spam scores, phishing hints, and decoded subjects. Nothing is uploaded.
PKI Viewer: Inspect X.509 certificates and chains, CSRs, CRLs, keys, PKCS#12, and signed P7M/S/MIME files in your browser: fingerprints, signature checks, and key matching.
SSH Proxy: Generate SSH tunnel, SOCKS proxy, and port forwarding commands, plus SSH config entries, management scripts, autostart configs, and troubleshooting for Linux, macOS, Windows, BSD, and WSL.
QR Code Generator: Styled QR codes with custom dot and corner styles, gradients, and a logo, exported as SVG, PNG, JPEG, or WebP — for URLs, Wi-Fi, vCard, email, phone, location, and events, including a scan test.
Time Converter: Unix timestamps (s, ms, µs, ns), date and time in every IANA time zone, ISO 8601, RFC 2822, ISO weeks, and DST-aware time differences.
UUID Generator: Generate UUIDs v4, v7 (monotonic), v6, v1, v5, and v3 (RFC 9562) in bulk, decode any UUID (version, timestamp, node), and convert formats.

Localproxy — Proxy for JPKCom Developer Tools

Some of the tools listed above require access to external resources, e.g. for DNS lookups, SSL certificate checks, or SEO analysis. Browser security policies (CORS) normally prevent such access. By default, a proxy on the server handles this — with a rate limit and size caps. For Expert Mode, I wrote a lightweight HTTP proxy in pure Go — no external dependencies, single-file architecture (main.go). It runs on your machine, bypasses those limits, and since version 1.3.0 delivers the same certificate and redirect details as the proxy on the server:

github.com/JPKCom/proxy-jpkcom-dev-tools

How it works: The proxy runs as a standalone binary on your machine and binds exclusively to 127.0.0.1. All requests require per-session token authentication via the X-Proxy-Token header, and a host check blocks DNS rebinding against the proxy itself. SSRF protection is enforced when the connection is made — after DNS resolution, right before connecting, on every redirect too — and blocks private, reserved, and cloud metadata addresses, including their IPv6 forms. Cookies and the Authorization and Referer headers are never forwarded to the target.
Endpoints: /proxy — Forward HTTP/HTTPS requests with streaming body support; on request it follows redirects itself (up to five, each hop checked against SSRF), and it never passes the Location header — and with it your token — to the browser
/inspect — Return connection metadata as JSON: the full SSL certificate chain with signature checks, fingerprints, and PEM, host name matching, a list of certificate issues, TLS protocol and cipher, IP addresses, headers, HTTP/3 detection, and millisecond-precision connection profiling (DNS lookup, TCP connect, TLS handshake, TTFB). In diagnostic mode it also reads the chain of expired, self-signed, or legacy-TLS servers
/page — Comprehensive page analysis in a single request: follows redirect chains server-side (up to 20, with loop detection) with per-hop metadata (timing, IP, headers, certificate), delivers SSL details, body content, and performance timing
/ping and /version — Health checks and version information
Security and configuration: Configurable origin filtering for production use, configurable DNS servers (defaults to Cloudflare and Google), adjustable timeout and response size limits (default: 50 MB, applied to decompressed content too). Categorized JSON error responses for different failure types (DNS, TLS, connection, timeout, blocked target, redirect loop).
Privacy: By running locally on 127.0.0.1, no data leaves your machine through third parties. The proxy acts as a direct intermediary between your browser and the target server — without external cloud services or intermediate servers.
Platforms: Linux, macOS (13 Ventura or later), Windows, FreeBSD, OpenBSD, and NetBSD
General purpose: Although the proxy was developed for the JPKCom Developer Tools, it is universally usable — wherever you need a local, authenticated HTTP proxy with SSL inspection and connection profiling.

JPKCom DB — Knowledge Base, Blog, and Docs

At jpkc.com/db/ I run JPKCom DB — a standalone, bilingual (English and German) knowledge base that combines blog, documentation, and knowledge base. It focuses on web development, servers, DevOps, security, as well as AI, SEO, and GEO. Every page is additionally available as native Markdown so that AI systems can read the data directly and without noise. A site-wide full-text search (Pagefind) opens up all areas. Technically, the site is built on Eleventy and Tailwind CSS.

Blog: Articles on web development, AI, and digital practice — starting with a series on SEO and GEO.
Cheat Sheets: Over 200 command-line references, editorially prepared as in-depth articles and copyable with one click.
Tools documentation: Comprehensive companion docs for the free JPKCom Developer Tools: overview, manual, examples, plus tips and tricks.
Guides: Hands-on guides to my open-source projects, each cross-linked to the changelog.
Changelog: Version histories of the JPKCom projects, taken directly from each README.

GitHub Repositories

A selection of my open-source projects on GitHub, sorted by category. You can find my full profile at:
github.com/JPKCom

Proxy

proxy-jpkcom-dev-tools: Local HTTP proxy written in Go for browser-based developer tools. Enables DNS lookups, SSL analysis, and page inspection while bypassing CORS restrictions. See details above.

Web Interface

jpkcom-desktop: Web interface in the style of a classic desktop, in plain JavaScript: windows you can move, snap and restore, a menu bar, a dock, quick search and apps such as an editor, notes, tasks, a calculator, a terminal, and audio and video players. Content pages appear sanitized and natively in a window, without an iframe. Native ES modules, no build step, no runtime dependencies, a strict CSP with no eval and no innerHTML. Any number of languages, light and dark themes, installable and usable offline, fully keyboard accessible. Usable as a GitHub template, MIT license. Live demo

WordPress Plugins — Content and Display

All plugins require PHP 8.3+ and WordPress 6.9+, use strict typing, and are updated via automatic GitHub-based updates with SHA256 checksum verification.

jpkcom-post-filter: Faceted navigation and filtering of posts, pages, and custom post types via WordPress taxonomies. SEO-friendly URLs with filter state in the path, AJAX filtering with history.pushState and no-JS fallback. Four filter layouts (horizontal bar, columns, sidebar, dropdown), three list layouts (cards, rows, minimal). Native Gutenberg blocks, Elementor widgets, and Oxygen Builder elements. Four-tier caching (object cache, transients, APCu, PHP file cache). Full accessibility with aria-live regions and aria-pressed toggles. No dependencies — no ACF, Bootstrap, or jQuery required.
jpkcom-acf-jobs: Job listing and application management plugin for ACF Pro. Three custom post types (jobs, locations, companies) with hierarchical organization. Flexible job types (full-time, part-time, contract, internship). Schema.org JobPosting integration for Google for Jobs. WPML support, template override system, and Bootstrap 5 compatible.
jpkcom-acf-references: Reference gallery plugin for ACF Pro with interactive client-side filtering and animated transitions. Three custom post types (references, locations, customers). Image gallery with lightbox modal and keyboard navigation. Multiple layout options (list, card grid, image overlay). WPML support, prefers-reduced-motion compatible, and Bootstrap 5 compatible.
jpkcom-simple-lang: Lightweight per-post language selection that overrides the sitewide language setting in the frontend. Uses the WordPress core language system, automatically updates the HTML lang attribute, generates hreflang meta tags for SEO. Compatible with Yoast, Rank Math, and Oxygen Builder. Multisite support.
jpkcom-fa-svg-plugin: Shortcode plugin for embedding Font Awesome Pro (v5.15.4) as inline SVG. Supports all icon types (solid, light, regular, duotone, brands), CSS classes, styles, and title/ARIA labels for accessibility. Works in menus, Gutenberg, and via do_shortcode(). Multisite support.
jpkcom-gutenberg-img-alt: Automatically syncs image alt attributes in the Gutenberg block editor with media library metadata. Dynamic updates via regex — ensures alt texts stay current even when changed in the media library after insertion. Promotes SEO and accessibility.
jpkcom-rank-math-options: Companion plugin for Rank Math SEO: unlocks the robots.txt and .htaccess editors on multisite, removes the “Powered by Rank Math” notice from the frontend and XML sitemap, forces anonymous telemetry off, cleans up the generated llms.txt, and hides the Rank Math admin bar menu. Network-ready, no configuration needed.

WordPress Plugins — Security

jpkcom-harden-trim: Bundles over 40 hardening, privacy, and performance switches on one settings page — each can also be set with a constant in wp-config.php, which then locks the field. Harmless defaults: activating it changes nothing visible, it only removes traces nobody sees (generator tag, fingerprint headers, emoji script, user enumeration paths); the one thing it deliberately refuses out of the box is XML-RPC. Everything that can break something ships off, with a warning next to the switch. Security headers (X-Frame-Options, Permissions-Policy, HSTS), a cleaned-up <head>, local avatars, truncated comment IPs, control over heartbeat, revisions, and autosave, comments can be turned off. Three presets (Harmless, Recommended, Strict), role exemptions, JSON import/export, a kill-switch constant, the WP-CLI command wp harden-trim, and a read-only Abilities API ability for MCP and AI clients. No telemetry, requires WordPress 7.1+.
jpkcom-hide-login: Renames the default WordPress login URL (wp-login.php) to a custom slug. Built-in brute force protection with configurable thresholds (max attempts, time window, block duration). IP whitelist with CIDR support, WP-CLI commands, and multisite support. WooCommerce compatible, REST API safe, no core file modifications.
jpkcom-disable-xmlrpc: Globally disables WordPress XML-RPC: empties the method list via filter and blocks direct access to xmlrpc.php with a 403 error. Protects against automated attacks on the XML-RPC interface.
jpkcom-disable-comments: Completely disables WordPress comment functionality site-wide: closes comments, pingbacks, and trackbacks on every post type, removes the Comments screen, menu entry, admin bar node, and dashboard counts, answers the comment feeds with a 404, and makes every post report zero comments. The REST API comment endpoints answer 404 — except for block editor Notes, which keep working. Existing comments are not deleted, only hidden.
jpkcom-argon2: Enables the ARGON2ID algorithm for all WordPress password hashes. Replaces the default hashing with the more modern and secure Argon2id algorithm. Multisite support, no configuration needed.

Mastodon: JPKCom@mastodon.social — Fediverse profile
GitHub: JPKCom@GitHub — Open-source projects and code repositories
GitLab: JPKCom@GitLab — Additional code repositories
Drupal: JPKCom@Drupal — Drupal community profile
XING: Business network profile
LinkedIn: International business network profile
Google Business: Google business profile
Gravatar: Global avatar and profile on WordPress/Gravatar

Err-O-Rama

Even error pages deserve some fun. Each HTTP error page has its own theme, custom animations, and a few hidden details.

400 — Bad Request: Signal corruption with block displacement, line tearing, and RGB split
401 — Authorization Required: Radar scanner with blips and status messages
403 — Forbidden: Matrix rain with a playable Pong game
404 — Not Found: The classic “page not found” page
405 — Method Not Allowed: Padlock cutaway — the wrong key misses the shear line
408 — Request Timeout: Hourglass with granular sand, a growing cone, and a countdown
410 — Gone: Black hole rendered in real time — gravitational lensing, Einstein ring, and Doppler beaming of the accretion disk
418 — I'm a Teapot: Hyperspace animation with a steaming teapot
429 — Too Many Requests: Circuit board traces with overload effect
500 — Internal Server Error: Kernel panic in terminal style
502 — Bad Gateway: Bridge between client and server that collapses
503 — Service Unavailable: Robot with wrench and spinning gears
504 — Gateway Timeout: Clock with expiring countdown

Logos and Graphics

Graphics for download.

/img/JPK.svg: 1260 × 1260 · 69 KB · image/svg+xml
/img/JPKCode.svg: 2764 × 996 · 59 KB · image/svg+xml
/img/JPKCom.svg: 410 × 410 · 1.6 KB · image/svg+xml
/JPKCom.svg: 240 × 240 · 8.7 KB · image/svg+xml
/JPKComBE.svg: 1000 × 1000 · 9.5 KB · image/svg+xml
/JPKCom-6.svg: 1024 × 1028 · 4.6 KB · image/svg+xml
/JPKCom.png: 1024 × 1024 · 958 KB · image/png

Wallpaper

Desktop wallpapers for download.

The Cube — Blue: 3200 × 2000 · 298 KB · image/jpeg
The Cube — Gray: 3200 × 2000 · 318 KB · image/jpeg
The Cube — White: 3200 × 2000 · 360 KB · image/jpeg

Have questions or feedback about any of these projects? Get in touch.