Web tools
Inspect the tokens and claims web apps exchange — decoded locally, nothing uploaded.
- JWT decoder
Inspect headers and claims; verify signatures with a local key.
- TOTP generator & verifier
RFC 6238 codes from an authenticator secret — plus code verification with clock-drift window.
- PKCE pair
Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
- Subresource integrity
Hash a script or stylesheet into an integrity= attribute — text or file.
- Authorization header
Parse an Authorization header — Basic decodes, Bearer shape-checks, Digest splits.
- CSP evaluator & builder
Evaluate a Content Security Policy with csp_evaluator — or build one, finding by finding.
- SAML inspector
Read a SAML response — fields, attributes, conditions — and check its signature.
- Certificate & CSR
X.509 certificates and CSRs — subject, SANs, validity window, key facts.
- JWK / JWKS
Inspect a JSON Web Key or JWKS — members, thumbprint, PEM form.
9 tools · everything is computed locally, nothing leaves your device.