Web and auth tools
Decode JWTs, check headers, cookies, and certificates, build CSPs, and inspect the tokens web apps exchange, all decoded locally.
17 tools
- JWT decoder
Inspect headers and claims; verify signatures with a local key.
- TOTP generator & verifier
RFC 6238 codes from an authenticator secret, plus code verification with a clock-drift window.
- PKCE pair
Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
- Subresource integrity
Hash a script or stylesheet into an integrity= attribute, from text or file.
- Authorization header
Parse an Authorization header: Basic decodes, Bearer shape-checks, Digest splits.
- CSP evaluator & builder
Evaluate a Content Security Policy with csp_evaluator, or build one finding by finding.
- SAML inspector
Read a SAML response (fields, attributes, conditions) and check its signature.
- Certificate & CSR
X.509 certificates and CSRs: subject, SANs, validity window, key facts.
- JWK / JWKS
Inspect a JSON Web Key or JWKS: members, thumbprint, PEM form.
- HTTP header parser
Paste-in request/response headers with repeated-header preservation.
- Cookie analyzer
Set-Cookie breakdown: attributes, expiry dates, prefix rules, warnings.
- Open graph preview
Extract og:/twitter: meta from pasted HTML and see the card it builds.
- HTTP status reference
Searchable, dated snapshot of the IANA status registry with RFC references.
- JWE decryptor
Compact JWE decryption with local oct, PBES2, or RSA keys through jose.
- SSH key inspector
Public key wire parse, fingerprints, options, and comments.
- robots.txt tester
Paste-in rules with RFC 9309 longest-match verdicts per path.
- cURL converter
cURL to fetch, axios, and Python requests with a loss report.
Your files are processed on your device. The few tools that talk to the internet say so before they do.