Running on your device · 0 bytes uploaded

# Web tools

Inspect the tokens and claims web apps exchange — decoded locally, nothing uploaded.

- [JWT decoder

Inspect headers and claims; verify signatures with a local key.
](/web/jwt)
- [TOTP generator & verifier

RFC 6238 codes from an authenticator secret — plus code verification with clock-drift window.
](/web/totp)
- [PKCE pair

Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
](/web/pkce)
- [Subresource integrity

Hash a script or stylesheet into an integrity= attribute — text or file.
](/web/sri)
- [Authorization header

Parse an Authorization header — Basic decodes, Bearer shape-checks, Digest splits.
](/web/auth-header)
- [CSP evaluator & builder

Evaluate a Content Security Policy with csp_evaluator — or build one, finding by finding.
](/web/csp)
- [SAML inspector

Read a SAML response — fields, attributes, conditions — and check its signature.
](/web/saml)
- [Certificate & CSR

X.509 certificates and CSRs — subject, SANs, validity window, key facts.
](/web/certificate)
- [JWK / JWKS

Inspect a JSON Web Key or JWKS — members, thumbprint, PEM form.
](/web/jwk)

9 tool s · everything is computed locally, nothing leaves your device.

---

Canonical HTML: https://nutter.tools/web
Markdown version: https://nutter.tools/web/index.md
Plain-text version: https://nutter.tools/web/index.txt
Agent index: https://nutter.tools/llms.txt