Running on your device · 0 bytes uploaded

Web tools

Inspect the tokens and claims web apps exchange — decoded locally, nothing uploaded.

- JWT decoder

Inspect headers and claims; verify signatures with a local key.
 (/web/jwt)
- TOTP generator & verifier

RFC 6238 codes from an authenticator secret — plus code verification with clock-drift window.
 (/web/totp)
- PKCE pair

Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
 (/web/pkce)
- Subresource integrity

Hash a script or stylesheet into an integrity= attribute — text or file.
 (/web/sri)
- Authorization header

Parse an Authorization header — Basic decodes, Bearer shape-checks, Digest splits.
 (/web/auth-header)
- CSP evaluator & builder

Evaluate a Content Security Policy with csp_evaluator — or build one, finding by finding.
 (/web/csp)
- SAML inspector

Read a SAML response — fields, attributes, conditions — and check its signature.
 (/web/saml)
- Certificate & CSR

X.509 certificates and CSRs — subject, SANs, validity window, key facts.
 (/web/certificate)
- JWK / JWKS

Inspect a JSON Web Key or JWKS — members, thumbprint, PEM form.
 (/web/jwk)

9 tool s · everything is computed locally, nothing leaves your device.

Canonical HTML: https://nutter.tools/web
Markdown version: https://nutter.tools/web/index.md
Plain-text version: https://nutter.tools/web/index.txt
Agent index: https://nutter.tools/llms.txt