The toolkit
One question. A focused check.
Inspect tokens, policies and infrastructure, or work with hashes and encoding. Each tool shows whether it stays in your browser or contacts a server.
13 tools
JWT Debugger
Decode a token and flag alg:none, never-expiring tokens and sensitive claims.
CSP Evaluator
Grade a Content-Security-Policy A–F and see exactly what weakens it.
Password Strength
Estimate entropy and crack time, and catch common, predictable patterns.
Hash Generator
MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text, instantly.
SRI Hash Generator
Build Subresource Integrity tags for your scripts and stylesheets.
Base64 Encoder / Decoder
Convert text to and from base64, with a URL-safe option.
Secret Scanner
Paste code, .env or config and find leaked API keys, tokens and DB passwords.
CORS Tester
Probe a URL with a forged Origin to catch reflected-origin + credentials misconfigs.
SSL Certificate Checker
Inspect a site’s TLS certificate: expiry, issuer, chain and protocol support.
Email Security Checker
Check a domain’s SPF, DMARC and MX records for spoofing protection gaps.
DNS Security Checker
Verify DNSSEC validation and CAA records that lock down who can issue certs.
security.txt Validator
Fetch and validate /.well-known/security.txt against RFC 9116.
Data Breach Checker
See if an email address appears in known breaches, via Have I Been Pwned.