Security tools
Inspect tokens, headers, certificates and hashes without sending them anywhere.
6 tools
- SHA Hash & HMACSHA-1/256/384/512 digests and HMAC with Web Crypto, for text or files
- JWT DecoderDecode JWT header and payload with readable exp/iat — signature is NOT verified
- Security HeadersPaste a response's headers to score its security headers (CSP, HSTS, CORS, cookies, framing) and get the fix for each issue
- Secret ScannerFind leaked credentials in text or a file — API keys, tokens, passwords, private keys — and copy a redacted copy
- PEM / Certificate InspectorIdentify PEM blocks and inspect X.509 certificates (subject, issuer, validity, SAN, key) and ASN.1 — no verification
- CORS DebuggerPaste request and response headers or a HAR file and see why the browser blocks a cross-origin request