Free Developer Security & Config Tools
Paste-in tools that run entirely in your browser — decode JWTs, lint Dockerfiles, audit security headers and scan for leaked secrets. Nothing is uploaded.
Paste a JWT and instantly see its header, claims and expiry — decoded entirely in your browser. No upload, no sign-up, nothing leaves your device.
Paste a Dockerfile and get an instant security review: baked secrets, unpinned base images, root containers, curl-pipe-to-shell and remote ADD — all checked locally.
Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.
Paste your .env and .env.example to instantly find missing keys, empty values and undocumented extras. Values never leave your browser — only key names are compared.
Paste your API's CORS response headers and detect dangerous setups: wildcard origins with credentials, null-origin acceptance, reflected origins and missing Vary: Origin.
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Paste a GitHub Actions workflow YAML and catch the top-5 CI/CD risks: unpinned actions, script injection, pull_request_target abuse, secrets in run steps and write-all permissions.
Paste your page HTML, robots.txt and llms.txt to see if ChatGPT, Perplexity, Claude and Google AI can actually read, parse and cite your site — 13 checks, all in your browser.
Paste JSON to validate and pretty-print it — with error location (line and column) when it's broken, plus key count, depth and size stats. Runs entirely in your browser.
Paste a 5-field cron expression and get a plain-English schedule plus the next 5 run times — with a warning when the day-of-month/day-of-week OR-rule will surprise you.
Test a regular expression against your text with instant results: all matches, their positions, capture groups and flag support — runs locally, nothing sent anywhere.
Encode text to Base64 or decode it back — proper UTF-8 handling so non-ASCII characters don't corrupt. Runs entirely in your browser.
Percent-encode or decode strings, and break any URL into protocol, host, path, query params and fragment — decoded params listed cleanly.
Generate up to 50 random UUIDs (v4) at once — cryptographically secure, instantly copyable, with uppercase option. No server, no tracking, just crypto.randomUUID().
Convert any color between HEX, RGB and HSL — plus instant WCAG contrast ratios against white and black text so you know it's accessible.
Convert Unix timestamps (seconds or milliseconds) to human dates and back — with relative time, ISO 8601, and your local timezone.
Paste two versions of a text or file and get a line-by-line diff: added, removed and unchanged lines, unified-diff style. Runs locally — paste production configs safely.
Count words, characters, sentences and paragraphs in any text — plus reading time and top-word frequency for SEO content checks.
Convert any text between camelCase, PascalCase, snake_case, kebab-case, SCREAMING_SNAKE and Title Case — handles existing camelCase input correctly.
Convert between decimal, hexadecimal, binary and octal instantly — accepts 0x, 0b, 0o prefixes, handles huge numbers exactly (BigInt, no float overflow).
Find a dimension's aspect ratio and scale it proportionally — enter a new width or height and get the matching dimension instantly.
Generate up to 20 paragraphs of lorem ipsum placeholder text instantly — deterministic, copy-ready, for mockups and layout testing.