Free tools

Security checks that stay in your browser

Inspect a header, test a policy, or compare scan findings. Choose a check below. Nothing you paste is uploaded, and you do not need an account.

Security essentials

JWT debugger Decode a token and catch alg:none, a missing expiry, and secrets in the payload. Secret scanner Paste a .env file or a diff and find the keys that should not be in it. CSP evaluator Grade a Content-Security-Policy and see which directive undoes it. SRI hash generator Generate the integrity attribute for a script or stylesheet you load from a CDN. Hash generator MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of any text, at once. Base64 encoder Encode and decode Base64, including URL-safe, with UTF-8 handled properly. CWE lookup Look up a CWE and see the attack patterns MITRE links to it. CVSS calculator Score a CVSS 3.1 vector, or build one metric by metric.

Request and input policies

Path policy tester Test POSIX or Windows paths against a base directory without accessing files. Content-Disposition checker Inspect a download header and build one with a safer filename. Log injection checker Find control characters and record-boundary risks in supplied logs. Rate-limit simulator Simulate token buckets and request windows without sending traffic.

Repositories and findings

CODEOWNERS coverage checker Match file paths against CODEOWNERS rules and find gaps in ownership. Environment drift checker Compare environment variable names across deployments without exposing values. Security finding deduplicator Group duplicate findings by location or a supplied stable fingerprint. Security baseline comparator Compare finding sets for new, changed and no-longer-reported issues.
More free tools
Everything JSON Format, validate, convert, diff and reshape JSON, all in your browser.

These check one thing at a time. A scan reads your whole repository and tells you what an attacker would find first.

Free scan