Tools

Caesar, ROT13, Atbash, and Vigenère transforms plus letter-frequency analysis for CTF and puzzle solving.

Decode a PKCS#10 Certificate Signing Request (CSR) to verify its subject, public-key algorithm, and signature before you submit it to a CA.

Shannon entropy and character-class analysis for a secret.

Compute MD5, SHA-1, SHA-256, and SHA-512 digests of any text in one pass, entirely in your browser.

Identify likely hash algorithms from a digest by its length, character set, and prefix format.

Generate keyed HMAC signatures (HMAC-SHA1, HMAC-SHA256, HMAC-SHA512) for API signing and webhook verification.

Generate strong, cryptographically-random passwords with configurable length and character sets — computed in your browser and never transmitted.

Measure password entropy, character-class coverage, and estimated brute-force crack time — all offline.

Paste a PEM/DER X.509 certificate to decode its subject, issuer, validity dates, serial, public-key and signature algorithms, and Subject Alternative Names.

Generate cryptographically-random v4 (or time-based v1) UUIDs in bulk, and decode any UUID to reveal its version, variant, and embedded timestamp.

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes.

Encode text to Base64 and Base64URL, and decode Base64 back to readable text with a hex view of the raw bytes — both directions, in your browser.

Base64, base64url, hex, percent-encoding, and HTML entities in one pass.

Convert hexadecimal to readable UTF-8 text and text to hex, tolerant of spaces and colons — both directions in your browser.

Escape text to HTML entities or decode entities back, to reason about XSS and safe output encoding.

Percent-encode text for safe use in URLs and query strings, and decode percent-encoded values back to plain text — including a second pass that exposes double-encoding.

Encode and decode Base64 text and files.

Encode, decode, and parse URL components.

Encode and decode HTML entities.

Penetration testing framework for exploit development and validation.

Identify a file type from its leading hex bytes (magic numbers) regardless of extension.

Look up all DNS records for any domain: A, AAAA, MX, TXT, NS, CNAME and SOA, live.

Fetch and inspect a live SSL/TLS certificate: issuer, validity, expiry countdown and SANs.

Look up a domain's WHOIS record: registrar, creation and expiry dates, name servers and status.

Find the PTR hostname(s) for a public IP address and forward-confirm them (FCrDNS).

Turn an IPv4 CIDR block into network, broadcast, mask, host range, and usable host count.

Paste DNS records and get each type explained in plain English with its security implications.

Break down an IPv4 address: class, scope, private/reserved status, decimal/hex/binary, and reverse-DNS pointer.

Convert IPv4 addresses between decimal, hex, binary, and CIDR.

Parse and analyze HTTP headers for security issues.

Generate reverse-shell one-liners (bash, nc, python, php, perl, powershell, and more) for a given listener host and port.

A categorized reference of canonical SQL injection payloads for authorized testing and WAF/detection engineering.

A categorized reference of cross-site scripting payloads for authorized testing, filter evaluation, and detection.

Network discovery and security auditing scanner.

Fast web fuzzer for content discovery and directory brute-forcing.

Translate a cron expression into plain English and see the next run times, so you can verify a schedule before it ships.

Convert a Unix epoch (seconds or milliseconds) to human-readable UTC/ISO time, and convert a date back to an epoch — both directions in one tool.

Validate, pretty-print, and minify JSON in your browser, with clear parse errors, configurable indentation, and a minified-size readout.

Count characters, words, and lines in any text instantly, with and without spaces.

Test a regular expression against sample text and get a static ReDoS (catastrophic backtracking) safety review.

Convert text between camelCase, snake_case, kebab-case, PascalCase, CONSTANT_CASE, Title Case, and more.

Compare two blocks of text line by line and see exactly what was added, removed, or unchanged.

Decode and inspect JSON Web Tokens.

Test regular expressions with highlighted matches and replace preview.

Convert between Unix timestamps and human-readable dates.

The Cyber Swiss Army Knife for data encoding, encryption, and analysis.

Fetch a live URL and grade its HTTP security headers: HSTS, CSP, X-Content-Type-Options and more.

Check and grade a domain's SPF, DMARC and (optionally) DKIM records for email spoofing protection.

Fetch a URL live and inspect status, redirect chain, every response header, detected tech and timing.

Check a domain's CAA records — which Certificate Authorities are authorised to issue its TLS certificates.

Parse a CVSS 3.1 or 4.0 vector, expand every metric in plain English, and compute the 3.1 base score.

Paste raw email headers to reconstruct the delivery hop path and read SPF, DKIM, and DMARC results.

Paste HTTP response headers and get a graded report on HSTS, CSP, X-Frame-Options, and more.

Decode a JWT and statically review its header and claims.

Break a User-Agent string into browser, version, operating system, and device — and spot bots.

Web vulnerability scanner and proxy for manual testing.

Open-source web application security scanner.