Free · No sign-up
Tools forpeople who ship
The utilities we reach for building software, free for anyone who writes it too — a Supabase auditor, a JWT decoder, a secret scanner, generators, formatters, and DNS checks. Most run entirely in your browser, so nothing you paste leaves the tab. No account, no ads, no export limit.
- Tools
- 17
- Cost, forever
- $0
- Sign-ups
- 0
- Ads or trackers
- 0
Showing all 17
Security
Is it
actually safe?
Hand each one a token, a URL, or a project and it tells you what an attacker would see. The Supabase auditor is the one most people came looking for.
- 01Security
Supabase Security Auditor
Point it at your project, find the holes.
Audit your own Supabase project the way an attacker would probe it. Paste your project URL and anon key and it checks whether tables are readable without a login, whether storage buckets are world-listable, what your anon key's JWT actually grants, and whether you have pasted a service_role key somewhere a browser can see it. Every finding says which table or bucket, and how to close it.
Who reaches for itAnyone shipping a Supabase app who wants to be sure the anon key cannot read the whole database.
Open - 02Security
JWT Decoder
Paste a token, read what is inside.
Decode a JSON Web Token into its header, payload, and signature without sending it anywhere. Shows every claim, resolves the timestamp claims to real dates, tells you whether the token has expired or is not yet valid, and flags the alg:none footgun. Signature verification against a shared secret is optional and also runs locally.
Who reaches for itAnyone debugging auth and needing to know what a token actually says before trusting it.
Open - 03Security
Secret & .env Scanner
Paste code or a .env, catch the leaked keys.
Paste a code snippet, a config file, or a whole .env and it flags anything that looks like a live credential: AWS keys, Stripe and OpenAI keys, Supabase service_role tokens, private key blocks, database URLs with passwords in them, and generic high-entropy strings. Runs entirely in the browser, so the secret you are checking never leaves the tab.
Who reaches for itAnyone about to commit, paste into an issue, or share a config and wanting a last look first.
Open - 04Security
Security Headers Scanner
Enter a URL, grade its headers.
Fetch a URL and grade the security headers it returns: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each one is explained in a sentence, with the header to add when it is missing, and the whole set rolls up to a letter grade.
Who reaches for itAnyone hardening a site and wanting the same report a pen-tester would open with.
Open - 05Security
CORS Tester
See exactly what a URL allows cross-origin.
Send a preflight and a real request to any endpoint and read back exactly what it allows: which origins, which methods, which headers, and whether credentials are permitted. Spells out the common misconfigurations — a wildcard origin paired with credentials, a reflected Origin that trusts everyone — rather than leaving you to infer them.
Who reaches for itAnyone staring at a CORS error, or checking their own API is not open to every origin on the web.
Open
Encode & format
Transform it,
both directions
Reversible conversions and pretty-printing. Paste in, read out, copy back — no round trip to a server, so nothing you paste ever leaves the tab.
- 01Encode & format
Base64 Encode / Decode
Text or files, both directions.
Encode text or a file to Base64, or decode it back, with a URL-safe variant for tokens and query strings. Handles full Unicode correctly rather than mangling anything past ASCII, and decodes to a downloadable file when the input is binary. Everything happens in the browser.
Who reaches for itAnyone pulling a Base64 blob out of a token, a data URI, or an API response.
Open - 02Encode & format
URL Encode / Decode
Percent-encoding, both directions.
Percent-encode a string so it survives a URL, or decode one back to plain text. Offers both component encoding (for a single query value) and full-URI encoding (which leaves the structural characters intact), because using the wrong one is how a query parameter quietly breaks.
Who reaches for itAnyone hand-building a URL or reading an encoded one out of a log or a redirect.
Open - 03Encode & format
JSON Formatter
Validate, pretty-print, or minify.
Paste JSON and get it back formatted with the indentation you choose, minified to one line, or with a precise error pointing at the line and column where it broke. Sorts keys on request, and reports the depth and size so you can see what you are dealing with. Parsed in the browser, never uploaded.
Who reaches for itAnyone with a wall of minified JSON from an API and no patience left for it.
Open
Generate
Make a value
you can trust
Identifiers, passwords, keys, and hashes, generated with the browser's own crypto rather than a math library that looks random and is not.
- 01Generate
UUID Generator
v4 and v7, one or a thousand.
Generate UUIDs from the browser's own cryptographic random source — random v4, or time-ordered v7 for identifiers you want to sort by creation. Make one or a batch, copy the lot, and switch case or hyphenation to match whatever your database expects.
Who reaches for itAnyone seeding a database, writing a fixture, or needing an identifier that will not collide.
Open - 02Generate
Password & Key Generator
Strong passwords and API keys, in the browser.
Generate passwords, passphrases, and API keys from the browser's cryptographic random source — not Math.random, which is predictable and has no business near a credential. Tune length and character sets, read the real entropy in bits, or build a memorable multi-word passphrase instead.
Who reaches for itAnyone who needs a credential with enough real randomness behind it to survive a guessing attack.
Open - 03Generate
Hash Generator
SHA-2, SHA-3, and SHAKE, from text or a file.
Hash text or a file with SHA-2 (SHA-256/384/512) and the quantum-resistant SHA-3 family — SHA3-256/384/512 and the SHAKE256 XOF used in the post-quantum signature scheme SPHINCS+. SHA-2 runs on the browser's native crypto so a large file hashes at full speed; SHA-3 comes from a small audited library. Compare against an expected checksum to verify a download in one glance. Nothing is uploaded.
Who reaches for itAnyone verifying a download, fingerprinting a file, or reaching for a quantum-resistant SHA-3 digest.
Open
Test & explain
Write it,
watch it work
Live editors for the syntaxes nobody remembers cold — cron, regex, epoch time. Type on the left, read the plain-English meaning on the right.
- 01Test & explain
Cron Expression Explainer
Reads a cron line back in plain English.
Type a cron expression and read it back as a sentence, with the next several run times worked out so you can see whether it fires when you think it does. Handles ranges, steps, lists, and the day-of-month/day-of-week overlap that trips almost everyone. Build one from menus if you would rather not remember the field order.
Who reaches for itAnyone writing a crontab or a scheduled job and wanting to be sure of the timing before it ships.
Open - 02Test & explain
Regex Tester
Match, highlight, and explain, live.
Write a regular expression and see every match highlighted in your test text as you type, with capture groups broken out and a plain-English breakdown of what each part of the pattern does. Toggle the flags, check replacements, and catch a catastrophic-backtracking pattern before it hangs something in production.
Who reaches for itAnyone building a pattern and tired of guessing why it matches everything or nothing.
Open - 03Test & explain
Timestamp Converter
Unix epoch to date, and back.
Convert a Unix timestamp to a human date in your local zone and in UTC, or turn a date back into an epoch value. Reads seconds, milliseconds, and microseconds without being told which, shows the relative distance from now, and keeps a live clock so you always have the current epoch to hand.
Who reaches for itAnyone reading an epoch value out of a log, a database row, or a JWT and needing the real date.
Open
Network & DNS
Read what
a domain says
What a name resolves to, whether its mail can be spoofed, and when its certificate expires. The DNS lookups run in your browser over DNS-over-HTTPS.
- 01Network & DNS
DNS Lookup
Every record for a domain, from your browser.
Look up A, AAAA, CNAME, MX, TXT, NS, SOA, and CAA records for any domain over DNS-over-HTTPS, straight from the browser. Shows the TTL on each record and reads the answer back from Cloudflare's resolver, so it is a real lookup rather than a cached guess.
Who reaches for itAnyone chasing a propagation delay, a missing MX record, or a mispointed CNAME.
Open - 02Network & DNS
SPF, DKIM & DMARC Checker
Is your domain safe to spoof?
Check whether a domain publishes the three records that stop anyone sending mail as you: SPF, DMARC, and a DKIM selector. Reads each record back over DNS-over-HTTPS, explains what its policy actually enforces — an SPF that ends in ~all is not the same as one ending in -all — and tells you what is missing.
Who reaches for itAnyone whose domain sends email and wants to know it cannot be spoofed by a stranger.
Open - 03Network & DNS
SSL Certificate Checker
Expiry, chain, and issuer at a glance.
Check a domain's TLS certificate: who issued it, when it expires, how many days are left, which hostnames it covers, and whether the chain to a trusted root is intact. Catches the two failures that take a site down without warning — an expired certificate and a name it does not actually cover.
Who reaches for itAnyone who has ever been paged because a certificate expired at 2am on a Sunday.
Open
How they work
A developer tool people trust is one they can point at a real secret without wondering where it went. So these compute in your browser.
The JWT you decode, the .env you scan, the password you generate — none of it is uploaded, because none of it has to be. Three tools are the exception, and they say so: the header scan, the CORS probe, and the SSL check need to reach a URL your browser cannot reach cross-origin, so they go through our server and nothing else. Every tool states which side of that line it is on.
House rules
- No account, no email gate, no export limit.
- Client-side tools never send what you paste anywhere.
- The three server-assisted tools are labelled, and send only the URL you enter.
- Real browser crypto for anything that has to be random.
- Findings are a starting point, not a certificate — verify before you rely on them.
Software engineering
We build the software these tools come from
If you are shipping something real and want the people who wrote these to help build it, talk to the studio. No charge for the conversation.
- Free tools
- No sign-up
- Nothing tracked
- Free for everyone