JSON Beautifier & Viewer
Format, validate, and visualize JSON with a collapsible tree view. Syntax highlighting and easy copy/download.
Useful utilities for security professionals, completely free.
Format, validate, and visualize JSON with a collapsible tree view. Syntax highlighting and easy copy/download.
Analyze Swagger/OpenAPI specs to count HTTP methods and parameters for security assessment planning.
Turn a Burp Suite XML export into an OpenAPI 3.0 spec — runs entirely in your browser.
Convert IPv4 addresses to decimal, hex, octal, and mixed-base formats for security testing and WAF bypass research.
Encode text to Base64 or decode Base64 strings instantly. Supports UTF-8, client-side only.
Generate MD5, SHA-1, SHA-256, SHA-384, SHA-512 hashes or identify unknown hash types from their pattern.
Decode JSON Web Tokens to inspect header, payload, and signature. Check expiration and claims.
Generate Time-based One-Time Password codes from Base32 secret keys. Auto-refreshes every 30 seconds.
Validate your Google Gemini API key, test authentication, and view all available models with token limits.
Searchable reference of TCP/UDP ports with security-focused notes — covering web, databases, ICS/SCADA, and out-of-band management.
Fire a real cross-origin request from your browser and see exactly which headers are exposed, plus a curl-equivalent for full-fidelity testing.
AES-GCM (recommended) or AES-CBC at 128/192/256 bits via the Web Crypto API. Keys, IVs, and plaintext stay in your browser.
Paste an X.509 PEM and read every field — Subject, Issuer, validity, SANs, key usage, and SHA-256/SHA-1 fingerprints.
Exact tokenizer for OpenAI (GPT-4o, GPT-4, GPT-3.5, o1/o3); calibrated estimates for Claude, Gemini, and Llama. Lazy-loaded for speed.
Catalogue of 12 documented LLM jailbreak and prompt-injection technique families with examples, defences, and academic references.
Compute CVSS 3.1 and 4.0 scores by selecting metrics or pasting a vector. Same engine Vulnsy uses inside customer pentest reports.
Generate v4, v7, v1, or v5 UUIDs in batch, or inspect an existing UUID to see version, variant, and embedded timestamp.
Decode SAMLRequest / SAMLResponse messages (base64, optionally DEFLATE-compressed) into readable XML with key fields surfaced.
Paste a curl command, get equivalent Python, JavaScript fetch, Node.js, PHP, or Go code instantly.