Free security tools, one job each
No accounts, no tracking, no server round-trips where it can be avoided, built for real engagement workflows. Pick a tool below. Everything runs in your browser.
Text & Token Tools
JWT Decoder/Tamper & Generator
Decode, edit, and re-sign JWTs.
Flags alg:none and weak signing. HMAC, RSA, ECDSA, RSA-PSS.
Decode • Edit • Sign
Payload Encoder/Decoder
Chain encoding and decoding steps into one pipeline.
Base64, Hex, URL, HTML-entity, ROT13, and Binary, in any order.
Base64 • Hex • URL • ROT13
Magic Auto-Decoder
Paste an obfuscated string, get the plaintext.
Auto-detects layered Base64, Hex, URL, HTML-entity, ROT13, and Binary, up to 4 layers deep.
Base64 • Hex • ROT13 • Binary
Homoglyph Identifier/Generator
Detect or generate Unicode homoglyph lookalikes.
Spot spoofed domains and confusable characters in suspicious text.
Detect • Generate
Payload Generators
XSS Payload Generator
Generate XSS payloads.
Reflected, stored, DOM-based, WAF bypass, and encoding techniques.
Reflected • Stored • DOM • WAF Bypass
SQLi Payload Generator
Build SQL injection payloads.
MySQL, MSSQL, PostgreSQL, Oracle, SQLite. Info extraction, WAF evasion.
MySQL • MSSQL • PostgreSQL • Oracle
Reverse Shell Generator
Generate reverse shell one-liners.
Matching listener command and save-as-file options included.
Bash • Netcat • Python • PowerShell
Subdomain Permutation Generator
Generate candidate subdomain wordlists.
Environment/service/region tokens plus your own keywords. Dedup'd and capped.
massdns • puredns • dnsx
Command Builders
Hashcat Command Generator
Build a complete hashcat command.
Mode, attack type, wordlists, masks, rules, advanced flags.
Wordlist • Mask • Rules
MSFVenom Command Generator
Build msfvenom commands from template presets.
Windows, Linux, macOS, Android. Evasion encoders, listener setup guide.
Windows • Linux • macOS • Android
Nmap Command Generator
Build nmap commands from scenario templates.
Fast, stealth, full port, vuln scripts, timing presets, or hand-tune every flag.
Fast Scan • Full Scan • NSE
John the Ripper Command Generator
Build a complete john the ripper command.
Format, crack mode, wordlists, rules, masks, advanced flags.
Wordlist • Rules • Mask
Recon & Infrastructure Checks
HTTP Security Headers Analyzer
Fetch any URL's response headers and audit them.
Checked against OWASP Secure Headers Project. Pass/warn/missing status.
HSTS • CSP • X-Frame-Options
SPF / DKIM / DMARC Checker
Check a domain's email authentication setup.
Parsed mechanisms, policy explanations, misconfiguration flags.
SPF • DKIM • DMARC