Section · 5 pages
Tools
Everything runs in this page. Nothing you paste is sent to a server, stored, or logged: the site's Content Security Policy only lets these scripts fetch the site's own search index.
Tool · JWT JWT decoder and inspector
Paste a JWT to see its header and claims explained, with warnings for expiry, risky algorithms and missing audience. Optionally verify the signature locally with a public key.
Tool · SAML SAML decoder
Paste a SAMLResponse, a SAMLRequest, a whole HTTP-Redirect URL or raw XML. The decoder undoes the binding's encoding, explains the fields a service provider must check, and flags structures that wrapping attacks use.
Tool · OAuth 2.0 OAuth flow visualiser
Step through the authorization code flow with PKCE, the client credentials grant and the device authorization grant, one HTTP message at a time, with what each step protects against.
Tool · NIST SP 800-63B-4 Password policy checker
Describe your password policy and see, rule by rule, where it meets or breaks NIST SP 800-63B-4 (July 2025), with the exact requirement strength and section for each.
Tool · Checklist Least-privilege checklist builder
Pick the environments you run and get a checklist for reducing standing privilege there, with each item mapped to the NIST SP 800-53 control behind it. Tick items off and export it as Markdown.