Decode a JWT's header and payload without verifying the signature, with base64url handled correctly, the algorithm flagged as claimed-only, and an expiry check. This is a debugger, not an authorisation check.
Token
Decoded
This does not verify anything. The header and payload are only base64url-decoded - their contents are attacker-controlled. Trust nothing here until a server has checked the signature with a key it holds. Use it for debugging, never for authorisation.
A real entropy estimate in bits from character-class pools with a repetition penalty, an estimated crack time, a common-password list check and a live verdict.
Paste a Content-Security-Policy header and get every directive split out with its source list and a verdict, plus findings for unsafe-inline beside a host allowlist, wildcard sources, a missing default-src, data: in script-src, http: next to https:, and nonces with no strict-dynamic.
Decode a Set-Cookie or Cookie header into name, value and every attribute, with Max-Age and Expires resolved to an exact date, and flags a missing Secure or HttpOnly, a SameSite=None without Secure, and a Domain wide enough to leak to subdomains.
A real entropy estimate in bits from character-class pools with a repetition penalty, an estimated crack time, a common-password list check and a live verdict.
Batches of UUID v4 values from the browser's own CSPRNG, plus CRC32, FNV-1a and DJB2 of any text with both hex and decimal output.
An IPv4 CIDR into its network address, netmask, broadcast, total and usable host counts and the first and last usable host, with the address as a 32-bit integer and back.
Compare two semantic versions the way semver actually orders them, sort a list, and see what a caret or tilde range resolves to.
Principal, rate, years and a monthly deposit drawn as a real growth curve, with the year-by-year split of interest against principal.
