$loading...
Free online utilities for encoding, decoding, hashing, and inspecting tokens. Everything runs 100% client-side — no data leaves your browser.
Paste anything and we'll detect the format and route you to the right tool.
11 encodings with auto-detect magic mode, bulk processing, and output-to-input chaining. Base64, URL, Hex, HTML, Unicode, Octal, Binary, ROT13, and more.
Hash text or files with MD5, SHA-1/256/384/512. HMAC support, hash comparison tool, and copy-all. Drag-and-drop file hashing.
Decode, build, verify, and attack JWTs. Signature verification, none-algorithm attacks, JWKS injection templates, and claim tooltips.
286 operations across encoding, hashing, crypto, and analysis. Shareable recipes, presets, and intermediate results. A free CyberChef alternative.
Live regex testing with match highlighting, capture groups, and 28 pentest patterns for extracting emails, IPs, AWS keys, JWTs, and more. Export as JS, Python, or grep.
Analyze HTTP response headers for security issues. Get an A+ to F security grade, CSP evaluation, and detailed recommendations for 16 security headers.
Generate secure passwords and passphrases, build wordlists with mutations (leetspeak, case, suffixes), and analyze password strength with crack time estimates.
Subnet calculator, IP format converter (decimal, hex, octal, binary), SSRF bypass generator, subnet splitter, and range enumerator for network pentesting.
Convert Unix timestamps to human-readable dates and back. JWT timestamp decoder, 10 format outputs, time math, batch conversion, and live clock.
Score vulnerabilities with all 8 CVSS 3.1 base metrics. Parse vector strings, compare scores side-by-side, and export as markdown for reports.
Deobfuscate JavaScript with eval unpacking, string array recovery, fromCharCode decoding, hex/unicode unescape, and dead code removal.
Generate msfvenom commands with correct syntax for common payloads. Select platform, architecture, format, encoder, and copy ready-to-run commands.
Transform payloads to bypass Web Application Firewalls. Apply encoding tricks, case manipulation, comment injection, and double-encoding techniques.
Compare two texts side-by-side or inline with character-level diff highlighting. Useful for comparing HTTP responses, configs, and payload outputs.
Calculate MurmurHash3 favicon hashes for Shodan searches. Upload or fetch favicons, identify services from 35+ known hashes, and generate Shodan dorks.
Analyze Content Security Policy headers for misconfigurations. Detect unsafe-inline, unsafe-eval, JSONP bypasses, and missing directives with severity ratings.
Generate Google, Shodan, GitHub, and Censys dorks for OSINT and pentesting. 55+ templates for finding sensitive files, admin panels, exposed services, and leaked secrets.
Parse raw HTTP requests and responses. Auto-extract tokens, cookies, parameters, and injection points. Security header grading, code generation (curl, Python, JS, PowerShell), and request comparison.
Input any XSS, SQLi, command injection, path traversal, SSTI, XXE, or SSRF payload and auto-generate 50+ WAF bypass mutations. Encoding, obfuscation, alternative syntax, and protocol tricks.
Check subdomains against 40+ service fingerprints for CNAME-based takeover vulnerabilities. Batch check, DNS recon guide, step-by-step claim instructions per service, and subdomain wordlist generator.
Introspection queries with bypass techniques, attack payloads (batching, injection, IDOR, DoS, CSRF via GET), field fuzzer for hidden sensitive fields, and security header builder for GraphQL endpoints.
Test OAuth 2.0 and OIDC implementations for redirect_uri bypass (11 variants), PKCE downgrade, missing state CSRF, token leakage, implicit flow issues, and OIDC-specific attacks. Includes CSRF PoC generator and JWT token analyzer.
Document vulnerabilities and build pentest reports entirely in your browser. Track severity, CVSS scores, HTTP requests, steps to reproduce, impact, and recommendations. Export as Markdown report, JSON, or CSV.
Generate a custom OWASP Top 10 test checklist based on your app's tech stack, auth method, and architecture. Covers all 10 categories with severity ratings and links to relevant generators. Export as Markdown or JSON.
Paste a blocked payload, describe the WAF response, and get AI-generated bypass mutations. Also includes instant client-side quick mutations. Supports XSS, SQLi, command injection, SSTI, path traversal, XXE, and SSRF.
Build and visualize multi-step attack chains. Combine techniques like recon, injection, privilege escalation, and exfiltration into documented attack paths. Export as Markdown or JSON for pentest reports.
Scan any URL for missing security headers. Get an instant A+ to F grade for HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more. Shareable results with fix recommendations.
Identify the template engine from observed behavior. Get RCE payloads for Jinja2, Twig, FreeMarker, Velocity, Mako, ERB, Handlebars, Smarty, Pebble, and Tornado. Includes filter bypass techniques. 100% client-side.
Convert shellcode between 11 formats (C, Python, PowerShell, C#, Rust, Go, Ruby, NASM, hex, base64, JS). XOR encode, null-byte elimination, bad character avoidance, AES-CBC encryption, entropy analysis, and decoder stub generation.
Step-by-step SQL injection enumeration. Fingerprint databases, find column counts, enumerate tables/columns, and dump data with copy-ready queries. Supports MySQL, PostgreSQL, MSSQL, Oracle, SQLite. WAF bypass and blind SQLi modes.
Generate smart subdomain wordlists with 200+ common prefixes, environment permutations, cloud patterns, and custom suffixes. Configurable size (100-2000+), de-duplicated, with instant download.
Test any URL for CORS misconfigurations: origin reflection, null origin, subdomain/prefix/suffix matching, wildcard with credentials. Instant A-F grade with exploit code for findings.
Generate unique callback IDs and copy-ready payloads for Burp Collaborator, interactsh, webhook.site, and custom domains. DNS, HTTP, XXE, SSRF, XSS, RCE, and blind SQLi callback templates.
Query A, AAAA, MX, TXT, CNAME, NS, SOA, CAA records via Cloudflare DoH. Security insights for SPF/DMARC/DKIM, missing CAA detection, and export.
Search crt.sh for SSL certificates and subdomains. Deduplicate, sort, filter, extract unique subdomains, export as CSV/JSON/TXT for recon tools.
Visual editor for Nuclei YAML templates. Configure matchers, extractors, HTTP requests, and metadata. 15+ presets for common vulnerability checks. Download as .yaml.
Generate WAF bypass payloads targeting Cloudflare, AWS WAF, ModSecurity, Akamai, Imperva, F5, Sucuri, Azure. 8 payload categories with confidence ratings.
Paste any unknown data blob — JWT, hash, encoded string, IP, shellcode, key — and auto-identify what it is with confidence scores. Route to the right tool instantly.