Dev Tools

Full SSL/TLS certificate analysis: expiry, chain validation, cipher suites, protocol versions, and vulnerability scan.

Scan any URL for missing or misconfigured security headers: CSP, HSTS, X-Frame-Options, and 10 more.

Test any API endpoint's CORS configuration for misconfigurations that could expose your users to cross-origin attacks.

The most comprehensive web security header audit tool: CSP analyzer, HSTS preload check, and full OWASP compliance report.

Scan any domain or IP for open ports, running services, and network exposure risks. Developer and sysadmin friendly.

Paste a JSON Web Token to decode its header and payload, check expiry claims, and flag critical security issues like alg:none — all locally in your browser.

Type a pattern and a test string to see every match highlighted instantly, list capture groups, and get a plain-English breakdown of the tokens you used.

Enter a 5-field cron expression to see a human-readable schedule description and the next 5 upcoming run times, computed from right now.

Encode and decode Base64, URL, HTML entities, and Hex in one tool — fully UTF-8 safe, so emoji and accented characters round-trip perfectly.

Paste a commit message to validate its type, scope, description style, and breaking-change markers against the Conventional Commits spec, with auto-corrected suggestions.

Paste a system prompt and sample user input to scan for known prompt-injection patterns and get a hardening score with specific improvement suggestions.

Paste code, config, or .env contents to scan for AWS keys, Stripe/GitHub/Slack tokens, private keys, JWTs, and hardcoded passwords, with line numbers and severity.

Paste your payload, secret, and received signature to compute the expected HMAC-SHA256 signature client-side and instantly see a match or mismatch.

Paste your docker-compose.yml to check for missing image/build keys, malformed ports and volumes, duplicate services, and indentation issues.

Enter your current version and the types of changes made — the tool applies correct SemVer rules and generates a ready-to-fill Keep a Changelog entry.

Paste conflicted file contents and get every conflict block parsed, shown side-by-side, and resolved with Keep Yours / Keep Theirs / Keep Both.

Enter CSS selectors and get the real spec-accurate specificity tuple for each, plus a ranked explanation of which rule applies when they collide.

Generate a step-by-step feature flag rollout schedule and test whether a specific user ID falls inside your rollout bucket, with a monotonicity guarantee.

Toggle real Cache-Control directives and get the correctly-formatted header string live, with a plain-English explanation of what it means for browsers and CDNs.

Enter observed CPU and memory usage and get suggested Kubernetes requests/limits plus a ready-to-paste YAML block, following common practice ratios.

Paste a Dockerfile and get flagged issues — unpinned base images, missing USER instructions, broad COPY patterns, and unclean package caches — each with the exact line number.

Paste HTTP response headers and instantly see GitHub-style, IETF-draft, and Retry-After rate-limit conventions parsed, with a human-readable resets-in countdown.

Paste a JSON Schema and a JSON payload and get a real pass/fail validation, with specific field-level errors on failure — not just a formatter.

Paste a regex pattern and get an accurate, token-by-token plain-English walkthrough of what it matches — anchors, character classes, quantifiers, groups, and alternation explained in order.

Generate cryptographically random UUID v4 and spec-correct, monotonic ULIDs, or paste one in to validate its format and decode its embedded timestamp.

Paste raw JSON to auto-format, validate syntax, collapse/expand nodes, and copy clean output. Essential for any developer.

Test regex patterns against sample text with live match highlighting, group capture display, and plain-English explanations.

Paste an MCP server manifest and get a real pattern-based audit for missing auth, wildcard scopes, arbitrary command execution tools, and hardcoded credentials.

Actually scans pasted code, logs, or config text for real API key formats — OpenAI, Anthropic, AWS, GitHub, Stripe, Slack, Google — via genuine regex pattern matching, not a checklist.

Paste a git diff or log -p output and get a real scan for secrets — including ones that were later 'removed' in a subsequent commit but remain fully recoverable in history.

Paste your package.json or a dependency list and flag common copyleft-risk (GPL/AGPL-family) patterns, adjusted for whether you're shipping closed-source, SaaS, or open-source.

Actually parses a GraphQL query's brace nesting and pagination arguments to calculate real nesting depth and estimated node fan-out — a genuine complexity calculation, not a checklist.

A weighted 12-point checklist for WebSocket endpoints — Origin validation, connection-level authentication, message rate limiting, and the resource-exhaustion risks unique to persistent connections.

Paste OAuth scopes an app is requesting and get a plain-language risk breakdown — full mailbox access vs. read-only, narrow file access vs. your entire cloud drive.

Actually parses terraform plan output into a plain-English create/update/destroy summary, and flags security group rules open to 0.0.0.0/0 — real parsing, not a reformatting.

A weighted 12-point checklist to score your API versioning strategy before a breaking change ships — covering deprecation policy, client visibility, and a shared definition of 'breaking.'

Calculate exactly how many users a feature flag rollout would expose, how many would be affected if it has a bug, and the estimated cost during a realistic detection window — with a full rollout-percentage comparison table.

Paste a git diff or PR patch and get a real scan for hardcoded secrets, SQL injection and eval() patterns added, plus auth checks and test cases removed — the specific verification bottleneck AI-generated code has created.

A 10-point weighted checklist scoring how well your team's AI-assisted development practice actually catches the specific risks 'vibe coding' introduces — from unreviewed diffs to disabled auth checks to overscoped agent permissions.

A 10-point weighted checklist scoring the specific day-to-day habits — pasting into chat, .env file exposure, key scoping, agent context access — behind the nearly 2x higher credential-exposure rate among developers who use AI coding tools.

Pick your AI coding agent's actual task and its current shell, network, and credential access — get a real blast-radius score and the specific permissions to narrow, computed against what that task type genuinely requires.

Enter your actual request volume, average tokens per request, blended per-token pricing, current rate limit, and peak traffic multiplier — get a real monthly/annual cost projection plus a genuine check of whether your rate limit will throttle requests at estimated peak load.