Hands-on utilities

Small security tools, all in your browser.

Five quick utilities for day-to-day security work. Everything runs on your device, nothing is sent anywhere. Use non-sensitive sample data only.

Subnet calculator

Work out the network, mask, usable range and host count for an IPv4 CIDR block.

CIDR block

JWT inspector

Decode the header and payload of a compact JWT. The signature is never verified, so decoding does not authenticate any claim. Paste a non-sensitive sample token only.

JWT (three dot-separated parts)

Security header analyzer

Paste a raw HTTP response (headers) and see which common security headers are present, need review, or were not observed. Presence alone does not prove an effective policy.

Response headers

Access-control demonstration

A synthetic example of broken object-level authorization (BOLA). Pick an actor, an object and whether object-level authorization is enforced, and see the decision and why. Synthetic data only; this calls no real system.

Actor

Object

Authorization model

Risk matrix (5 by 5)

An illustrative likelihood by impact prioritization. Not CVSS, an actuarial estimate, or a statement of organizational risk acceptance.

Likelihood (1 to 5)

Impact (1 to 5)

Private by design. These tools run entirely in your browser. No account, no server, no tracking. Decoding or analyzing a value here does not validate, authenticate or secure it, and none of these utilities replace a proper security test.