Text & documents
Encoder/DecoderURL, Base64, HTML
Text convertercamelCase, snake_case...
Text DiffCompare two texts
LaTeXPreview mathematical formulas
MarkdownReal-time preview
MermaidDiagrams as code
DiagramsVisio-style visual editor, Mermaid import
String escaperJS, JSON, SQL, Regex, HTML, URL
Unicode / ASCIICharacter information
Numbers & maths
CalculatorExpressions, calculation sheet and plots
StatisticsCalculator, distributions, simulators
Physics SimulatorPendulum, energy, integrators
Base converterBase 2 to 64
Unit systembits, bytes, SI, IEC
Subnet / CIDRNetwork calculator
Timestamp and datesUnix, time zones, formats
Date calculatorDays between dates, exact age, day of the week
Data & formats
Format converterJSON, YAML, Properties, ENV, CSV
JSON FormatterFormat and validate JSON
Regex TesterRegular expressions
JSON DiffStructurally compare two JSONs
Code formatterSQL, CSS, HTML, JavaScript
DB StudioVisual Postgres database in the browser
SQL LabValidate, run and optimize SQL with real Postgres
Giant file viewerOpen huge CSV/logs without loading them
Visual ETL flowTransform data by chaining nodes
Log analyzerMake sense of a log: traces, patterns and AI reduction
Knowledge graphRDF, SPARQL and ontologies
Atoms and chemistryPeriodic table, orbitals and valence shell
Security
Text anonymizerRedact PII and secrets (reversible)
JWT InspectorDecode JWT tokens
Auth flowsBasic, JWT and OAuth2 step by step
Hash generatorSHA-256, SHA-384, SHA-512
Password & UUID generatorPasswords and UUIDs
Development & DevOps
CronGenerator and validator
Docker → ComposeConvert docker run to Compose
Skaffold multi-configDependency graph and requires validation
Linux: permissions and userschmod, chown, useradd and groups
URLParse and build URLs
Random dataNames, emails, IPs, UUIDs...
ElectronicsOhm's law, series/parallel resistors
From the transistor to the chipFrom a cell's noise margin to the clock: SRAM, read path, IR drop, standard cell and setup/hold
Logic GatesAND, OR, NOT and more gate simulator
Architecture SimulatorDiagram CI/CD, cloud, AI/MCP and simulate load
Quantum simulatorQubits, gates, superposition and entanglement
HammingError detection
Nginx/Apache SPA configGenerate config to serve a SPA
SemverSemantic version ranges
CORS ExplainerAnalyse your server's CORS headers
API workbenchSend requests, convert collections and compare versions
Cert inspectorAnalyse X.509 certificates in PEM format
Rate LimiterSimulate Token Bucket and Fixed Window
Assembly simulatorSimplified MIPS ISA · step-by-step · registers & memory
Context ForgePack and shield your project for AI
Visual terminalClick and get the command: Linux, macOS, PowerShell
Artificial Intelligence
LLM costsSimulate monthly spend
AgentsSpec, permissions, verification and evals
Local AI cameraDetects objects and alerts, without uploading anything
Local speech transcriptionAudio to text without uploading it, and measure the error
Does this text say anything?How much you can cut without losing a single idea
EmbeddingsSimilarity, 2D map and RAG
Local AIChat, summarization, translation & sentiment in-browser
TokenizerVisualize tokens, compare models, estimate costs
Probability for AIDistributions, softmax, Bayes and entropy
Gradient descentSGD, Momentum, RMSProp, Adam
Neural networkTrain an MLP and watch the boundary form
Mini-LLMTrain a language model with your text
Dimensionality reducerPCA, t-SNE and UMAP, live
Confusion matrix & ROCThreshold, precision/recall, ROC/AUC, PR
Clustering (k-means, DBSCAN)Discover groups without labels
Attention visualizerWhat each word looks at in a transformer
Convolution & CNN filtersImage filters and feature maps
Decision treeDecision regions + the tree
DiffusionThe noise behind Stable Diffusion
Regression & MLELeast squares, overfitting, ridge
Markov chainsStates, stationary distribution and text
Hypothesis testingp-values, t-test, χ², ANOVA and power
OCR — Image to textExtract text from images, 100% local
Finance
InflationYear-by-year purchasing power erosion
Economy simulatorFirms, prices, monopolies and limited resources
Compound interestCapital + contributions + compound interest
Mortgage / loanMonthly payment and French amortization schedule
Split expensesWho owes whom and how much
Health & Wellness
BMI & healthBMI, ideal weight, BMR and sleep cycles
Productivity
PomodoroTime-block work technique
StopwatchWith laps, stages and history
Games & Entertainment
DiceTables with numeric and symbolic dice
ScorekeeperPoints per player with game timer
Random pickerPick a random item from a list
Name generatorReal, fantasy, sci-fi, Norse names
Multimedia & design
Color HEX/RGB/HSLColor converter
QR CodeGenerate QR codes
ImagesResize, convert, Base64
PDF ToolsMerge, extract, watermark
ChartsVisualize data with charts
WCAG ContrastWCAG AA/AAA contrast ratio
Business
Meeting costHow much does each meeting really cost?
SLA / UptimeAvailability percentage ↔ downtime
Break-evenCost and revenue break-even point
Burn rate / RunwayHow long does your cash last?
A/B TestStatistical significance of experiments
DORA MetricsClassify your team by DevOps metrics
UTM BuilderBuild and decode URLs with UTM parameters
Spaces and resourcesTables, racks, beds or desks: share them out and see if they hold up
Project workshopSimulate your Makefile: what it rebuilds and why
Project X-rayWhat Spring will do with your code, and which dependencies are stale
Test auditorOf these passing tests, which ones cannot fail?
Manuscript auditorWhich numbers in your paper or thesis don't add up
How to use
What it is and what it's for

CORS (Cross-Origin Resource Sharing) is the mechanism by which a browser decides whether a web page may read the response of an API hosted on another origin (another domain, port or protocol). Without the right CORS headers, the browser blocks the read for security. This tool simulates that browser check: it explains, without making any real request and all in your browser, whether your server would allow the call and why.

What to enter

Fill in three things:

• Origin (browser) — the URL of the app making the request (e.g. https://myapp.com). It is the value the browser would send in the Origin header.
• HTTP method — GET, POST, PUT, DELETE… The method decides whether a preflight is needed.
• Server response headers — paste the headers your API returns, one per line, in the format Name: value (e.g. Access-Control-Allow-Origin: *). The analysis updates on its own as you type.

Simple request vs preflight

There are two kinds of cross-origin request:

• Simple request — with GET, POST or HEAD and basic headers, the browser sends it directly and then checks whether the response carries Access-Control-Allow-Origin.
• With preflight — with methods like PUT, PATCH or DELETE (or custom headers), the browser first sends a preliminary OPTIONS request to ask permission. The tool automatically flags when your method requires a preflight.

The preflight (OPTIONS) in detail

The preflight is an OPTIONS request the browser sends before the real one to ask “will you let me do this?”. In this tool it fires with the methods PUT, PATCH, DELETE and OPTIONS. When the notice appears, your server must respond to that OPTIONS with the right CORS headers (allowed origin, methods and headers); otherwise the browser cancels the real request even if your API works. Adding Access-Control-Max-Age avoids repeating the preflight on every call.

Access-Control-Allow-Origin

It is the essential header: it states which origin may read the response.

• * — allows any origin, but does not work with credentials (cookies).
• A specific origin, e.g. https://myapp.com — only that origin, and it must match exactly your Origin (protocol + domain + port).

If this header is missing, or its value matches neither * nor your origin, the request is blocked.

Access-Control-Allow-Methods

Lists the HTTP methods the server accepts from another origin, comma-separated (e.g. GET, POST, PUT, DELETE). It matters mostly in the preflight. If you provide this header but it does not include your method, the tool flags it as a problem and blocks the request. If you omit it, the method is not checked.

Access-Control-Allow-Headers

Lists which request headers the client may send (e.g. Content-Type, Authorization). The browser requires it in the preflight when your request sends non-standard headers. If your app sends Authorization and it does not appear here, the browser will block the call.

Access-Control-Allow-Credentials

With the value true it allows sending cookies and credentials on the cross-origin request.

• Heads up, important gotcha: credentials are incompatible with Access-Control-Allow-Origin: *. If you use credentials, the origin must be specific (e.g. https://myapp.com), never *. Combining the two makes the browser reject the response.

Access-Control-Max-Age and Vary

Access-Control-Max-Age states how many seconds the browser may cache the preflight response (e.g. 86400 = 24 h), so it doesn't repeat the OPTIONS on every call. The tool includes it in the suggested headers when your method needs a preflight. Remember to also add Vary: Origin on your server when you return a specific origin, so caches don't mix responses from different origins.

How to read the result

After the analysis you will see:

• A banner, green (allowed) or red (blocked), with the exact reason: Access-Control-Allow-Origin is missing, the origin doesn't match, or the method isn't allowed.
• CORS headers found — each detected header with its value and an explanation.
• Problems detected — what prevents the request.
• It works, but it is a security risk — what the browser DOES let through and you should not want, such as accepting the null origin with credentials.
• Your browser allows it, but do not rely on it — what Chrome accepts today and the spec does not guarantee.
• Suggested headers — a block ready to copy into your server configuration.

CORS ExplainerAnalyse your server's CORS headers
CORS ExplainerAnalyse and explain your server's CORS headers
URL of the app making the request

Tick it if your code uses <code>credentials: 'include'</code> (or <code>withCredentials</code>). It changes the rules: the origin can no longer be <code>*</code>, wildcards stop working, and the server must answer <code>Access-Control-Allow-Credentials: true</code>.

The REQUEST ones, not the response ones. They decide whether the browser sends an OPTIONS first, and they are what "Access-Control-Allow-Headers" has to cover.

CORS permitido correctamente
The browser will first send an OPTIONS request (preflight), because of the Content-Type application/json. Your server has to answer THAT OPTIONS too, not only the real request.

CORS headers found

Access-Control-Allow-Originhttps://myapp.comPermite solo el origen: https://myapp.com
Access-Control-Allow-MethodsPOSTMétodos permitidos: POST
Access-Control-Allow-HeadersContent-TypeCabeceras permitidas en la petición: Content-Type

Suggested headers for your server

Access-Control-Allow-Origin: https://myapp.com
Vary: Origin
Access-Control-Allow-Methods: POST
Access-Control-Allow-Headers: Content-Type
Access-Control-Max-Age: 86400
This is decided from the headers you paste, without touching the network - which is why it also works for a local or private API. If you want to fire the request FOR REAL and see whether your server answered at all, there is the API workbench.