Text & documents
Encoder/DecoderURL, Base64, HTML
Text convertercamelCase, snake_case...
Text DiffCompare two texts
LaTeXPreview mathematical formulas
MarkdownReal-time preview
MermaidDiagrams as code
DiagramsVisio-style visual editor, Mermaid import
String escaperJS, JSON, SQL, Regex, HTML, URL
Unicode / ASCIICharacter information
Numbers & maths
CalculatorExpressions, calculation sheet and plots
StatisticsCalculator, distributions, simulators
Physics SimulatorPendulum, energy, integrators
Base converterBase 2 to 64
Unit systembits, bytes, SI, IEC
Subnet / CIDRNetwork calculator
Timestamp and datesUnix, time zones, formats
Date calculatorDays between dates, exact age, day of the week
Data & formats
Format converterJSON, YAML, Properties, ENV, CSV
JSON FormatterFormat and validate JSON
Regex TesterRegular expressions
JSON DiffStructurally compare two JSONs
Code formatterSQL, CSS, HTML, JavaScript
DB StudioVisual Postgres database in the browser
SQL LabValidate, run and optimize SQL with real Postgres
Giant file viewerOpen huge CSV/logs without loading them
Visual ETL flowTransform data by chaining nodes
Log analyzerMake sense of a log: traces, patterns and AI reduction
Knowledge graphRDF, SPARQL and ontologies
Atoms and chemistryPeriodic table, orbitals and valence shell
Security
Text anonymizerRedact PII and secrets (reversible)
JWT InspectorDecode JWT tokens
Auth flowsBasic, JWT and OAuth2 step by step
Hash generatorSHA-256, SHA-384, SHA-512
Password & UUID generatorPasswords and UUIDs
Hidden text (X-ray)Invisibles, hidden instructions and fake letters
Agent file auditorCLAUDE.md, skills, MCP, hooks and permissions
Can I paste this?Secrets and cookies in a text, log or HAR before sharing it
GitHub Actions auditorCommand injection, unsafe pull_request_target, unpinned actions
Headers and CSP auditorCSP, HSTS, cookies (Secure/HttpOnly/SameSite) from a pasted curl -I
MCP catalogue auditorContext cost, annotations, official registry compliance
Access LabIdentity, RBAC and governance — vendor-neutral, multi-cloud
SAML decoder and auditorSignature, expiry, audience, and the XML Signature Wrapping attack
Email headers and DMARC auditorSPF, DKIM, DMARC — from an email’s headers or its DNS records
Side-channel labAttack a secret by timing and a key by power analysis
Authentication flow labAttack a real JWT (alg=none, RS256→HS256 confusion) on an interactive canvas
Defense in depthThe 7 security layers, and what Jarroba already covers with a real attack
Development & DevOps
CronGenerator and validator
Docker → ComposeConvert docker run to Compose
Skaffold multi-configDependency graph and requires validation
Linux: permissions and userschmod, chown, useradd and groups
URLParse and build URLs
Random dataNames, emails, IPs, UUIDs...
ElectronicsOhm's law, series/parallel resistors
From the transistor to the chipFrom a cell's noise margin to the clock: SRAM, read path, IR drop, standard cell and setup/hold
Logic GatesAND, OR, NOT and more gate simulator
Architecture SimulatorDiagram CI/CD, cloud, AI/MCP and simulate load
Quantum simulatorQubits, gates, superposition and entanglement
HammingError detection
Nginx/Apache SPA configGenerate config to serve a SPA
SemverSemantic version ranges
CORS ExplainerAnalyse your server's CORS headers
API workbenchSend requests, convert collections and compare versions
Cert inspectorAnalyse X.509 certificates in PEM format
Rate LimiterSimulate Token Bucket and Fixed Window
Assembly simulatorSimplified MIPS ISA · step-by-step · registers & memory
Context ForgePack and shield your project for AI
Visual terminalClick and get the command: Linux, macOS, PowerShell
Project workshopSimulate your Makefile: what it rebuilds and why
Project X-rayWhat Spring will do with your code, and which dependencies are stale
Spring DoctorField injection, and the rest of the Spring Boot conventions, file by file
Test auditorOf these passing tests, which ones cannot fail?
Manuscript auditorWhich numbers in your paper or thesis don't add up
Artificial Intelligence
LLM costsSimulate monthly spend
AgentsSpec, permissions, verification and evals
Local AI cameraDetects objects and alerts, without uploading anything
Local speech transcriptionAudio to text without uploading it, and measure the error
Does this text say anything?How much you can cut without losing a single idea
EmbeddingsSimilarity, 2D map and RAG
Local AIChat, summarization, translation & sentiment in-browser
TokenizerVisualize tokens, compare models, estimate costs
Probability for AIDistributions, softmax, Bayes and entropy
Gradient descentSGD, Momentum, RMSProp, Adam
Neural networkTrain an MLP and watch the boundary form
Mini-LLMTrain a language model with your text
Dimensionality reducerPCA, t-SNE and UMAP, live
Confusion matrix & ROCThreshold, precision/recall, ROC/AUC, PR
Clustering (k-means, DBSCAN)Discover groups without labels
Attention visualizerWhat each word looks at in a transformer
Convolution & CNN filtersImage filters and feature maps
Decision treeDecision regions + the tree
DiffusionThe noise behind Stable Diffusion
Regression & MLELeast squares, overfitting, ridge
Markov chainsStates, stationary distribution and text
Hypothesis testingp-values, t-test, χ², ANOVA and power
OCR — Image to textExtract text from images, 100% local
Finance
InflationYear-by-year purchasing power erosion
Economy simulatorFirms, prices, monopolies and limited resources
Compound interestCapital + contributions + compound interest
Mortgage / loanMonthly payment and French amortization schedule
Split expensesWho owes whom and how much
Health & Wellness
BMI & healthBMI, ideal weight, BMR and sleep cycles
Productivity
PomodoroTime-block work technique
StopwatchWith laps, stages and history
Games & Entertainment
DiceTables with numeric and symbolic dice
ScorekeeperPoints per player with game timer
Random pickerPick a random item from a list
Name generatorReal, fantasy, sci-fi, Norse names
Multimedia & design
Color HEX/RGB/HSLColor converter
QR CodeGenerate QR codes
ImagesResize, convert, Base64
PDF ToolsMerge, extract, watermark
ChartsVisualize data with charts
WCAG ContrastWCAG AA/AAA contrast ratio
Business
Meeting costHow much does each meeting really cost?
SLA / UptimeAvailability percentage ↔ downtime
Break-evenCost and revenue break-even point
Burn rate / RunwayHow long does your cash last?
A/B TestStatistical significance of experiments
DORA MetricsClassify your team by DevOps metrics
UTM BuilderBuild and decode URLs with UTM parameters
Spaces and resourcesTables, racks, beds or desks: share them out and see if they hold up
How to use
What it is

Paste the output of curl -I https://your-site, or the response headers the browser's network tools copy, and it tells you what's missing or wrong: CSP, HSTS, cookie flags (Secure, HttpOnly, SameSite) and the rest of the usual security headers.

To generate your own headers

This tool AUDITS what a site is already sending. If you want the nginx or Apache configuration for your own project, use the SPA configuration tool.

How does it know if it's HTTPS?

Response headers don't repeat the request's scheme. If you paste the command line (curl -I https://…) or the bare URL, it's detected from there; with no clue at all, HTTPS is assumed (the most common real case) — and you can correct it by hand with the toggle.

Headers and CSP auditorCSP, HSTS, cookies (Secure/HttpOnly/SameSite) from a pasted curl -I
Headers and CSP auditorPaste the output of curl -I: CSP, HSTS, cookies and the rest of the security headers. 100% in your browser
Not sent anywhere, not saved: analyzed in your browser