Visual digital circuit simulator with AND, OR, NOT, NAND, NOR, XOR and XNOR gates. Connect nodes, toggle inputs and watch signal propagation in real time.

Open a Java/Spring project from your disk and see what the framework will do with it: the package map with its cycles, and the pom.xml dependencies with the versions that are known and the ones that are not. None of your code leaves the browser; checking whether a version is stale or vulnerable is optional, and shows you literally what would be sent.

Train a decision tree (CART) on 2D data and see how it classifies with yes/no questions: the "staircase" decision regions and the tree drawn node by node. Adjust the depth and watch overfitting; choose Gini or entropy. The interpretable model behind random forests and XGBoost.

Visually understand p-values, the rejection region and the α level; run t-test, χ², ANOVA and analyze power (type I/II error). To validate whether a model improvement is real or just noise.

Build a quantum circuit with qubits and gates (H, X, Y, Z, CNOT, Toffoli...) and watch superposition, entanglement, the Bloch spheres and measurement live. Bell, GHZ and Grover demos.

Analyse X.509 certificates in PEM format: subject, issuer, validity dates, SANs, key type and days remaining with a colour indicator.

Walk a Markov chain and watch the visit distribution converge to the stationary one; or train a Markov text generator. The basis of MDP, PageRank, MCMC and classic text generation. It teaches chain theory; to train a language model with your text see Mini-LLM.

Pack a whole project (or a snippet) into a single text ready to paste into an AI: removes comments, minimizes and shields secrets, IP and sensitive data. 100% in the browser — your code is never uploaded to any server.

Visual statistics playground for AI: interactive distributions (normal, binomial, Poisson…), softmax and temperature, Bayes and entropy. Tweak parameters and watch the curves, samples and loss live.

Turn audio into text with Whisper running in your browser: open a file or record from the microphone and get the transcript with timestamps, ready to export as TXT, SRT, VTT or CSV. Your audio is never uploaded anywhere, and there is a network-request counter in plain sight so you can check it. It also brings the metric a transcript is really judged by — the word error rate — so you can measure it on your own audio and compare two models word by word.

Paste an email’s headers ("Show original" in Gmail, "View source" in Outlook, an .eml) and it tells you what SPF, DKIM, and DMARC say about it, plus social-engineering indicators (a Reply-To pointing to a different domain). It also audits pasted SPF/DMARC/DKIM DNS records (the output of dig, or the value as-is): SPF with +all or too many lookups, DMARC without enforcement or reporting, weak or revoked DKIM keys. Verified against RFC 7208 (SPF), RFC 7489 (DMARC), RFC 6376 and RFC 8301 (DKIM). 100% in the browser.

Transform data by chaining nodes: filter, derive columns, clean text and select — all in one pass, 100% in your browser. Per-node preview and output to CSV or the Viewer.

Stopwatch with laps and history. Hundredths of a second precision and copy results button.

Paste a SAMLResponse/SAMLRequest — the full URL of a Redirect binding, the base64 value of a POST binding, or the already-decoded XML — and it decodes and audits it: presence and algorithm of the signature (rejects SHA-1), expiry, audience, encryption, and the classic XML Signature Wrapping (XSW) attack pattern, where the signature covers a different element from the one actually processed. Verified against the OWASP SAML Security Cheat Sheet. 100% in your browser.

Paste your manifests and it works out which pod can connect to which according to their NetworkPolicies, with the port, and why: which policy isolates each side and which rule lets the traffic through. It catches the classic traps (namespaceSelector and podSelector in separate elements, a default-deny that leaves a pod with no way in) and what leads nowhere: Services without pods, ConfigMaps or Secrets that are missing. Plus each workload’s Pod Security level and which pods its namespace would reject, and validation against the official schema of your Kubernetes version: typos in fields, wrong types and retired APIs. Checked against netpol-analyzer, the official admission controller and kubeconform. 100% in the browser.

Simulate your Makefile in the browser: build a pretend project with its timestamps, touch a file and see exactly what make would rebuild, in what order and WHY — with the recipe already expanded. It warns about what actually bites: the tab character, the cd that does not survive into the next line, the dollar sign make eats, and the missing dependency that only blows up under -j. It runs nothing.

Compares two texts line by line and shows differences with colour highlighting (added/removed).

See the diffusion process behind generative AIs like Stable Diffusion: a structured point cloud dissolves into Gaussian noise step by step, and the reverse process rebuilds it.

Generate secure passwords with configurable options and cryptographically secure UUIDs v4.

Generate SHA-256, SHA-384 and SHA-512 hashes directly in the browser using Web Crypto API.

Visualize how LLMs split text into tokens, compare costs across models (GPT-4, Claude, Gemini, Llama) and estimate how much of the context window your text consumes.

Drop your project or paste a workflow from .github/workflows/: looks for hidden instructions in a PR title that slip into a shell step, the pull_request_target + fork-checkout pattern (someone else's code with the base repo's secrets), third-party actions not pinned to a commit, and secrets written by hand. Includes the real tj-actions/changed-files example. 100% in the browser.

Format, minify and validate JSON with error highlighting and key counter.

Calculate the real cost of a meeting (one-off and annual if recurring) based on attendees, hourly rate and duration.

Payment and amortisation schedule; compare offers by their real APRC (Directive 2014/17/EU) and find out whether the discount is worth it; and see whether early repayment suits you better by lowering the payment or the term.

Convert a Unix timestamp (s/ms/µs/ns) or any date to every format (ISO, RFC, syslog, Excel, FILETIME…), with time zones, DST and local-vs-UTC detection.

Calculate BMI, ideal weight, basal metabolic rate (Harris-Benedict) and recommended bedtimes.

chmod (octal/symbolic permissions with special bits), chown and a users & groups command builder (useradd, usermod, groupadd) with warnings and a per-flag explanation.

Generate and validate cron expressions with a visual builder, text humanisation and next execution times.

A simulated file explorer that, instead of moving files, shows you the command that would do it: double-click a folder and the «cd» appears, right-click to copy, rename or delete, and the script builds up below ready to copy. The same gesture in Linux, macOS, PowerShell and CMD, with names properly quoted and real errors. It runs nothing and never touches your disk.

A real Postgres database in your browser: write SQL, see tables and relationships as a diagram, and query sample data. No server.

Visual Visio-style diagram editor: drag shapes, connect and edit them. Import and export Mermaid.

Train a character-level language model on YOUR text and generate new text in that style. Two modes: by counting (n-gram, instant) or with a neural network trained by gradient descent. Tune the temperature and watch the next-character probability, just like a real LLM. The n-gram mode is a character-level Markov; for chain theory (stationary, PageRank) see Markov chains.

See how models learn: a ball rolls down a loss surface with SGD, Momentum, RMSProp or Adam. Change the learning rate and momentum and watch the animated trajectory; try local minima and Rosenbrock.

Three things in one: expressions with 2D and 3D plots, a multi-line sheet with variables and units, and an equation and system solver that shows the steps.

Extract the text from an image (photo, screenshot, scan) right in your browser, without uploading anything to any server. Upload, drag or paste the image and get the text with each word's box colored by its confidence. Pick the language, fix the uncertain words and copy or download it. Tesseract engine downloaded from the CDN and cached (offline afterwards).

Wheel, a public draw anyone can verify (SHA-256 fingerprint and seed), Secret Santa with private links, sharing out items and teams.

Statistics calculator (descriptives, charts), interactive distributions and probability simulators to understand data and uncertainty.

From a regular expression to its NFA (Thompson), then to the DFA (subset construction) and the minimal DFA, plus the CYK algorithm for grammars: step by step, with the ε-closure and the table as it fills in, and the textbook examples.

Decode, verify and sign JWT tokens (header, payload, expiration, algorithms). It is the token inspector; to see the full authentication flow (OAuth2/Bearer) see Auth flows.

Merge, extract, reorder and rotate pages while seeing each one, and turn images into PDF and pages into images. Without uploading your documents to any server.

Create diagrams (flowchart, sequence, ER, Gantt) by writing Mermaid code with real-time preview.

Paste a log or open a file and actually understand it: it groups exception stack traces as ONE event (not forty lines), mines the patterns that repeat, points at the root cause, reviews your logging hygiene, and shrinks it to a token budget you can paste into an AI. Java, Python, Node, Go, .NET, JSON, logfmt and syslog. 100% in your browser.

Diagram software/hardware architectures (CI/CD, cloud, AI/MCP agents, data flows) with typed components and simulate load in real time: queues, latency, throughput and bottlenecks. No server.

Paste the output of curl -I (or the headers DevTools copies) and it tells you what's missing or wrong: Content-Security-Policy (unsafe-inline, unsafe-eval, wildcards), HSTS (max-age, preload), each cookie's flags (Secure, HttpOnly, SameSite) and the rest of the usual headers. Without over-claiming: what the browser already assumes by default (Referrer-Policy) is marked informational, not a failure. 100% in the browser.

Detects and replaces sensitive data (emails, phones, validated cards, IBAN, national IDs, keys and secrets) with Presidio-style operators: replace, redact, mask, reversible token or hash. Ideal to clean logs or prompts before pasting them into an AI. 100% in the browser.

Analyse and explain in plain language the CORS headers your server sends. Shows what is missing to allow a cross-origin request.

Open a network capture (.pcap or .pcapng) and understand what happens to each connection: retransmissions, duplicate ACKs, zero window, DNS and HTTP, with the reason for every packet and the same rules as Wireshark. With examples and exercises; your capture never leaves the browser.

Model users, groups, scopes and role assignments, then ask «can X do A on R? why?» — with a step-by-step trace: which assignment wins, at what scope, with what inheritance. A NEUTRAL model that already tells Azure RBAC (control and data planes, deny assignments) apart from AWS IAM (SCPs per level, boundaries, resource policies), verified against each provider's official docs. It's not a portal clone: it teaches the model, which doesn't go stale when the UI changes. 100% in the browser.

Calculate days between dates, exact age in years/months/days, day of the week and date operations.

Paste or drop a CSV (also the Spanish Excel one: 1.234,56 and «;») and get a line, bar, area, pie or scatter chart with title, axes and source. A PNG ready for a document.

Load a Spring Boot project from your disk and review it file by file in a mini-IDE: a tree on the left, code with the findings marked on the right. Starts with field injection (@Autowired) versus constructor injection — the most repeated advice in every Spring Boot checklist — with a one-click fix when it is safe to apply. None of your code leaves the browser.

Write SQL against a real Postgres in the browser: schema-aware autocomplete, live validation, warnings and optimization suggestions (indexes, SARGability). No server.

Build an atom by adding and removing protons, neutrons and electrons, and watch how they arrange themselves: a periodic table of all 118 elements, ions and isotopes, electron configuration with its 20 real exceptions, and a folding view that goes from the orbital to the valence band.

Which practices still hold, which have been superseded and since when, with their why, their source and their history. Also for AI agents, over MCP.

Train a real neural network in your browser and watch it learn: pick data (circle, XOR, gaussians, spiral) and an architecture, hit play and see the decision boundary form and the loss drop. Click to have it classify a new point. No server, no downloads.

Sends HTTP requests and explains why they fail: it tells apart "your server is down" from "the browser hid the response", which give the same error. Converts collections between Postman, Bruno, Insomnia, OpenAPI, HAR and curl without uploading your tokens anywhere, generates code in eleven languages, and compares two versions of an API to tell you what breaks.

Really attack a fake secret by timing (Kocher 1996) and a fake key by differential power analysis over AES's real S-box (Kocher, Jaffe, and Jun 1999). Time and power draw are simulated — browsers deliberately degrade the precision of their clocks since Spectre — but the attack algorithm is the real one: byte by byte, and difference of means. Links to /electronics and /chip: the same transistor and the same clock path simulated there are what a real attacker measures. 100% in the browser.

Check which package versions satisfy a semantic version range (^, ~, >=, -) and view the syntax cheatsheet.

Markdown editor with real-time preview in split or preview-only mode.

Transform text between camelCase, snake_case, PascalCase, kebab-case and more.

Simulates a simplified MIPS ISA in the browser. Editor with active-line highlighting, registers, memory, stack and console. Step-by-step or automatic execution with adjustable speed.

Simulate the monthly cost of using different AI models based on your request volume and prompt size.

Turn on your camera and detect objects live with a 10 MB model running in your browser: it warns you when something appears —or when it STOPS being there—, counts appearances and gives you the log as CSV. You can have several rules at once, each with its own object, threshold and zone drawn over the image, all watching the same video. Neither the video nor the detections leave your device, and there is a network-request counter in plain sight so you can check it.

See the attention mechanism inside transformers (BERT, GPT): type a sentence and watch which words each token "looks at", with the token-to-token attention matrix, multiple heads and the causal mask of generative models. Interactive: click a word to see its attention arcs.

Invents names that sound Spanish, Basque, Old Norse, Japanese… with a Markov chain you can look inside. Or train it with your own list.

Upload an .xlsx or .ods and recalculate all its formulas, comparing them with what it had saved: divergences, real circular references and unsupported functions.

Project your cash month by month with growth, hires and rounds: when it runs out, which month you become profitable and whether you're “default alive”. Includes break-even in units.

WCAG 2 contrast ratio (AA, AAA and 3:1 for icons and borders) between two colours and, if it fails, the most similar colour that does pass.

Paste an MCP server's tools/list —yours, or anyone's— and audit its catalogue quality: missing descriptions and annotations, a name that suggests it deletes something while its annotation says it's read-only, context cost per tool, and whether the instructions field is set and fits under what a Tool Search client trims. Paste server.json and package.json too to catch the same 422/403/400 errors we already suffered publishing our own packages, before the official registry gives them to you. This is not an access-security auditor: that's what the Agent file auditor is for. 100% in the browser.

Beautify or minify SQL, CSS, HTML and JavaScript code with automatic indentation.

Agent-based market simulation: firms competing (Cournot), monopolies, mergers, limited resources and government policy, with a timeline. Understand why prices move (e.g. why RAM gets pricier as HBM is prioritised for AI). No server.

Visualize and edit Basic, Bearer/JWT and OAuth2 (Authorization Code and PKCE) as step-by-step sequence diagrams. Here you see the protocol/flow; the JWT is one step — to inspect the token in detail see the JWT inspector.

Resize, convert and compress images while seeing the before and after and how much they weigh. Without uploading them to any server and without metadata (GPS).

Discover groups in unlabeled data (unsupervised learning) and compare k-means with DBSCAN live. Watch the centroids converge step by step, try "Moons" and "Rings" to see where k-means fails and DBSCAN succeeds, and tune k, eps and minPts.

Converts between bases (2–64) and adds a programmer's calculator (arithmetic and bitwise, two's complement), bit inspector, IEEE 754 and codes (ASCII, Gray, endianness).

A map of the 7 Defense in Depth layers (physical, identity and access, perimeter, network, compute, application, data) that links to the Jarroba tools that already demonstrate each one with a real attack, and honestly says where there's none. Includes Zero Trust (verify explicitly, least privilege, assume breach) as a switch that cuts across every layer, not as one more layer. It's not a network simulator: every covered layer leads to real cryptography or protocol, not an animation.

Of these passing tests, which ones cannot fail? Paste your test file and it tells you, case by case, what it really checks — with the evidence in front of you, so you can prove it wrong. And the part nobody else does: it compares the BEFORE and AFTER of a change and shows you whether you weakened the net — the matcher that got widened, the assertion that vanished, the case that stopped running. That is the cheap shortcut of someone in a hurry, and of an AI told to make the suite go green. TypeScript, JavaScript, Python, Java and Go. It runs nothing: your code never leaves the browser.

Look up full information for any character: codepoint, UTF-8/16, HTML entity and ASCII table.

Before pasting a text, a log or a .har export into an AI chat, a support ticket or a public forum: tells you which secrets, API keys and session cookies would leak with it, where they are, and gives you a clean version ready to copy. A session cookie or an Authorization header is always flagged, even without a recognizable shape. 100% in the browser.

Availability ↔ downtime, and your SLO's error budget: burn-rate alerts from Google's SRE Workbook computed for you, a low-traffic warning, Prometheus rules and dependency composition.

Apply filters (kernels) to an image and see the resulting feature map: edges (Sobel), blur, sharpen, emboss… the basic operation of a convolutional network (CNN). Edit your own kernel, upload an image and watch the "filter bank" that mimics a CNN's first layer.

Convert between JSON, YAML, Properties, ENV and CSV with automatic input format detection.

What your euros from another year are worth today, using Eurostat's official harmonised CPI (Spain, Germany, Portugal, France, Italy, euro area); whether your salary has outpaced prices; and how much you will have saving or investing, in today's euros, after fees and taxes.

Evaluate a binary classifier visually and interactively: move the threshold and watch the confusion matrix, precision, recall, F1, the ROC curve (with AUC) and the precision-recall curve (with AP). Adjust the model's quality and class imbalance to understand how some metrics lie and others don't.

Escape and unescape text to embed it in SOURCE CODE: JavaScript, JSON, SQL, Regex, HTML, URL and CSS. To encode for transport (Base64/URL/HTML) see Encoder/Decoder.

Split group expenses and calculate who owes whom with the minimum number of transfers.

Paste one or more skaffold.yaml and see the dependency graph (requires). It validates cross-references: a requires pointing to a misspelled config name shows in red. Rename a config and its requires update. No server.

Configurable Pomodoro timer with session counter and work, short break and long break phases.

Project high-dimensional data (or embeddings) to 2D with PCA, t-SNE and UMAP, and watch them organize live. Compare the linear method (PCA) with the non-linear ones, try the swiss roll and tune perplexity/neighbors. It teaches the algorithms with generic data; to project real sentences see the Semantic map.

Import RDF data (Turtle, JSON-LD, N-Triples, RDF/XML), see it as an interactive graph and query it with SPARQL 1.1 — a whole semantic store in your browser (Oxigraph WASM), no server.

Scoreboard for matches with multiple players, customizable scoring and integrated timer.

Formula-driven physics in 3D: simple and double pendulum with real units, step-by-step or real-time, selectable integrators (Euler, Verlet, RK4) and energy and phase-space plots.

Three views on embeddings (meaning vectors): measure the cosine similarity between texts, project them to a 2D map with PCA and build a mini RAG that retrieves the most relevant chunks. All with models running in the browser.

Simulate rate limiting algorithms (Token Bucket and Fixed Window) with a visual timeline of accepted and rejected requests.

3D dice with real physics, from a coin to a d9999, that fall, roll and collide. Each table opens its own projection window for another screen or for each player's phone, and you choose what they see on top: the total, the alerts, the probability. Create dice with your own icons, write rules as sentences (advantage, exploding dice, minimums, alerts…) and see the EXACT probability of every roll. The number is decided by the browser's cryptographic generator, not by the physics. No server.

Process scheduling (FCFS, SJF, SRTF, Round Robin, HRRN, priorities) and page replacement (LRU, FIFO, optimal, clock) step by step: at every instant, the queue and why each process runs. With the textbook examples and “Check my answer”.

Drop a project folder before opening it with your AI and see what its configuration will do without asking you: hooks, pre-approved MCP servers, redirected API URLs, unrestricted shell permissions, commands inside skills and instructions hidden in CLAUDE.md, AGENTS.md or Cursor rules. For Claude Code, Cursor, Copilot, Gemini CLI and Codex. It separates facts from signals and explains each case and how to fix it. Nothing leaves your browser.

The physical design of a chip, from the inside, in five steps that link together: the memory cell and its noise margin (the butterfly curve), how that cell is READ without destroying it, how the current reaches it and how much voltage is lost on the way, what shape it takes on silicon and why height is measured in tracks, and how fast all of that can run. It shows why reading a cell can erase it, why a hold violation is not fixed by lowering the frequency, and how IR drop ends up being paid for in the clock. First-order models, and every screen says so.

An interactive canvas with Client, Authentication Server, and Resource Server: generate a real JWT (real RSA, Web Crypto), pick an attack (alg=none, or RS256→HS256 algorithm confusion) and a verification posture (pinning the expected algorithm, or letting the token itself decide) and watch the token travel and the result. Both attacks have been documented since 2015 (Tim McLean) and keep showing up in production as recently as 2024. 100% in the browser.

Build UTM links and see BEFORE publishing which Google Analytics 4 channel they'll land in and why, using the official rules and source list. Bulk-audit what's already published: Unassigned, variants and personal data.

Convert a docker run command with its flags to an equivalent docker-compose.yml file.

The five DORA metrics according to every report from 2019 to 2025: your level year by year with its gaps and errata, your 2025 percentile and the archetypes that replaced Elite/High/Medium/Low.

Encode or decode text for TRANSPORT: URL, Base64 and HTML entities. To escape text inside source code (JS, JSON, SQL, Regex, CSS…) see String escaping.

Draw the plan of whatever you run — a bar’s tables, a data centre’s racks, a ward’s beds, an office’s desks, workshop bays, classrooms or campsite pitches — assign who takes what, and see whether it holds up. The part no tool in the sector has: as well as colouring the state, it uses queueing theory to work out how long people wait, how many leave without a spot, and how many resources you would actually need. No account, no server.

Generate the Nginx config or Apache .htaccess to correctly serve a Single Page Application with client-side routing.

Generate fake data for testing: names, emails, phones, IPs, UUIDs, dates, IBAN and more.

Converts between bits, bytes and their multiples according to SI (kilo/mega) and IEC (kibi/mebi) standards.

Encodes with parity bits and corrects 1-bit errors; includes SECDED (detects 2), interactive error injection, parity coverage and a noisy-channel simulator.

Drag points and see the least-squares fit live. Raise the polynomial degree to watch overfitting and use regularization (ridge = MAP with a Gaussian prior) to control it. MSE = maximum likelihood with Gaussian noise.

Calculate network, broadcast, host range, mask and usable hosts from CIDR notation.

Test regular expressions in real time and visualize all matches with their position.

Paste your paper, your dissertation or your thesis and see which numbers don't add up BEFORE you submit it. It recomputes the p-value of every "t(28) = 2.20, p = .036" in the text and shows you the whole calculation, rounding included — because "2.20" doesn't mean exactly 2.20. And it checks which means are arithmetically possible: with 20 integer responses, a mean of 3.47 isn't suspicious, it simply doesn't exist. What no tool in this field can offer you: the NIH and the major publishers FORBID reviewers and editors from uploading a manuscript to third-party services, and here nothing is uploaded — everything is computed in your browser. It accuses no one: it tells you what to look at, and why.

Build a circuit and watch it run: current flows through the wires of the schematic and of a breadboard at once. DC, transient with an oscilloscope, and AC; from a battery and a bulb to transistors, op-amps and MOSFETs, with explained examples up to a CMOS NAND gate.

Converts any CSS colour between HEX, RGB, HSL, OKLCH and OKLab, and gives its tint scale. Understands what you copy from DevTools, transparency included.

Open and explore CSV, logs or JSONL of tens or hundreds of GB without loading them into memory: virtual scroll, go to line, "tail" and streaming text/regex search. 100% local.

Run a tournament of anything: league, group stage, knockout bracket, double elimination, Swiss system, Grand Prix or judged contest, chaining phases. Standings and pairings work themselves out, with the tiebreakers you choose.

What you keep as a self-employed worker in Spain: Social Security for your real-income band, IRPF with your region's scale, VAT and how much to set aside each month, with every figure explained and its legal source. In your browser, no sign-up.

Check a text before pasting it into an AI or publishing it: finds and decodes instructions written with invisible characters, words split to dodge filters, code that reads differently from how it runs (Trojan Source) and letters from another alphabet posing as Latin ones. Without flagging legitimate emoji or flags. 100 % in the browser.

Prepare the work for an AI and check what it hands back. Write the spec (what changes and, above all, what does NOT) and review it against the rules that make it satisfiable; split permissions into three buckets; export to SPEC.md, Kiro or CLAUDE.md. And from the other side: measure the loop trace, separate what is backed by a source from what is merely asserted (an arXiv paper is a preprint, not a peer-reviewed article) and build an eval bank that reviews itself before giving you any percentage. Includes the system prompt builder.

Paste a document and measure how much of it you can throw away without losing a single idea. It compares paragraphs by MEANING with a model running in your browser, so it catches the padding that repeats the same thing in different words — exactly what a word-list detector misses. It strikes out what is redundant, points at the paragraphs that repeat each other and leaves you the core to copy. It does NOT tell you whether an AI wrote it: that cannot be validated. It measures emptiness, which belongs to the text and not to its author.

Preview LaTeX mathematical formulas in real time with example snippets.

Create QR codes for a URL, WiFi, contact, email or phone (PNG or SVG, they never expire) and read them from a photo to see where they lead before opening them.

Break a URL into its parts (protocol, host, path, query params) and build new ones.

Chat with LLMs, summarization, translation and sentiment analysis running 100% on your device. No server, no data sent. Powered by Transformers.js.

Structurally compare two JSON objects and list added, removed and changed keys.

Analyse an A/B or A/B/n test with confidence intervals, Fisher's exact test and a traffic-split check (SRM); plan sample size and duration, and simulate how much the false positive rate inflates if you peek early.