Text & documents
Encoder/DecoderURL, Base64, HTML
Text convertercamelCase, snake_case...
Text DiffCompare two texts
LaTeXPreview mathematical formulas
MarkdownReal-time preview
MermaidDiagrams as code
DiagramsVisio-style visual editor, Mermaid import
String escaperJS, JSON, SQL, Regex, HTML, URL
Unicode / ASCIICharacter information
Numbers & maths
CalculatorExpressions, calculation sheet and plots
StatisticsCalculator, distributions, simulators
Physics SimulatorPendulum, energy, integrators
Base converterBase 2 to 64
Unit systembits, bytes, SI, IEC
Subnet / CIDRNetwork calculator
Timestamp and datesUnix, time zones, formats
Date calculatorDays between dates, exact age, day of the week
Chemistry: solutions and pHExact pH of any mixture, titrations and speciation
Data & formats
Format converterJSON, YAML, Properties, ENV, CSV
JSON FormatterFormat and validate JSON
Regex TesterRegular expressions
JSON DiffStructurally compare two JSONs
Code formatterSQL, CSS, HTML, JavaScript
DB StudioVisual Postgres database in the browser
SQL LabValidate, run and optimize SQL with real Postgres
Giant file viewerOpen huge CSV/logs without loading them
Visual ETL flowTransform data by chaining nodes
Log analyzerMake sense of a log: traces, patterns and AI reduction
Knowledge graphRDF, SPARQL and ontologies
Atoms and chemistryPeriodic table, orbitals and valence shell
Security
Text anonymizerRedact PII and secrets (reversible)
JWT InspectorDecode JWT tokens
Auth flowsBasic, JWT and OAuth2 step by step
Hash generatorSHA-256, SHA-384, SHA-512
Password & UUID generatorPasswords and UUIDs
Hidden text (X-ray)Invisibles, hidden instructions and fake letters
Agent file auditorCLAUDE.md, skills, MCP, hooks and permissions
Can I paste this?Secrets and cookies in a text, log or HAR before sharing it
GitHub Actions auditorCommand injection, unsafe pull_request_target, unpinned actions
Headers and CSP auditorCSP, HSTS, cookies (Secure/HttpOnly/SameSite) from a pasted curl -I
Kubernetes network reachabilityCan pod A reach pod B? NetworkPolicy, ports and broken references
MCP catalogue auditorContext cost, annotations, official registry compliance
Access LabIdentity, RBAC and governance — vendor-neutral, multi-cloud
SAML decoder and auditorSignature, expiry, audience, and the XML Signature Wrapping attack
Email headers and DMARC auditorSPF, DKIM, DMARC — from an email’s headers or its DNS records
Side-channel labAttack a secret by timing and a key by power analysis
Authentication flow labAttack a real JWT (alg=none, RS256→HS256 confusion) on an interactive canvas
Defense in depthThe 7 security layers, and what Jarroba already covers with a real attack
Development & DevOps
CronGenerator and validator
Docker → ComposeConvert docker run to Compose
Skaffold multi-configDependency graph and requires validation
Linux: permissions and userschmod, chown, useradd and groups
URLParse and build URLs
Random dataNames, emails, IPs, UUIDs...
ElectronicsCircuit simulator: DC, transient, AC, MOSFETs and breadboard
From the transistor to the chipFrom a cell's noise margin to the clock: SRAM, read path, IR drop, standard cell and setup/hold
Logic GatesAND, OR, NOT and more gate simulator
Architecture SimulatorDiagram CI/CD, cloud, AI/MCP and simulate load
Quantum simulatorQubits, gates, superposition and entanglement
HammingError detection
Nginx/Apache SPA configGenerate config to serve a SPA
SemverSemantic version ranges
CORS ExplainerAnalyse your server's CORS headers
API workbenchSend requests, convert collections and compare versions
Cert inspectorAnalyse X.509 certificates in PEM format
Rate LimiterSimulate Token Bucket and Fixed Window
Assembly simulatorSimplified MIPS ISA · step-by-step · registers & memory
Operating systemsScheduling and page replacement, step by step and with sources
AutomataFrom regular expression to NFA, DFA and minimal DFA, plus CYK, step by step
Capture labNetwork captures (.pcap) explained: TCP, DNS and HTTP, packet by packet
Context ForgePack and shield your project for AI
Visual terminalClick and get the command: Linux, macOS, PowerShell
Project workshopSimulate your Makefile: what it rebuilds and why
Project X-rayWhat Spring will do with your code, and which dependencies are stale
Spring DoctorField injection, and the rest of the Spring Boot conventions, file by file
Test auditorOf these passing tests, which ones cannot fail?
Manuscript auditorWhich numbers in your paper or thesis don't add up
Message brokersRabbitMQ and Kafka, same scenario
Maven: lifecycleWhat your mvn runs, goal by goal
Artificial Intelligence
LLM costsSimulate monthly spend
Practice validityWhat still holds and what was superseded
AgentsSpec, permissions, verification and evals
Local AI cameraDetects objects and alerts, without uploading anything
Local speech transcriptionAudio to text without uploading it, and measure the error
Does this text say anything?How much you can cut without losing a single idea
EmbeddingsSimilarity, 2D map and RAG
Local AIChat, summarization, translation & sentiment in-browser
TokenizerVisualize tokens, compare models, estimate costs
Probability for AIDistributions, softmax, Bayes and entropy
Gradient descentSGD, Momentum, RMSProp, Adam
Neural networkTrain an MLP and watch the boundary form
Mini-LLMTrain a language model with your text
Dimensionality reducerPCA, t-SNE and UMAP, live
Confusion matrix & ROCThreshold, precision/recall, ROC/AUC, PR
Clustering (k-means, DBSCAN)Discover groups without labels
Attention visualizerWhat each word looks at in a transformer
Convolution & CNN filtersImage filters and feature maps
Decision treeDecision regions + the tree
DiffusionThe noise behind Stable Diffusion
Regression & MLELeast squares, overfitting, ridge
Markov chainsStates, stationary distribution and text
Hypothesis testingp-values, t-test, χ², ANOVA and power
OCR — Image to textExtract text from images, 100% local
From prompt to responseWhat happens to your AI request, stage by stage
Finance
InflationOfficial CPI, purchasing power and savings in today's euros
Economy simulatorFirms, prices, monopolies and limited resources
Mortgage / loanPayment, real APRC of each offer and early repayment
Split expensesWho owes whom and how much
Self-employed (Spain)Social Security, IRPF, VAT and how much to set aside
Health & Wellness
BMI & healthBMI, ideal weight, BMR and sleep cycles
Productivity
PomodoroTime-block work technique
StopwatchWith laps, stages and history
Games & Entertainment
Dice3D dice from 2 to 9,999 faces, with projection
ScorekeeperPoints per player with game timer
Random pickerPick a random item from a list
Name generatorInvented with a Markov chain, from 8 traditions
TournamentLeagues, groups, knockouts and Swiss, with standings
Multimedia & design
Color HEX/RGB/HSLHEX, RGB, HSL, OKLCH and scales
QR CodeCreate and read · WiFi, contact, URL
ImagesResize, convert and compress
PDF ToolsMerge, extract, rotate, images to PDF
ChartsVisualize data with charts
WCAG ContrastAA/AAA and the colour that does pass
Spreadsheet auditorRecalculates and compares with what's saved
Living documentText with blocks from other tools, exportable to PDF/XLSX
Icon generatorIcon generator
Scan documentScan document
Compare imagesCompare images
Compare PDFWhat changed between two versions
CSV for ExcelAccents, separator and decimal
Really redact a PDFDeletes the content, not a box on top
Fill PDF formsFill PDF forms
Business
Meeting costHow much does each meeting really cost?
SLA / UptimeAllowed downtime, error budget and alerts
Burn rate / RunwayRunway, break-even and cash forecast from your bank statement
A/B TestAnalyse, plan and don't fool yourself by peeking
DORA MetricsYour team according to every DORA report, 2019–2025
UTM BuilderUTM links with their predicted GA4 channel
Spaces and resourcesTables, racks, beds or desks: share them out and see if they hold up
My payslipCheck your payslips and your income tax
Work calendar and shiftsHolidays, agreed working time and shift rotas
How to use
What this is

The journey of a request to an AI, end to end: what is already loaded before you type, how the context window is assembled, which filters check it in your app and in the gateway, the model, an agent’s loop and what is checked on the way out. Pick a scenario, click a stage and edit the pieces where they come in.

The tabs

Journey: the eleven stages and the context window. Tools, MCP and skills: what each definition costs, skills in three levels and a tool call control by control (schema, hooks, permissions as in Claude Code, person, sandbox). Context: what comes in through RAG, what is lost when compacting and what can be cached, with real prices. IDE agent: what runs without asking depending on the mode, what can be undone and what subagents save (or not). Lab: what each layer stops over the /agents attack catalogue, measured, and the failures that are not attacks.

The bar at the top is the context window

It is everything the model reads at THAT stage, piece by piece, with its tokens actually counted using OpenAI’s o200k tokenizer (other models count somewhat differently). Tool definitions are counted as the JSON that describes them; each provider wraps them its own way, so it is an approximation. Notice how much is there before you type anything.

What is real and what is simulated

The filters use the app’s secret and personal data detectors and the injection phrase list from /agents: what they find is real, and everything runs in your browser. The gateway is simulated: its policies exist (Azure API Management has llm-token-limit, llm-content-safety and semantic caching; LiteLLM, guardrails before and after the call), but here the content filter is done by our detectors. A phrase list catches the textbook order and not the disguised one: that is what happens with real list-based filters.

What nobody saw

Remove layers and look at the box at the bottom: what was there and no active layer looked at. The indirect injection lesson shows itself: the app’s filter does not see the retrieved document or a tool’s output, because they arrive later. No single layer is enough.

From prompt to responseWhat happens to your AI request, stage by stage
From prompt to responseWhat happens to your AI request, stage by stage
Context window at “Assembling the context”0 tokens · 0% of the window
  • System prompt 0
  • Conversation history 0
  • Your prompt 0
  • Retrieved documents (RAG) 0

Assembling the context

What happens. The request is assembled: the history (or its summary, if it no longer fits), the documents the RAG retrieves and your prompt, in a fixed order. A prefix that does not change between requests can be cached and costs less.

What can go wrong. A retrieved document can carry a hidden order: that is indirect injection. Compacting the history can lose one of your instructions. And a change at the start of the request breaks the cache.

In depth:/embeddings/llm-costs/context-forge

The journey stops at “AI gateway”.

Everything the detectors found was seen by some layer.