Generate Apache HTTP Server VirtualHost configurations for HTTP and HTTPS. Add SSL, proxy pass, and custom headers. Free Apache config generator, no signup required.
APK analyzer that reads an Android app's manifest, permissions, exported components and signing certificate in your browser. Opens AAB and XAPK too. Free.
ASN.1 decoder for DER and PEM: view certificates, keys, CSRs and PKCS #7 as a tree of tags, lengths, OIDs and values. Runs in your browser, nothing uploaded.
Decode an X.509 PEM certificate to view its subject, issuer, validity, serial number, public key, SANs, and SHA-1/SHA-256 fingerprints. Private, client-side decoding.
Certificate key matcher that checks whether an SSL certificate or CSR matches its private key. RSA, EC and Ed25519 PEM keys, compared in your browser. Free.
CORS tester checks whether a URL allows cross-origin requests from your browser, and explains exactly why a request was blocked when it fails. Free, no signup.
Analyze a Content-Security-Policy header for unsafe directives like unsafe-inline, unsafe-eval, and wildcard sources. Get instant security warnings. Free, client-side, no signup.
Build Content-Security-Policy headers and meta tags with common directives, reporting options, and quick security warnings.
CSR decoder reads the subject, public key algorithm and size, and requested SANs from a PEM certificate signing request, and verifies its self-signature. Free, no signup.
CSR generator that creates a certificate signing request and private key in your browser. RSA or ECDSA keys, multiple SANs, wildcards and the openssl command.
Generate an Ed25519 SSH key pair online in OpenSSH format, ready for GitHub, GitLab or authorized_keys, with its SHA256 fingerprint. Nothing is uploaded.
EXE viewer and DLL analyzer for Windows PE files: see the signer, version info, imports, exports, sections and entropy of any .exe or .dll. Free, no upload.
HAR sanitizer that strips cookies, auth headers, tokens and passwords from a .har file in your browser, then flags any secrets left. Free, no upload.
Generate Strict-Transport-Security (HSTS) headers with includeSubDomains and preload directives. Enforce HTTPS for your domain easily.
Parse raw HTTP request or response headers into a readable table, JSON structure, and quick audit view for security, caching, and CORS.
Inspect all HTTP response headers of any website. Audits security headers like HSTS, CSP, and X-Frame-Options and groups headers by type.
Test if any website supports HTTP/2 and HTTP/3 (QUIC) via real TLS ALPN negotiation. Shows TLS version, server headers, alt-svc advertisement, and response time.
Validate MTA-STS TXT records for any domain and review policy ID metadata for SMTP transport security - browser-based, no install needed.
Generate NGINX server configs for static sites, reverse proxies, and load balancers. Includes SSL/TLS, Gzip compression, rate limiting, CORS, and caching options.
PCAP viewer that opens .pcap and .pcapng captures in your browser. Decodes TCP, UDP, DNS, HTTP and TLS, with Wireshark-style filters. Never uploaded. Free.
Permissions-Policy generator that builds the HTTP header for camera, microphone, geolocation and more. Copy it as nginx, Apache, Next.js or Vercel config.
PFX to PEM converter that extracts the certificate, chain and key from a .pfx or .p12 file, or builds a PFX from PEM. Opens legacy 3DES files. No upload.
PGP key viewer that decodes an armored public key block: fingerprint, key ID, algorithm, user IDs, subkeys, expiry and packets. Runs in your browser. Free.
Pickle viewer that opens .pkl, .pickle and PyTorch .pt files without running them. Shows the object tree and opcodes, and flags os.system payloads. Free.
Search and discover 1,400+ free public APIs across 50+ categories. Filter by authentication type, CORS support, and HTTPS to find the perfect API for your next project.
SARIF viewer that turns CodeQL, Semgrep or ESLint SARIF output into a list of findings by severity, rule and file:line, with filters and search. Free.
Secret scanner that finds leaked API keys, tokens and private keys in pasted code. 28 rules for AWS, GitHub, Stripe, OpenAI and more. Nothing is uploaded.
Check which HTTP security headers are present on any website and get an instant A+ to F grade. Verifies Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, and CORP.
Self-signed certificate generator for localhost and dev servers: DNS and IP SANs, RSA or ECDSA keys, a CA option and the matching OpenSSL command. Free.
Shannon entropy calculator for any string or text, in bits, nats or dits. Shows symbol frequencies, efficiency and which tokens look like secrets. Free.
Convert SSH keys between OpenSSH, PEM, PKCS#8 and RFC 4716 formats. Handles RSA, ECDSA and Ed25519 public or private keys, all in your browser. Free.
Check SSL certificate details for any domain - expiry date, issuer, Subject Alternative Names, TLS version, and fingerprint. Instantly verify if a certificate is valid, trusted, and how many days remain before it expires.
Check TLS-RPT DNS records and inspect report destination URIs to monitor SMTP TLS delivery failures - free tool, no signup required.