Free identity and API security tools
Every tool runs locally in your browser. Nothing you paste leaves this page: no uploads, no logs, no analytics.
JWT Decoder & Inspector
Decode a JWT's header and claims, check expiry, spot risky algorithms and verify HS256 signatures locally.
PKCE Generator
Create a code_verifier and its S256 code_challenge, plus random state and nonce values, with WebCrypto.
SAML Response Decoder
Decode POST and Redirect binding messages, pretty-print the XML and pull out issuer, subject, conditions and attributes.
Authorization URL Builder
Build an OAuth 2.0 or OpenID Connect authorize URL parameter by parameter, with warnings for insecure combinations.
Security Header Builder
Generate HSTS, CSP, Referrer-Policy and nosniff headers for nginx, Apache, IIS, Jetty and static hosts.
Why run these tools in the browser?
Tokens and assertions are credentials, so the safest decoder is one that never sends them anywhere. Each tool here is a small JavaScript program that works on the text you paste, on your device. There is no server-side component, no logging and no analytics. Hashes and random values come from the browser's Web Crypto API; SAML inflation uses the built-in DecompressionStream.
Which tool do I need?
| You have | Use | You get |
|---|---|---|
A string starting with eyJ | JWT Decoder | Header, claims, expiry status, warnings, optional HMAC check |
| A login flow to build or debug | Authorization URL Builder | A correct authorize URL and a list of risky choices |
| A public client that needs PKCE | PKCE Generator | code_verifier, S256 code_challenge, state and nonce |
| A SAMLResponse or SAMLRequest value | SAML Decoder | Readable XML with issuer, subject, conditions and attributes |
| A site that needs HSTS and CSP | Security Header Builder | Config snippets for nginx, Apache, IIS, Jetty and static hosts |