Security Tools tools - Page 2

Timing-safe HMAC compare for GitHub sha256=, Stripe t=/v1=, and generic HMAC-SHA256 webhook signatures.

Verify HS*/RS*/ES* JWT signatures with a pasted secret, PEM public key, or JWK — complements decode-only JWT Decoder.

Paste a Content-Security-Policy string to flag unsafe-inline/eval, missing default-src, and reporting gaps.

Parse a page for script/link tags and report missing integrity attributes on third-party assets.

Discover and parse RFC 9116 security.txt (/.well-known/security.txt) including Contact and Expires.

Generate bcrypt or Argon2id password hashes for local auth testing — same URL, dual algorithms.

Compute HMAC digests and optionally compare an expected signature (timing-safe when lengths match).

Resolve A/AAAA/MX/TXT/NS/CNAME and report DNSSEC-related DS/DNSKEY/RRSIG presence (not full chain validation).

HTTP→HTTPS upgrades, loops, long chains, and open-redirect-looking query params.

Fetch a URL with a probe Origin and report Access-Control-Allow-* gaps, wildcards, and Origin reflection.

Heuristic scan of pasted env/config/log text for API keys, tokens, PEM keys, and JWTs.

Look up SPF, common DKIM selectors, and DMARC TXT records for a domain or URL hostname.

Compute MD5, SHA-1, SHA-256/384/512, or SHA-3 digests of text in one place — with legacy warnings for MD5/SHA-1.

Generate a cryptographically random password with configurable length and character sets.

Estimate password strength from length, charset mix, entropy heuristics, and a short common-password list.