Free online security tools

Encoders, hash tools, a JWT decoder, CVSS and subnet calculators, and more — all free, all running locally in your browser.

  • Encoder / Decoder — Base64, URL, and Hex — encode or decode text both ways.
  • Hash Generator — SHA-1, SHA-256, SHA-384, SHA-512 of any text, via the browser's crypto engine.
  • JWT Decoder — Decode a JSON Web Token's header and payload and read its claims. No signature verification.
  • CVSS 4.0 + 3.1 Calculator — Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
  • Subnet Calculator — IPv4 CIDR → network, broadcast, host range, mask, and host count.
  • Password Strength — Rough entropy and crack-time estimate for a password, with feedback.
  • Cipher Playground — Caesar/ROT, XOR, and Vigenère — the classic ciphers from the CTF zone.
  • Regex Tester — Test a regular expression against sample text with live match highlighting and capture groups.
  • Hash Identifier — Paste a hash and get likely algorithms, guessed from its length and character set.
  • Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.
  • Vulnerability Report Writer — A guided form that forces good structure — title, severity, steps to reproduce, impact, remediation — then exports clean Markdown or a printable PDF.
  • Resume/LinkedIn Keyword Helper — Paste a job description, see which security keywords you already cover (based on completed paths) and which are gaps.
  • Portfolio Project Generator — Guided starter briefs for real portfolio projects, with a write-up template you can export.
  • Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.
  • MITRE ATT&CK Mapper — A searchable reference of real ATT&CK tactics and techniques, tied back to where this course covers each one.
  • STRIDE Threat-Model Worksheet — A guided Spoofing/Tampering/Repudiation/Info-Disclosure/DoS/Elevation worksheet, exportable as Markdown.
  • CIDR Overlap Checker — Check whether two CIDR ranges overlap — catches conflicting firewall/routing rules before they cause an outage.
  • User-Agent String Parser — Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.
  • Entropy Calculator — Shannon entropy of any text — a genuine static-analysis signal for spotting packed or encrypted data.
  • Raw HTTP Request Builder — Build a raw HTTP request from method, path, headers, and body — see exactly what goes over the wire.
  • Log Grep / Filter Playground — Filter a block of log lines with a regex — the exact "find the signal in the noise" skill IR work depends on.
  • Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
  • Dependency / SBOM Risk Checker — Paste a dependency list and flag ones matching a known-vulnerable version range.
  • Email Header Analyzer — Paste raw email headers and get flagged for From/Return-Path mismatches, SPF failures, and missing DKIM.
  • Password Policy Checker — Test a password against a configurable length/complexity policy, rule by rule.
  • VLSM Subnet Planner — Plan variable-length subnets across several different host-count requirements from one base network.
  • Simplified YARA Rule Tester — Test a small set of required strings against sample content and see whether your rule matches.
  • Incident Severity & SLA Calculator — Impact × urgency in, a priority tier and realistic remediation SLA out.
  • Compliance Control Mapper — Look up how one control area maps across SOC 2, ISO 27001, NIST 800-53, and PCI-DSS.
  • Diffie-Hellman Key Exchange Visualizer — Watch two sides land on the same shared secret without ever transmitting it, with small real numbers.
  • Base32 / Base85 Encoder — Encode or decode text in Base32 or Base85 — the less common encodings you'll still run into in CTFs.
  • Timing Attack Visualizer — See exactly why a naive string comparison leaks how many leading characters were correct — and why constant-time comparison fixes it.