A growing library of browser tools and deep technical guides for IT professionals.
Encode or decode Base64, with correct Unicode/UTF-8 handling — plain btoa/atob breaks on non-Latin1 text. Runs entirely in your browser.
Enter an IPv4 address and CIDR prefix to get the subnet mask, network/broadcast addresses, usable host range, and address count. Runs entirely in your browser.
Convert colors between HEX, RGB, and HSL, with a live preview swatch. Runs entirely in your browser.
Paste a 5-field cron expression and get a plain-English, field-by-field explanation. Runs entirely in your browser.
Paste or upload a CSV file and get an interactive, searchable, sortable table — auto-detected delimiter and header, malformed/duplicate row detection, per-column stats, and CSV/JSON conversion. Large files are parsed in a Web Worker so the page doesn't freeze. Runs entirely in your browser.
Safely defang IOCs (URLs, domains, IPs, emails) so they can be pasted into tickets and chat without becoming clickable, or refang them back. Runs entirely in your browser.
Compare two blocks of text line by line and see exactly what was added, removed, or changed. Runs entirely in your browser.
Paste full email headers to extract the common fields, walk the Received chain in true chronological order with hop delays, flag private IPs and hostname mismatches, check SPF/DKIM/DMARC results, and pull out every IOC. Runs entirely in your browser.
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text using the browser's native Web Crypto API. Runs entirely in your browser.
Build (or decode) Basic, Bearer, and API-key Authorization headers. Secrets are hidden by default with a reveal toggle, never saved to local storage, never put in a URL, and never sent anywhere. Runs entirely in your browser.
Convert images between PNG, JPEG, and WebP, and resize them, entirely in your browser using the Canvas API. Nothing is uploaded anywhere.
Pull IPs, domains, URLs, emails, hashes, CVEs, ATT&CK IDs, and file/registry paths out of a pasted alert, ticket, or log — grouped, deduplicated, and exportable. Runs entirely in your browser.
Check an IP address, file hash, URL, or domain against VirusTotal and AbuseIPDB in one place.
Paste JSON to validate, pretty-print, or minify it. Runs entirely in your browser — nothing is sent anywhere.
Decode a JSON Web Token's header and payload, with human-readable timestamps for exp/iat/nbf. Runs entirely in your browser — does not verify the signature.
Look up the vendor/manufacturer of a MAC address using the official IEEE OUI registry (53,000+ assignments). Runs entirely in your browser.
Look up Windows NTSTATUS error codes by hex, decimal, or symbolic name — sourced directly from Microsoft's MS-ERREF specification. Runs entirely in your browser.
Searchable TCP/UDP port reference — 51 common ports with default service, description, security notes, and typical attack relevance, filterable by category (Windows, Linux, Database, Web, Authentication, File Sharing). Runs entirely in your browser.
Paste a full URL or just a query string and edit its parameters in a table — add, delete, duplicate, reorder, sort, and see both the encoded and decoded value of each. Handles repeated keys and warns on malformed percent-encoding. Runs entirely in your browser.
Test a regular expression against sample text, see every match highlighted, and inspect capture groups. Runs entirely in your browser.
Grab a full-page screenshot of any public URL, right in your browser. Powered by thum.io's free screenshot service.
Breaks down a shell command into its syntax, what each command and flag actually does, and a plain-English summary of what the whole thing will do. Runs entirely in your browser.
Pretty-print or minify SQL, force keyword case, and pick an indent size — dialect-aware keyword recognition for generic SQL, PostgreSQL, MySQL, SQLite, and SQL Server. Formatting only, never executes anything. Runs entirely in your browser.
Convert between Unix epoch timestamps and human-readable dates, shown in both UTC and your browser's local time explicitly. Runs entirely in your browser.
Convert between numeric (750), symbolic (rwxr-x---), and checkbox permissions, with setuid/setgid/sticky support, contextual warnings, and a generated chmod command. Runs entirely in your browser.
Encode or decode URL text, with a choice between component encoding (query params) and full-URI encoding. Runs entirely in your browser.
Parse one or many User-Agent strings into browser, engine, OS, device type, and CPU architecture — flags automation frameworks (curl, PowerShell, Python Requests, Headless Chrome, Selenium, and more) and obsolete browsers, with a confidence rating per result. Runs entirely in your browser.
Generate RFC 4122 version 4 (random) UUIDs using the browser's built-in cryptographically secure generator. Runs entirely in your browser.
Look up Win32 errors, NTSTATUS values, and HRESULT codes in one search — auto-detects hex, decimal, or symbolic name, and decodes an HRESULT's severity/facility/code bits (resolving the common Win32-wrapped case automatically). Runs entirely in your browser.
Offline reference for 28 Windows Security/System event IDs that come up constantly in real investigations — search by ID, keyword, or category, with typical meaning, severity guidance, investigation steps, and MITRE ATT&CK mappings. Runs entirely in your browser.
Pretty-print, minify, and validate XML, then run XPath queries against it with match counts and node previews — namespace-aware, with verified protection against XXE and entity-expansion attacks. Runs entirely in your browser.
Pretty-print, minify, and validate YAML with real line/column error messages, and convert between YAML and JSON — supports multi-document files, anchors, aliases, and multiline strings. Runs entirely in your browser.