// Utilities
Tools
Small, self-contained utilities. They run in your browser whenever possible — your data never touches our server.
// Everyday utilities
The most-used tools on the bench
X.509 Certificate Decoder
Read the issuer, SANs, and expiry of an X.509 cert — .pem files included — without uploading it.
CVSS Calculator
Score a finding with CVSS v3.1 and get the vector string your ticketing queue speaks.
Word & Character Counter
Live word, character, sentence, and reading-time counts for drafts with a length limit.
Unix Timestamp Converter
Turn Unix epoch seconds, milliseconds, or ISO dates into every format at once.
CSP Header Analyzer
Paste a Content-Security-Policy header and see every risky directive explained.
JSON Schema Validator
Validate a payload against its schema — MCP tool calls and configs included — before it executes.
UUID Generator
Generate UUID v4 identifiers in bulk with the browser's cryptographic random source.
35 / 35 utilities
Password Generator
Generate strong, random passwords with tunable character classes and an entropy estimate.
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 digests in hex and base64.
QR Code Generator
Turn any text or URL into a scannable QR code and download it as a PNG.
Unix Timestamp Converter
Convert between Unix timestamps, ISO 8601, UTC, and local time.
Word & Character Counter
Count words, characters, sentences, paragraphs, and reading time live.
Number Base Converter
Convert numbers between binary, octal, decimal, and hexadecimal.
Text Diff Checker
Compare two blocks of text or code side by side, line by line.
JSON Formatter
Format, minify, and validate JSON with line-and-column errors.
JSON Schema Validator
Validate a JSON document against a JSON Schema, with every violation and its exact path.
JSON Diff
Compare two JSON documents semantically — every added, removed, or changed value with its exact path.
Cron Parser
Describe a cron expression in plain English and preview next run times.
Regex Tester
Test JavaScript regex patterns with live highlighting and capture groups.
UUID Generator
Generate UUID v4 identifiers in bulk, with case and format options.
PDF to Markdown
Convert a PDF file to Markdown right in your browser. No upload, no server.
JWT Decoder
Decode a JSON Web Token's header and payload, with a warning on unsigned alg: none tokens.
Encode / Decode Toolkit
Base64, URL, hex, and ROT13 — encoded and decoded side by side, plus an auto-decode chain for stacked/layered encoding.
Hash Identifier
Identify a hash by shape, or generate SHA-1/256/384/512 digests from text.
CVSS Calculator
Compute a CVSS v3.1 base score, severity rating, and vector string.
Markdown Preview
Write CommonMark and see it rendered live, then copy the generated HTML.
Markdown to JSON
Parse Markdown into a structured JSON tree (mdast AST) of typed nodes.
MCP Tool Schema Linter
Check an MCP Tool definition against the spec — required fields, schema constraints, and annotation hints.
Prompt Injection Tester
Audit a system prompt against six known prompt-injection technique categories, with hardening suggestions for every gap.
AI Agent Config Checker
Scan an agent config (.mcp.json, .claude/settings.json, system prompt) for leaked secrets, over-broad permissions, and injection-prone content.
MCP Server Probe
Send a standard MCP initialize handshake to an endpoint and see what it reveals: server identity, exposed tools, auth requirements.
MCP Config Generator
Paste an MCP server URL or package name and get ready-to-paste config blocks for Claude Desktop, Cursor, Cline, Zed, and Windsurf.
Agent Config Diff
Compare two versions of an agent config and see what drifted: added or removed MCP servers, version pin changes, permission changes, env additions.
MCP Supply Chain Checker
Scan an MCP config for unpinned versions, auto-install flags, mutable sources, secrets in env blocks, and standing authorizations.
MITRE ATT&CK Explorer
Search and browse the MITRE ATT&CK Enterprise knowledge base — techniques, tactics, platforms, and sub-techniques.
Subnet / CIDR Calculator
Calculate network address, broadcast address, usable host range, and subnet mask from an IPv4 CIDR block, and split a network into subnets.
X.509 Certificate Decoder
Decode a PEM certificate's subject, issuer, validity, SANs, key usage, and fingerprints in your browser.
Email Header Analyzer
Trace an email's Received hop chain and read its SPF, DKIM, and DMARC authentication results from raw headers.
YAML / TOML / JSON Converter
Convert between YAML, TOML, and JSON with auto-detected source format — for agent configs, CI files, and MCP manifests.
CSP Header Analyzer
Audit a Content-Security-Policy header for unsafe-inline, unsafe-eval, wildcard sources, and missing hardening directives.
IOC Extractor
Extract IPs, domains, hashes, emails, and CVEs from threat-intel text — free, in-browser, no upload.
STRIDE Threat Model Worksheet
Model a design's components and get a per-element STRIDE checklist — Spoofing, Tampering, Repudiation, Info disclosure, DoS, and Elevation of privilege.
// Related writing
Where these tools do real work
X.509 Certificate Decoder
Workload Identity Federation for AI Agents: Kill the Static Key
CVSS Calculator
CTEM Is Vulnerability Management That Stopped Lying to Itself
Word & Character Counter
Open Knowledge Format (OKF): Google's Answer to the AI Agent Context Problem
Unix Timestamp Converter
The Incident Isn't Over When the Fire's Out
CSP Header Analyzer
The Best Exploits Are Boring
JSON Schema Validator
Validate Agent Tool Calls Before They Execute
UUID Generator
Agentic Systems Aren't Apps With Extra Steps
// More tools
Need more tools? toolsforweb.com — a side project with 50+ free browser utilities for everyday work: converters, calculators, encoders, formatters.