Security Tools

Inspection, not attack. Read what a token actually claims, see how a site's security headers would really be graded, and check a .env file for credentials before it reaches a commit. The JWT decoder and .env tools run entirely in your browser; the header checker fetches one page, once, as an ordinary visitor.