Skip to content

Category

Security tools.

Decode, hash and convert security artefacts locally — nothing you paste ever leaves the page.

4toolsAll tools

Security tools

  • SecurityLive

    CVE-Ignore Converter

    Translate .trivyignore / .grype.yaml / .snyk in one click.

    Convert and unify a single vulnerability-suppression policy across Trivy, Grype, Snyk and osv-scanner formats. Pure client-side, no upload.

    Open tool
  • SecurityLive

    JWT Decoder & Encoder

    Decode, verify, and sign JWTs — HS/RS/PS/ES/EdDSA — with a built-in key generator.

    Paste a JSON Web Token to decode its header and claims, verify its signature against a secret, PEM, JWK, or JWKS, sign new tokens with any JWS algorithm, and generate test keys — all in your browser. Nothing leaves the page. Pure client-side.

    Open tool
  • SecurityLive

    Hash Generator

    Compute MD5, SHA-1, SHA-256 and SHA-512 digests of any text — plus HMAC.

    Paste text and get its MD5, SHA-1, SHA-256 and SHA-512 hashes at once, plus an optional HMAC with a key — computed in your browser with the Web Crypto API. Pure client-side.

    Open tool
  • SecurityLive

    Certificate Decoder & Chain Checker

    Decode PEM certificates, check chain order, and verify signatures — in your browser.

    Paste a certificate or a whole chain and read every X.509 field, see the chain order corrected with the reason it was wrong, and get a real signature verdict on each link — verified, failed, or not-checked with the algorithm named. Hand-rolled DER parser, Web Crypto verification, zero uploads.

    Open tool

When you reach for Security tools.

Security artefacts are exactly the things you should be most reluctant to paste into a website. A JWT carries claims and sometimes a session. A certificate chain reveals internal hostnames. A vulnerability-suppression file lists what you have chosen not to fix, and where.

That is the whole reason these run client-side. There is no backend to receive what you paste, no request that carries it, and no account tying it to you — which you can verify in your browser network tab, or by disconnecting from the internet and watching the tool keep working.

The chain checker is the one worth knowing about: it does real per-link signature verification with Web Crypto rather than just pretty-printing fields, so it can tell you the chain is out of order and why, which is the single most common cause of "certificate signed by unknown authority" in Go and Docker.

Back to all tools