Your files stay on your device

# Web and auth tools

Decode JWTs, check headers, cookies, and certificates, build CSPs, and inspect the tokens web apps exchange, all decoded locally.

17 tools

- [JWT decoder

Inspect headers and claims; verify signatures with a local key.
](/web/jwt)
- [TOTP generator & verifier

RFC 6238 codes from an authenticator secret, plus code verification with a clock-drift window.
](/web/totp)
- [PKCE pair

Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
](/web/pkce)
- [Subresource integrity

Hash a script or stylesheet into an integrity= attribute, from text or file.
](/web/sri)
- [Authorization header

Parse an Authorization header: Basic decodes, Bearer shape-checks, Digest splits.
](/web/auth-header)
- [CSP evaluator & builder

Evaluate a Content Security Policy with csp_evaluator, or build one finding by finding.
](/web/csp)
- [SAML inspector

Read a SAML response (fields, attributes, conditions) and check its signature.
](/web/saml)
- [Certificate & CSR

X.509 certificates and CSRs: subject, SANs, validity window, key facts.
](/web/certificate)
- [JWK / JWKS

Inspect a JSON Web Key or JWKS: members, thumbprint, PEM form.
](/web/jwk)
- [HTTP header parser

Paste-in request/response headers with repeated-header preservation.
](/web/headers)
- [Cookie analyzer

Set-Cookie breakdown: attributes, expiry dates, prefix rules, warnings.
](/web/cookie)
- [Open graph preview

Extract og:/twitter: meta from pasted HTML and see the card it builds.
](/web/og-preview)
- [HTTP status reference

Searchable, dated snapshot of the IANA status registry with RFC references.
](/web/http-status)
- [JWE decryptor

Compact JWE decryption with local oct, PBES2, or RSA keys through jose.
](/web/jwe)
- [SSH key inspector

Public key wire parse, fingerprints, options, and comments.
](/web/ssh-key)
- [robots.txt tester

Paste-in rules with RFC 9309 longest-match verdicts per path.
](/web/robots)
- [cURL converter

cURL to fetch, axios, and Python requests with a loss report.
](/web/curl-converter)

Your files are processed on your device. The few tools that talk to the internet say so before they do.

---

Canonical HTML: https://nutter.tools/web/
Markdown version: https://nutter.tools/web/index.md
Plain-text version: https://nutter.tools/web/index.txt
Agent index: https://nutter.tools/llms.txt