Your files stay on your device

Web and auth tools

Decode JWTs, check headers, cookies, and certificates, build CSPs, and inspect the tokens web apps exchange, all decoded locally.

17 tools

- JWT decoder

Inspect headers and claims; verify signatures with a local key.
 (/web/jwt)
- TOTP generator & verifier

RFC 6238 codes from an authenticator secret, plus code verification with a clock-drift window.
 (/web/totp)
- PKCE pair

Generate an RFC 7636 verifier/challenge pair, or check a pair against each other.
 (/web/pkce)
- Subresource integrity

Hash a script or stylesheet into an integrity= attribute, from text or file.
 (/web/sri)
- Authorization header

Parse an Authorization header: Basic decodes, Bearer shape-checks, Digest splits.
 (/web/auth-header)
- CSP evaluator & builder

Evaluate a Content Security Policy with csp_evaluator, or build one finding by finding.
 (/web/csp)
- SAML inspector

Read a SAML response (fields, attributes, conditions) and check its signature.
 (/web/saml)
- Certificate & CSR

X.509 certificates and CSRs: subject, SANs, validity window, key facts.
 (/web/certificate)
- JWK / JWKS

Inspect a JSON Web Key or JWKS: members, thumbprint, PEM form.
 (/web/jwk)
- HTTP header parser

Paste-in request/response headers with repeated-header preservation.
 (/web/headers)
- Cookie analyzer

Set-Cookie breakdown: attributes, expiry dates, prefix rules, warnings.
 (/web/cookie)
- Open graph preview

Extract og:/twitter: meta from pasted HTML and see the card it builds.
 (/web/og-preview)
- HTTP status reference

Searchable, dated snapshot of the IANA status registry with RFC references.
 (/web/http-status)
- JWE decryptor

Compact JWE decryption with local oct, PBES2, or RSA keys through jose.
 (/web/jwe)
- SSH key inspector

Public key wire parse, fingerprints, options, and comments.
 (/web/ssh-key)
- robots.txt tester

Paste-in rules with RFC 9309 longest-match verdicts per path.
 (/web/robots)
- cURL converter

cURL to fetch, axios, and Python requests with a loss report.
 (/web/curl-converter)

Your files are processed on your device. The few tools that talk to the internet say so before they do.

Canonical HTML: https://nutter.tools/web/
Markdown version: https://nutter.tools/web/index.md
Plain-text version: https://nutter.tools/web/index.txt
Agent index: https://nutter.tools/llms.txt