Coming soon

Analyze password strength with zxcvbn and real entropy math, or generate a diceware passphrase.

Score CVSS 3.1 and 4.0 base metrics in your browser.

Convert Sigma detection rules to Splunk SPL, Elastic Lucene, or Microsoft KQL.

Decode and inspect JSON Web Tokens entirely in the browser. Surfaces expiry, audience, and issuer claims, and actively warns about classic pitfalls: `alg: none` acceptance, HS/RS algorithm confusion, and missing expiration. A linter for tokens, with nothing ever sent to a server.

Paste a chunk of code, config, or logs and instantly surface leaked credentials (AWS keys, GitHub PATs, Stripe keys, private keys, and JWTs) using the same style of detection rules as gitleaks. Runs locally, so you can safely scan sensitive snippets.

A CyberChef-lite recipe builder. Chain operations (Base64, XOR, gzip, URL-encode, SHA-256, AES) into a live pipeline and watch data transform. Powered by WebCrypto and WASM, with the whole recipe encoded in the URL hash so you can share a transformation without sharing the data.

Drop in a browser `.har` capture and automatically redact cookies, authorization headers, bearer tokens, and other secrets before you hand it to a colleague or vendor for debugging. Fully client-side.

Paste raw email headers and get a readable analysis: the full chain of `Received` hops laid out on a timeline, SPF / DKIM / DMARC results, and flags for spoofing and phishing indicators.

Drop in a PEM certificate, chain, or CSR and get a clean breakdown: subject, SANs, key type and size, signature algorithm, validity window, and flags for weak algorithms or imminent expiry. Parsed in-browser with pkijs / forge.

Build a Content-Security-Policy visually, with plain-English explanations of every directive, then paste an existing header to see exactly what it would block or allow. Catches common mistakes like overly broad `unsafe-inline` or a missing `default-src`.

Check whether a password appears in known breaches using Have I Been Pwned's k-anonymity range API. Only the first five characters of a SHA-1 hash ever leave the browser. A working demonstration of privacy-preserving breach lookups.

Translate cryptic permissions into plain English. Paste a Unix mode like `0644`, a symbolic `rwxr-xr-x`, or a Windows ACL and get a clear, human breakdown of exactly who can do what.

An interactive WebAuthn / passkey playground that walks through the registration and authentication ceremonies step by step, visualizing the challenge and response flow and the data exchanged. A hands-on way to understand passwordless auth.

Run YARA rules against pasted samples right in the browser via a WASM build of the engine. Write or tweak a rule, hit run, and see matches and matched strings instantly. No install, no upload.

An educational WASM dictionary attack against weakly-signed HS256 tokens. Feed it a token and a wordlist to demonstrate why short, guessable signing secrets are dangerous. Pairs naturally with lab-jwt-lab.

An interactive graph visualizer for attack paths. Feed it nmap output, Active Directory relationships, or a custom JSON graph and explore the nodes and edges with D3 and React. Doubles as an embeddable island for garden write-ups.

The org's hardened project starter. Ships with GitHub Actions pinned to commit SHAs, a scanning suite (CodeQL, gitleaks, Trivy, dependency-review), a SECURITY.md, Dependabot config, and branch-protection guidance, so every new repo begins with good hygiene baked in.

Reusable security-scan workflows published in the org's .github repo, so any project can adopt secret scanning, SAST, and dependency checks in a single click from its Actions tab.

A small CLI and GitHub Action that rewrites `uses: owner/action@v3` references to pinned commit SHAs across a repository, hardening your workflows against supply-chain tampering. A genuinely useful quick win.

A growing collection of CVE and CTF write-ups published as garden notes, using the seedling to evergreen growth stages to show which analyses are fresh sketches versus polished references.

Reusable STRIDE and LINDDUN threat-model templates as Markdown, ready to drop into any project for a quick, structured security review.

A cross-linked MITRE ATT&CK glossary: techniques, tactics, and notes wired together with wikilinks and backlinks, growing into a personal knowledge graph over time.

A deliberately over-the-top, terminal-aesthetic security operations dashboard rendered as a React island: ASCII maps, blinking "threat" feeds, and glowing counters. Equal parts data-viz practice and pure cyberpunk vibes.

A convincing-looking fake admin login page that records what automated bots and scanners try to submit (client-side, or to a webhook you control). A tiny, mischievous honeypot, very on-brand for random commits.

A template for hosting static, jeopardy-style CTF challenges directly on GitHub Pages. Challenge board as a React island, flags verified client-side via hashing. No backend required.