Useful checks. Clear answers.

Format or minify JSON, encode UTF-8 text as Base64, or calculate a SHA-256 digest. Hashing is not encryption. JSON numbers follow JavaScript precision limits.

Decode a three-part JWT and inspect its header, claims and expiration. No signature verification is performed; decoded claims are untrusted.

Generate passwords locally with a length slider, character controls and pattern templates. Use secure browser randomness and keep the result in your password manager.

Preview five-field Unix cron schedules with a time zone, reference time, presets and occurrence count. This previews times; it does not schedule jobs.

Convert seconds, minutes, hours or days into a duration using exact whole-second arithmetic. Presets help with common values. No DNS lookup.

Calculate IPv4 or IPv6 network boundaries and address counts. IPv4 /31 uses point-to-point semantics; /32 is a single address. No network connections are made.

Calculate a downtime budget or reverse an entered duration into availability. Choose a period and compare 30-day and 365-day budgets. No uptime measurement or SLA certification.

Estimate lost revenue from your hourly revenue, downtime and affected percentage. The result uses your currency and assumptions; it is not an observed financial loss.

Choose a HAR JSON file, up to 2 MiB and 5,000 requests. Summarize requests, HTTP errors, durations and reported transfer bytes. Headers, URLs, cookies and bodies are not displayed or uploaded.

Generate local RSA-2048 or RSA-4096 DKIM keys with plain TXT or zone-file output. Copy public DNS data separately and download the private PEM key securely. No DNS publishing.

Paste raw email headers to unfold fields and inspect Received and Authentication-Results entries. These entries can be forged; this tool does not verify signatures or establish trust.

Check one public page for HTTP status, basic HTTPS, selected headers and HTML metadata. Read completed-check coverage alongside the light-check score.

See the status and origin of each response in the redirect path and flag HTTPS-to-HTTP downgrades. Paths and query values are omitted.

Check HSTS, Referrer-Policy, nosniff and framing protection, and see whether the response sends an enforced CSP header. Full policy analysis and exploit testing are outside this check.

Inspect the final page’s verified HTTPS connection, negotiated TLS protocol and observed certificate information. This is not a full protocol, cipher or vulnerability audit.

Inspect the page title and meta description in the returned HTML. JavaScript is not executed, and this is not a complete SEO or search-ranking audit.

Run a light scan to validate publicly routable destinations before connecting. The report shows the final page’s address observation, not a DNS record lookup or complete address inventory.