User guide
How to use ronutz
A practical guide to the whole site: the five worlds it is organised into, how each one works and where to start in it, then the reference material, the tools one line each, common tasks with the tools that get them done, and the manual for the features that cut across everything.
The site in one minute
Everything on ronutz lives in one of five worlds, the same five the footer of every page, the colophon and the sitemap use. The counts are computed from the site itself when it is built, so they are the figures of the pages they point at.
readUnderstand
- Learn751 articles
- Article series70 series
- Stories9 threads
- Study guides13 reading paths
- Open materials1 course
- Certification guides105 guides
- Glossary1817 entries
- The Practice64 published
traceExplore
- Industry364 companies
- Vendor hubs8 vendor hubs
- People
- The Roles43 positions
hireWork with me
- About
- Endorsements89 verbatim
- The career record21 chapters
- Training I teach28 courses across 4 vendors
- Advisory
- Speaking
- Red Education
ronutz.comThe project
How each part works
One section per surface: what it is for, how to use it, and the two or three places to start. The sections below this one are the reference: the datasheet, every tool on one line, the common tasks, and the manual.
The tools
Every tool in the catalogue computes in your browser and sends nothing anywhere: paste or type the input and the result appears, with an Example button that fills a known-good input and a Clear button beside it. The tools index opens three ways in: paste what you have, and the box lines up the tools that recognise the shape of what you pasted; choose by what you need to do (decode, understand, compute, build, check); or follow a workflow that takes one thing from tool to tool, a CIDR to a firewall rule, a certificate to the headers a browser enforces.
The index has three floors, stated on the page: the main floor, where every tool has a fixed shape and golden test vectors; the green room, for tools whose form is still settling; and the red room, the one place a tool can send your input out, to the official service named on screen, and only when you ask. Each tool has a documentation page, readable as a web page or as Markdown, and the same logic is described as an API with a machine-readable specification.
Start with:The tools index · Paste what you have · The API
Learn
The Learn library is the explanation behind the tools: articles grouped by subject, in the same taxonomy the tools use, each citing the documentation it was written from and linking the tools that compute what it describes. The hub can be read two ways, Guided or Directory. Guided asks what you want to do (understand a subject, learn something in order from the start, prepare for an exam, work with a particular platform, find a definition fast) and sends you to the right door; Directory lists every article by subject in reading order.
Around the articles sit the Article series, subjects told in order from an opener through their parts; the Stories, longer pieces that argue a point; The Practice, about the work rather than the technology (triage, escalation, change, the human side); the Glossary, with a definition for every term the articles and tools use; and the People, the engineers and authors behind the protocols. In any article, the first mention of a technical term carries a dashed underline you can hover or tap for a short definition; that hint can be switched off in Settings.
Start with:The Learn hub · Article series · The glossary · The Practice
Study guides and certification guides
A study guide is a reading path: the articles to read, in order, with one sentence saying what you will understand at the end, grouped into families (protocols and foundations, identity and security, application delivery, vendor platforms). Each path opens on its first article, and every article in it links back to the path, so you can leave and return without losing your place.
The certification guides are the same material arranged against a vendor exam: the exam's own code and objectives, with the articles and tools that cover each objective. They are reading plans, not exam dumps; where an objective has no coverage yet the guide says so in its place, and a build check fails if one is left silent, which is how the gaps stay visible when the exams change.
The page opens with the training series: fundamentals in order, one level at a time, each a set of modules with a stated outcome, its parts in reading order and the tools to practise on, and a page of its own that starts it. That makes five ways to read in order, each with its own job: a training series takes one level of a curriculum, module by module; an article series tells one subject from its opener through its parts; a reading path gathers published articles toward one understanding; a certification guide maps one exam's objectives to the articles that cover them; a story argues one case across several pieces.
Start with:The training series · The study guides · The certification guides
The vendor hubs
A vendor hub is one page per vendor family that gathers everything the site holds for it: the tools that decode or compute that vendor's formats, the articles grounded in its documentation, its place on the industry record and its lineage of acquisitions and renames. If you work on one platform all day, its hub is the page to bookmark.
Where the author teaches a vendor's official courses, the hub says so and links the training page, which routes to Red Education; where he does not, the hub says nothing about teaching, by rule. Naming a vendor on this site is never a claim of a relationship with it.
Start with:All the hubs · Training
The industry record
The industry record is a chronology of the organisations that built networking and security, in the order their stories begin, each with its founding year, its sources and, where it applies, who bought whom and for how much. Six ways in sit before the list: follow a company, follow a lineage, explore an era, the Brazilian ecosystem, where the author's own path crossed it, and the people. Each is a filtered view with its own address, so it can be shared.
The career chapters are the author's own record, one chapter per company he worked inside or alongside, with the credentials of each; the people timeline runs from the voltaic pile to the present. A method page states the rules every entry follows (what counts as a source, what founded means, how an acquisition is recorded, what is done with an uncertain date) and names the build checks that enforce them. A correction route on the contact page is one click from every entry.
Start with:The industry record · The career chapters · How the research is done
Search and shortcuts
The search field in the header, or Ctrl K, opens a dialog that searches tools, articles, guides and pages at once; the pills under the field narrow it to one kind. A hub's own field searches only that hub's world, and a section's field (The Practice, The Roles) only that section, with an Only in pill that one click widens again. Search runs in your browser against an index built with the site; no query leaves your device.
A handful of single-key shortcuts work on every page: press ? to see them, and rebind any of them in Settings. The human sitemap lists every page by world, for the times a map beats a search box.
Start with:Settings and shortcuts · The sitemap
Privacy and what stays on your device
The site sets no cookies and runs no third-party analytics or trackers. Your theme, your language, your shortcut bindings, the glossary-hint preference and a short reading trail live in your browser's local storage, on your device only, and are never sent anywhere; clearing site data restores the defaults. The privacy page lists every key the site writes, by name, and what the server counts in aggregate.
The site is a progressive web app: once visited, your browser can keep it available, and because the tools compute locally they keep working offline. The stats page shows what is most read, from the aggregate counts; the colophon says how the site is built and what every number on it is computed from.
Start with:The privacy page · Stats · Colophon
At a glance
The essentials in one panel. These figures are generated from the site itself at build time, so they always match what is actually published.
- Live tools
- 187
- Categories
- 11
- Learn articles
- 751
- Reading paths
- 13
- Certification guides
- 105
- Vendor hubs
- 8
- Organisations on the industry record
- 364
- People on the timeline
- 148
- Glossary terms
- 1817
- Languages
- 16
- Where it runs
- In your browser, on your device
- Your input
- Never sent anywhere by default
- Code license
- Apache-2.0
- Content license
- CC BY 4.0
- Built with
- Next.js, a statically exported progressive web app
- Price
- Free to use; the first useful answer is never behind a paywall
Tool reference
Every general-purpose tool, grouped by category. This list is generated from the live registry, so it is always complete. Tools tied to a specific vendor live on that vendor's page.
Bezeichner
- UUID-Generator und -Inspektor (v4 / v7)Erzeugen Sie zufällige v4- oder zeitgeordnete v7-UUIDs oder fügen Sie eine beliebige UUID ein, um ihre Version, Variante und (bei v7) den eingebetteten Erstellungszeitstempel zu lesen. Die Erzeugung nutzt die sichere Zufallsquelle des Browsers. Läuft vollständig in Ihrem Browser.
Hashing & Krypto
- Hash Preimage FinderWatch a bounded, local brute-force search recover a weak hash input in seconds, or run out of keyspace on anything with real entropy. No wordlist, no table, just your browser. A demonstration of why fast, unsalted hashes fail.
- Hash-Generator (SHA-1/256/384/512)Berechnen Sie SHA-1-, SHA-256-, SHA-384- und SHA-512-Digests eines beliebigen Textes, dargestellt als Hex und Base64, mit dem nativen Web Crypto des Browsers. Läuft vollständig in Ihrem Browser.
- HMAC-Generator (SHA-256/384/512)Berechnen Sie einen schlüsselbasierten HMAC über eine Nachricht mit Ihrem geheimen Schlüssel, dargestellt als Hex und Base64, über das native Web Crypto des Browsers. Dieselbe Konstruktion, die der JWT-Verifizierer für HS256 verwendet. Ihr Schlüssel verlässt nie Ihren Browser.
Identität & Tokens
- LDAP filter explainerPaste an LDAP search filter - get the annotated tree: operators, match types, decoded RFC 4515 escapes, recognized AD matching-rule OIDs, and errors anchored to the exact character.
- OAuth flow chooserWhat kind of app, is there a user, offline access needed - and the right grant comes back RFC-cited, with implicit and ROPC retired by name per RFC 9700.
Kodierung & Daten
- ASCII table explorerAll 128 ASCII codes in every notation, with their names from RFC 20 to Unicode 18.0.0, how to write each one in C, JSON, JavaScript, Python, Tcl, HTML and URLs, and a look-up that tells you when a character is not ASCII at all.
- Base64-, Base32-, Hex- und Prozent-CodecKodieren Sie Text in Base64, URL-sicheres Base64, Base32, Hexadezimal oder Prozentkodierung, und dekodieren Sie jedes davon zurück. Toleriert fehlende Auffüllung und Leerzeichen und kennzeichnet binäre (nicht UTF-8) Ergebnisse. Läuft vollständig in Ihrem Browser.
- Charset converter and mojibake fixerTurn text into bytes and bytes into text in fourteen charsets, from UTF-8, UTF-16 and UTF-32 to windows-1252, IBM 850 and EBCDIC, with every ill-formed byte replaced exactly as a browser replaces it. Paste a hex dump, escapes, %XX or Base64, compare what every charset makes of the same bytes, and turn garbled text such as café back into what it was.
- JSON ↔ YAML ConverterConvert JSON to block-style YAML or YAML back to JSON, entirely in your browser. Parse errors point to the exact line and column, and conversion notes flag the lossy edges like dropped comments and expanded anchors.
- JSON Formatter & ValidatorValidate, pretty-print, minify, and sort JSON. Parse errors point to the exact line, column, and path; duplicate keys are flagged; and large numbers are preserved exactly. Runs entirely in your browser.
- Multi-time-zone meeting plannerOne instant, read in every attendee's IANA time zone: local time, UTC offset, day shift, and a working-hours flag. DST is whatever the zone database says for that date, which is exactly why you plan with a real one.
- Roman numerals converterNumbers to numerals and back, with the canonical subtractive form, the place-by-place construction, and honest validation: IIII is accepted and explained, IL is refused with the rule it breaks.
- Time calculatorExact time arithmetic: the span between two instants, or an instant plus or minus a duration, in ISO 8601 or plain shorthand. Months and years are refused honestly: they are calendar units with no single exact length.
- Unicode inspectorSee what is really in a piece of text: every code point with its name, and the characters that hide or deceive, from zero-width spaces and Trojan Source bidirectional controls to Cyrillic letters posing as Latin. Look up any code point, find one by name, clean a text and write it as escapes in eight languages.
- Unix-Zeit-KonverterGeben Sie einen Unix-Zeitstempel — Sekunden, Millisekunden, Mikrosekunden oder Nanosekunden, automatisch erkannt — oder ein ISO-8601-Datum ein und lesen Sie es in allen gängigen Formaten zurück. Alles im Browser.
Netzwerk
- BFD timer calculatorEnter both systems' BFD intervals and Detect Mult to get, for each direction, the agreed transmit interval, its jitter range, the detection time the receiver computes and whether Echo may run, every number explained with its RFC 5880 section; or paste a BFD Control packet in hex to decode it field by field.
- Bits, bytes and throughputA size in every unit of both conventions with the bit count written out (1.5 GB is 12 000 000 000 bits and 1.397 GiB; read the 1024 way it would be 7.37 % more), a rate in bits and bytes per second and per minute, hour and day, and any two of size, rate and time giving the third, with the protocol efficiency of TCP over Ethernet applied if you ask. The connection table answers for a modem, T1, E1 and every Ethernet speed at once. Exact arithmetic; nothing is rounded until it is printed.
- Cable run plannerSpeed, distance, environment, PoE in - every compliant cable and fiber option out, each citing the TIA-568 or 802.3 rule that governs it, with honest exclusions for the rest.
- CGN port blocks and MAP port setsDivide one public IPv4 address among subscribers: port blocks per address and per pool (RFC 7768), RFC 7422 deterministic mapping with its forward and reverse lookup, and the MAP-E and MAP-T port set of a PSID (RFC 7597), with the log volume that blocks remove.
- CIDR-/Subnetz-RechnerZerlegen Sie einen beliebigen IPv4-CIDR-Block in Netzwerk- und Broadcast-Adressen, den nutzbaren Host-Bereich, die Host-Anzahl und die Netzmaske, und sehen Sie, in welchen IANA-Adressbereich für besondere Zwecke er fällt. Die weiteren Modi teilen einen übergeordneten Block in Subnetze variabler Länge (VLSM) auf, fassen Präfixe zu einem Supernetz zusammen und finden Überschneidungen und Lücken. Läuft vollständig in Ihrem Browser.
- DHCP option 43 generatorBuild the vendor-specific option 43 value a wireless controller actually expects. One option number, four incompatible encodings.
- dig command builderSay what to look up, where to ask and how, and get one copy-pasteable dig command with every token explained, the combinations the manual calls redundant or contradictory flagged, and a summary of what the query will carry: transport, port, RD, DO, CD, EDNS and cookie. The inverse of the dig output explainer. Runs nothing; built in your browser from the BIND 9 manual and the DNS RFCs.
- dig output explainerPaste real dig output and get a decoded, explained breakdown: the header and flags, the EDNS OPT pseudo-section, every record in each section, and the query stats. Parsed entirely in your browser, nothing is resolved or sent anywhere.
- HTTP methods comparisonEnter one to four HTTP methods (try "get vs query") to see each one's registry facts: safe, idempotent, cacheable, request-body semantics, CORS safelist membership, HTML-form support, and the defining RFC - plus exactly which properties differ. Includes QUERY, the RFC 10008 method registered in June 2026.
- HTTP status code explainerPaste status codes (404, 301 302 307) or families (5xx) and get each one decoded: family, registered name, documented meaning, and the operational notes - including the protocol's own fallback rule for codes it has never met.
- IPv6-ToolkitParsen Sie eine IPv6-Adresse oder ein Präfix, um die kanonische (RFC 5952) und vollständig expandierte Form, die Klassifizierung als Sonderverwendung, die Präfix-Arithmetik, eine EUI-64-MAC (falls vorhanden) und den ip6.arpa-Reverse-DNS-Namen zu sehen. Läuft vollständig in Ihrem Browser.
- MTU / MSS calculatorEnter a link MTU and your encapsulation stack (vxlan, gre, pppoe, vlan, mpls, +N custom) to get the inner MTU and TCP MSS, the Ethernet frame sizes, the underlay MTU an overlay needs, and the wire efficiency of standard versus jumbo frames.
- nslookup output explainerPaste real nslookup output and get a decoded, explained breakdown: the resolver it used, whether the answer is authoritative, every record (with MX / SRV / SOA field breakdowns), and any failures. Parsed entirely in your browser, nothing is resolved or sent anywhere.
- OUI / MAC vendor lookupLook up the manufacturer behind a MAC address, and read whether it is unicast or multicast and universally or locally administered. All in your browser.
- Registered domain (eTLD+1)Find the public suffix (eTLD) and registered domain (eTLD+1) for any hostname, using the Public Suffix List.
- Route origin validation calculatorPaste a route (prefix and origin AS) and the VRPs you have, and get its RFC 6811 state (Valid, Invalid or NotFound) with the reason VRP by VRP: which VRPs cover it, which match, and why the others fail. AS 0 and maxLength are handled as the RFCs state them, IPv4 and IPv6 alike, and nothing is fetched.
- Routing table explainerPaste the output of ip route, netstat -rn or route print to read every route field by field, see which default route wins, and ask which route a destination would use, by longest prefix and then metric.
- Syslog PRI decoder + encoderDecode a syslog PRI such as 134 into its facility and severity, or encode them back, all in your browser.
Operations & Fieldcraft
- Before/After Health Snapshot ComparatorYou declare the states, the tool gates the conclusion: seven selections produce a tiered comparison report - baseline quality, a churn-classed dimension catalog, delta-interpretation guidance, and the continue / observe / investigate / hold-rollback-ready gate. Never labels a change successful on green components alone.
- Change Blast-Radius MapperDescribe what you are changing and its structure; a fixed rule set maps the blast radius as concentric tiers (target, co-located, downstream, human) populated with what could be affected, plus severity-tagged risks and containment measures. It maps what could be affected, never asserts what will break.
- Change Window Runbook BuilderDescribe a planned change in six structured fields; a fixed rule set assembles an ordered runbook across six phases - with the risks the plan carries and readiness cautions about the input. Advisory structure to review and adapt, never an approval.
- chmod permission calculatorType a file mode as octal (4755), as ls shows it (-rwsr-xr-x) or as chmod clauses on a base (g+s,o-rwx) and read it every other way: the bits, who may do what, what setuid, setgid and the sticky bit mean for a file or a directory, the commands that reach it, the umask that would create it, and a trace of each clause. From POSIX.1-2024 chmod and ls and coreutils 9.11 chmod(1); nothing leaves the browser.
- Digital transformation trackerThirty milestones across seven domains, sorted by how much you should trust them: what shipped, what is already law, what is scheduled, what is scheduled but actively moving, and what is only somebody's forecast.
- Fault Hypothesis BuilderDescribe a fault in six structured fields; a fixed rule set ranks hypotheses to test - with the evidence to collect, what would support each, and what would weaken it. Advisory structure, never a diagnosis.
- Flow Path ReasonerThe senior skill is refusing to troubleshoot until the path is understood. Seven selections build a canonical hop map with side-flows, TLS segments, rewrite points, and ranked failure-domain candidates - and unknowns stay visibly unknown.
- Incident Timeline & RCA BuilderRCA stands for root cause analysis - the disciplined walk from an incident's symptoms back to the conditions that allowed it. Enter an incident's events as a small timeline and mark the contributing-factor domains you observed; a fixed rule set orders the timeline, derives the milestone spans, and structures candidate contributing factors with the evidence for each. It never names a root cause - candidates to investigate, not a verdict.
- Log level mapperPick a level in one logging system (syslog, the Linux kernel, Cisco IOS, Junos, Windows Event Log, .NET, Python, java.util.logging, Log4j 2, OpenTelemetry) and read its nearest equivalent in every other, with each system's own number and words, where the match is exact and where it is only the nearest rung. The bridge is OpenTelemetry's SeverityNumber, the one scale defined to hold the others. Nothing is sent anywhere.
- Network operating system comparerFourteen network operating systems - IOS, IOS XE, IOS XR, NX-OS, Junos, Junos Evolved, EOS, TMOS, F5OS, EXOS, VOSS, FortiOS, PAN-OS and Gaia - with lineage, what each runs on, how components share state, where the planes divide, and what an upgrade costs. Pick one for a full profile or two to see them axis by axis. Every entry lists weaknesses as well as strengths.
- Packet Capture Plan BuilderCommand builders answer how to capture; this answers where, why, and what it would mean. Describe the path and the symptom; a 35-rule original registry designs a phased capture plan: ranked points on named boundaries, expected observations, an interpretation matrix with supports and weakens decided before collection, and sync/authorization discipline. It plans captures - it never ingests them.
- Python playgroundReal CPython 3.14 in your browser, for the arithmetic of networks: subnets, masks, EUI-64, DNS headers in struct, HMAC, latency statistics, transfer times. A 13.5 MB engine downloads once, when you say so; nothing you type leaves the page.
- Syslog message parserPaste one syslog message, or a TCP frame carrying one, and read every field named in the order its RFC names them: the PRI opened into facility and severity, the RFC 5424 header, the structured data element by element, the message; or the BSD form of RFC 3164 with its TIMESTAMP, HOSTNAME, TAG and CONTENT. Whatever is non-compliant is said in the RFC's own words. Nothing is sent anywhere.
- TAC Escalation Packet BuilderDescribe the issue you are about to escalate; a fixed rule set assembles a complete vendor-support packet and a checklist of the artifacts still to collect before opening the case, dropping what you already have. It structures the hand-off; it does not open a case or contact any vendor.
- Terminal, shell, TTY and console explainerPaste what `tty` printed - /dev/pts/3, /dev/tty2, /dev/ttyS0, /dev/tty, /dev/console, or “not a tty” - and see which layer you are actually looking at, what is holding the other end, and what that implies for signals, job control and what happens when the window closes. Local and offline.
Security & WAF
- CSP evaluatorPaste a Content-Security-Policy, as a header value, a whole header line, a Report-Only header, a meta element or several at once, and read it the way CSP Level 3 reads it: each directive named and explained, each source expression classified by the grammar (keyword, nonce, hash, scheme, host and its wildcards), the effective source list per destination through the fallback chain, and a graded list of findings, each quoting the specification: 'unsafe-inline' and 'unsafe-eval', wildcard, data: and http: sources, missing object-src, base-uri and frame-ancestors, short nonces, 'strict-dynamic' without a nonce, keywords without quotes, missing semicolons, duplicate, unknown and obsolete directives, directives ignored in meta or in Report-Only, and whether the policy meets the specification's own Strict CSP. Decode and grade only, offline: nothing is fetched.
- CVSS vector decoderPaste a CVSS v3.1 or v3.0 vector and get the score computed and mapped to a severity, with every metric spelled out. Local and offline; nothing is sent anywhere.
- OGNL injection decoderPaste an OGNL payload you found in a WAF or application log and read what it was trying to do. Separates a sandbox escape from an execution call, names the advisory family the shape is consistent with, and always states what it did not determine. Decodes only - it never evaluates the payload and holds no templates.
- PAN-OS policy evaluation orderPut a Panorama rulebase into the order PAN-OS actually evaluates it, trace a flow to the deciding rule, and find the rules that never fire because something above them already matched.
- Secure Headers AnalyzerPaste an HTTP response and get a graded breakdown of its security headers, cookie flags, and cross-origin policy, checked against OWASP, RFC 6797, CSP Level 3, and RFC 6265bis.
- SSRF URL classifierPaste a URL and see where it actually points: loopback, a private or link-local range, a cloud metadata endpoint, CGNAT, any block of the IANA special-purpose registries, or the public internet. Decimal, octal and hex IP obfuscation is decoded, so is an IPv4 address hidden inside an IPv6 one (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo); dangerous schemes and embedded credentials are flagged, and an SSRF risk level is shown. It never resolves DNS and never sends the request.
- XML DecoderPaste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
Text & utilities
- Cron expression explainerPaste a crontab schedule and get every field read back in plain language, the footguns flagged, and the next runs computed.
- Expect script explainerPaste an Expect script and read what it would do, command by command: what it spawns, what it waits for, what it types, when it hands over to you. Then the dialogue it conducts and the findings: a password in clear text, a timeout left at the default or set to never, a pattern that matches too soon, a send without the return the program waits for, a script that ends before the program has answered. Parsed with the Tcl 8.4 engine, never run; every rule cites the expect(1) manual.
- Greek alphabet explainerType Greek and get names plus transliteration; type letter names and get glyphs. The full 24-letter table explains where engineers meet each one, from μ micro to Ω ohms.
- Text DiffCompare two blocks of text and see exactly what changed, line by line, with inline word-level highlighting on edited lines. Optionally ignore whitespace or case. Everything is computed in your browser; your text is never sent anywhere.
TLS und Transport
- Cipher-Suite-DecoderGib eine TLS-Cipher-Suite ein, als IANA-Name, OpenSSL- oder GnuTLS-Name oder als Hex-Codepunkt, um sie in Schlüsselaustausch, Authentifizierung, Verschlüsselung, Modus und MAC aufzuschlüsseln, mit einer verständlichen Sicherheitsbewertung und der offiziellen IANA-Empfehlung. Läuft vollständig in deinem Browser gegen eine eingebettete Kopie der IANA-Registry.
Web & HTTP
- Color contrast & formatTwo colours in any CSS notation (named, hex, rgb, hsl, hwb, lab, lch, oklab, oklch, color()) and out come the WCAG contrast ratio with pass or fail at every level (AA and AAA, normal and large text, user interface components), a live preview, each colour converted to every notation with its relative luminance, and the nearest foreground that would pass each failing level. Pure arithmetic from the WCAG formulas and the CSS Color Level 4 sample code; nothing leaves the browser.
- CSS selector testerPaste HTML and one or more selectors (one per line) and see exactly which elements each selector matches: the elements highlighted in the parsed tree with their path and line, the count per selector, and its specificity counted per section 15 of Selectors Level 4. The HTML is parsed inertly with the same parser as the HTML structure explainer; the selectors are parsed and matched by Selectors Level 4's own rules (compound by compound, right to left), including :is(), :not(), :where(), :has(), :nth-child(An+B of S), attribute operators with the i and s flags, CSS escapes and the form-state pseudo-classes read from attributes. Invalid selectors are named with the position of the error; the pseudo-classes a static document cannot answer are marked. Checked against Chromium's querySelectorAll.
- CSS specificity calculatorPaste one or more CSS selectors, or a whole stylesheet, and read each selector's specificity as the (A, B, C) triple of Selectors Level 4, every simple selector named with the column it adds to, the selectors ranked the way the cascade ranks them with ties called out, and the special cases spelled out: :where() counts for nothing, :is(), :not() and :has() take their most specific argument, :nth-child(of) adds its argument, the universal selector adds nothing, a repeated class counts twice, a legacy single-colon pseudo-element counts as one. With the reminder of the five things the cascade checks before specificity.
- curl command builderPick any of the 27 protocols curl speaks, fill in protocol-aware fields, and get the exact command with every flag explained and safety warnings surfaced. The inverse of the HTTP request translator: that one reads a command, this one writes it.
- curl command explainerPaste a curl command and get it explained flag by flag, then translated to fetch, a raw HTTP request, HTTPie and Python. Nothing is sent and no request is run.
- HTML structure & DOM explainerPaste HTML and read the tree the HTML parser builds from it: every element, text node and comment with its line, the elements the parser created without a tag (html, head, body, tbody), the end tags it supplied, the formatting elements it split and the content it moved out of a table, with the document mode (quirks or not) and every parse error by the standard's own code and position. Then the findings: the DOCTYPE, the language, the title, the encoding, images without alternative text, links and buttons with no name, heading jumps, duplicate ids, controls without labels, obsolete elements and attributes, each tied to a sentence of the HTML Standard or WCAG 2.2. Parsing only: no script runs, nothing is fetched, nothing is rendered.
- HTTP message decoderPaste a raw HTTP/1.1 request or response and read it decoded: the request line or status line against the IANA registries, every field filed under the part of the specification that defines it, the framing decision RFC 9112 makes for the body (which of its eight rules applies, Content-Length against the bytes present, Transfer-Encoding overriding it, the chunks decoded one by one with their trailers), and the credentials and cookies the message carries, surfaced and masked. The decode-only half of an interception proxy's inspector: it never sends, replays or tampers.
- HTTP request translatorPaste a raw HTTP/1.1 request and get the equivalent curl, fetch, HTTPie, Python and PowerShell. Nothing is sent and no request is run.
- Meta, Open Graph & JSON-LD inspectorPaste a page, or just its head, and read everything it declares the way each standard reads it: the title and the character encoding by the HTML Standard, every meta element classified (the standard's own names, the WHATWG MetaExtensions registry, the pragma directives, the non-conforming ones), every link element with its rel tokens (canonical per RFC 6596, hreflang alternates, icons, manifest), the Open Graph object with its arrays and structured properties per ogp.me, the twitter:* card properties as registered, the robots and googlebot rules by Google's published list, the viewport, and every JSON-LD block parsed and outlined per JSON-LD 1.1. Forty-six findings, each quoting the sentence it rests on. Parsed inertly with parse5; nothing is fetched or executed.
- Regex ToolkitTest, explain, and debug regular expressions with live matches and a backtracking-risk check.
- Sorting Algorithm StepperPaste a small list of numbers, pick a strategy - bubble, selection, insertion, merge, or quick - and watch the algorithm think: every comparison, every swap, one WHY line per move, with live comparison and write counters that make Big-O growth tangible.
- URL InspectorDissect any URL into its named parts: scheme, host, port, path, query parameters, and fragment. Decodes percent-escapes and internationalized hosts, and flags credentials and other issues. Runs entirely in your browser.
Zertifikate & PKI
- ACME dns-01 TXT computerCompute the TXT record for an ACME dns-01 challenge, from the token and account key.
- Certificate chain builderPaste a leaf and its intermediates in any order and get the chain a server should send: the end entity first, each issuer after the certificate it signed, the root optional. Links are made by key identifier or by name, RFC 5280's rules are checked along the way (cA, keyCertSign, pathLenConstraint, validity, windows), missing and extra certificates are named, and each signature is verified in your browser. Nothing is fetched.
- CSR-DecoderDekodieren Sie eine PKCS#10-Zertifikatsignieranforderung, um Antragsteller, öffentlichen Schlüssel, angeforderte SANs und Erweiterungen sowie Attribute zu lesen; vollständig im Browser.
- Let's Encrypt rate-limit plannerPlan certificate issuance for a set of hostnames: group them by registered domain and see how they map onto Let's Encrypt's rate limits.
- X.509-Zertifikat-DecoderFügen Sie ein Zertifikat als PEM, base64 oder hex ein, um Inhaber, Aussteller, Gültigkeitsfenster, öffentlichen Schlüssel und v3-Erweiterungen zu lesen, mit SHA-256- und SHA-1-Fingerabdrücken. Läuft vollständig in Ihrem Browser.
- Zertifikat-ErneuerungsplanerErmitteln Sie die Gültigkeit eines TLS-Zertifikats, ob es in den 47-Tage-Zeitplan des CA/Browser Forums passt, und den daraus folgenden Erneuerungsrhythmus; alles offline.
Suggested usage
Common tasks, and the tools that get them done. Follow the tools in order for each task.
Size a carrier-grade NAT pool, or trace an abuse report
Work out how many subscribers a public pool holds with port blocks, lay out an RFC 7422 deterministic mapping and reverse an address, port and time to the inside address, read the port set of a MAP PSID, then check the inside and pool prefixes with the CIDR calculator.
Inspect a token you received
Decode a JSON Web Token to read its claims, then decode any Base64 fields inside it.
Plan an IP subnet
Work out network ranges, masks and host counts for IPv4, see which special-purpose range a block falls in, and carve a parent block into variable-length subnets with the free blocks left over; then read an IPv6 address or prefix the same way, with its special-use type and its size.
Size BFD timers and check what is on the wire
Work out the interval each direction of a BFD session really runs at, how long each side waits before declaring the path down and whether Echo may run, with the RFC section behind every number; decode a captured BFD Control packet to compare, and plan where to capture UDP 3784 when only one end comes up.
Check a route against its ROAs
Paste a route and the VRPs your validator exports, or a SLURM file, to get its RFC 6811 state with the reason VRP by VRP; then work the covering prefixes with the CIDR or IPv6 calculator.
Work with a TLS certificate
Decode a certificate to see its fields, check a signing request, and plan the renewal date.
Set up sign-in for an app
Understand an OpenID Connect flow, add PKCE for a public client, and add a one-time-password second factor.
Work out which Extreme OS name applies to your switch
Check whether a model carries the new Switch Engine and Fabric Engine names or the original EXOS and VOSS, see the caveats that come with the series, then translate a task between the two command sets.
Make sense of an SPB fabric configuration
Paste an I-SID, a nickname or a role and get the Shortest Path Bridging vocabulary sorted: which backbone VLAN carries the service, what the service actually binds to, and what changes between an edge bridge and a core bridge.
Decide how traffic should reach the service edge
Choose the steering method for a situation and see what it costs, then trace what a specific flow will actually do once that configuration is in place.
Understand what one request meets in an SSE platform
Describe a request and walk the single pass: which services engage, which are pillars and which are cross-cutting, and what a chain of separate appliances would have done instead.
Read a FortiOS config block before you paste it
See the structure as a tree, find out whether any set command is about to replace a list rather than add to it, and check whether the policy it configures can even be reached.
Work out why a FortiGate is not passing that traffic
Check which policy actually matches the packet and whether the rule you expected is even reachable, then build the diagnose debug flow sequence to watch it happen on the device.
Understand how two network operating systems differ
See lineage, what each runs on, how state is shared and where the planes divide - and what each of those predicts about behaviour when something fails.
Work out which terminal layer you are actually in
Paste what tty printed and see whether you are on a pseudoterminal, a virtual console or a real serial line - and what that means for signals, job control and what happens when the window closes.
Find out why the BIG-IP reset that connection
Paste the F5 Ethernet trailer from a capture taken on the device and read the RST cause, the slot and TMM that handled the packet, and the flow identifiers - plus a warning if the trailer carries TLS session secrets.
Read an F5OS tenant configuration and check its sizing
Paste the tenant block to see its lifecycle state, its platform and whether the memory allocation meets F5's published minimum, then decode the RESTCONF path you would use to change it.
Decode a BIG-IP object path, then its statistics
Paste an iControl REST URL to see the module, collection and tilde-encoded object with its tmsh equivalent; flatten the object's stats response into readable lines; then use the F5OS explainer for the platform layer underneath.
Read an F5OS path, then the declaration behind it
Decode an F5OS RESTCONF path segment by segment to see which module, tenant and node it addresses, then read the AS3 declaration that configures the service running inside that tenant.
Read a DNS answer
Make sense of the output from dig, and from nslookup, line by line: TTLs printed in units read back in seconds, how long a negative answer may be cached, and whether the answer came from a server authoritative for the name.
Read a routing table
Paste the output of ip route, netstat -rn or route print to read each route field by field, see which default route wins and which route a destination takes, then check one prefix's arithmetic in the CIDR calculator.
Verify data integrity
Compute a hash of some data, or an HMAC when a shared secret is involved.
Debug a SAML single sign-on
Decode a SAML response to read its assertions and conditions, then inspect the X.509 certificate that signed it.
Match a token to its signing key
Read a JWKS key set to see the keys it publishes, then decode a JSON Web Token to find the key that signed it.
Understand a TLS connection
Decode the negotiated cipher suite, inspect the server certificate, and review the response security headers.
Harden a web response
Audit a site's HTTP security headers, then inspect the URL those headers protect.
Assess a URL for SSRF risk
Classify whether a URL could reach an internal target, then inspect its parts in detail.
Score a vulnerability
Decode a CVSS vector string into its metrics to understand how severe a finding really is.
Convert and tidy a config
Convert a config between JSON and YAML, then format the result so it is easy to read.
Compare two files
Normalize two JSON blobs with the formatter, then diff them to see exactly what changed.
Reproduce an HTTP request
Break a URL into its parts, then translate the call into curl, fetch, or another client.
Identify an unknown hash
Look up a digest against known values, then recompute a hash to confirm the match.
Read a syslog line
Decode a syslog PRI value into its facility and severity.
Build and test a regex
Write a regular expression and test it against sample text as you go.
Work out why AWAF blocked a request
Start from the request log entry, decide whether the block was a false positive, weigh how much to trust the signature that fired, then compare the policy against the version that behaved.
Write an iRule that behaves
Check which event your logic belongs in before writing it, confirm the commands are legal in that context, then lint for the patterns that cost CPU and estimate what the rule will actually spend.
Work an incident from first symptom to escalation
Turn a symptom into testable hypotheses, reason the traffic path, plan a capture that will answer the question, build the timeline as you go, and hand the vendor a packet that does not come back asking for more.
Plan a change and prove it worked
Map what the change can reach before you make it, write the runbook with its rollback, then compare health before and after. The third step is the one most often skipped.
Fingerprint an unknown client
Read the TLS handshake as JA3 and JA4, compare the HTTP header order against what the claimed browser sends, and measure whether the user agent string is as common as it pretends to be.
Get an access point onto its controller
Build the DHCP option 43 value in the encoding your access point vendor actually expects, and plan the cable run that gets power and data to where the AP is going.
Cut a value out of a request
Check whether the command you picked counts from 0 or from 1, cut the value with findstr, substr or getfield beside the plain Tcl that does the same, try the string commands on your exact input, and read a structured value with scan.
Work out what Tcl does with a value
See how Tcl 8.4 reads a number as written (010 is octal, so it equals 8), how expr and if evaluate a condition step by step with == next to eq, then run the snippet one command at a time and watch each substitution.
Turn a routing decision into an iRule
Write the decision as rules and get it as an if chain, a switch or a class match with its data group, check the code against the DevCentral iRules Style Guide, then lint it for the patterns that cost CPU.
Find what is hiding in a string
Paste the text into the Unicode inspector to see every code point, with invisible characters, bidirectional controls, unusual line breaks and lookalikes flagged; compare against the ASCII the text should have held; and run an iRule through the style checker, which reports the same characters in Tcl.
Write a character in any language
Look up an ASCII code in any notation and copy its escape for C, JSON, JavaScript, Python, Tcl, HTML or a URL; for anything beyond ASCII, take the escapes and UTF-8 bytes from the Unicode inspector; then encode the bytes as hex, Base64 or percent-encoding.
Fix text that came out garbled
Paste the garbled text into the charset converter's Fix mojibake mode to find the charset that misread it and get the original back; if you have the raw bytes, read them in Bytes to text and compare every charset side by side; then check the result for hidden characters in the Unicode inspector.
Manual
Running a tool
Open any tool, paste or type your input, and the result appears immediately. There is no sign-in and nothing to install. Most tools include an Example button that fills in sample input, and a Clear button that resets the fields. Below each tool you will find related Learn articles that explain the underlying concept.
Learning as you go
Two learning aids sit alongside the tools. The Glossary defines the acronyms, terms, and jargon the tools and articles use, from protocol names to attack backronyms, each with a short definition and a fuller explanation. And in the Learn articles and tool documentation, the first mention of a term carries a subtle dashed underline: hover or tap it for a quick definition without leaving the page, with a link to the full glossary entry. If you find the underlines distracting, turn them off under Settings, in the Reading section.
Beyond the tools
The site is more than the calculators. The Learn library holds articles that explain the concepts the tools operate on. The Vendors pages gather the vendor-specific tools and reference material for platforms like F5, along with the corporate history behind the names. And the Certifications area offers study guides and reading paths for people working toward a certification. All of it is reachable from the header.
Privacy and themes
The catalogue's tools run entirely in your browser, so the data you enter is not transmitted anywhere; the red room's tools, the one exception, send a query only when you press Ask, and only to the official service they name. Your theme, the language you last used and a few other preferences are remembered in your browser only and never sent anywhere. The Privacy page names each of them and says exactly what is and is not kept.
The API
Each tool's logic is also documented as an API, with a machine-readable specification you can read on the API page. The API is documented for reference; whether requests are served depends on the site's current configuration, which the API page states plainly.
Languages
The interface is available in several languages; switch using the language control in the header. English is the source, written with AI and published only when a person decides it should be; Brazilian Portuguese is written with AI too and reviewed gradually; the other languages are machine-translated. Where a phrase has not yet been translated for a given language, the English text is shown for that phrase so nothing is ever missing.
Offline use
The site is a progressive web app. Once you have visited it, your browser can keep it available, and because the tools compute locally they keep working without a connection. You can add the site to your home screen or desktop like an app.
Source and license
The project is open source. The code is licensed under Apache 2.0 and the written content under CC BY 4.0. You can read the source, report an issue, or suggest a tool from the repository, which is linked in the footer and on the License page.