Tools
Strumenti
Utilità piccole, veloci e attente alla privacy. Il catalogo calcola nel tuo browser e non invia nulla da nessuna parte; l'unica eccezione è la stanza rossa, dove uno strumento interroga il servizio ufficiale che indica, e solo quando premi «Ask».
Three floors, one rule. The main floor is the catalogue: every tool with a manifest, golden vectors and a fixed shape, computing in your browser and nowhere else. The green room holds the tools whose form is still finding itself, same privacy, labelled as early. The red room is the one place a tool sends your input out, to the official service named on screen, and only when you press Ask.
Try
Straight to the tools ↓
Skip the signposting and go to the index below: every tool, filterable by vendor and category.
Vendor hubs →
One page per platform, gathering its tools, articles and certification material in a single place. The way in if you already know which vendor you are working on.
Technology study guides →
Walkthroughs of the protocols and mechanisms themselves, with no exam attached. Read these to understand the thing rather than to pass something.
Certification exam guides →
Objective by objective for each exam, showing what is covered here and, honestly, what is not.
Paste what you have
A token, a header block, a log line, a certificate, a CIDR: paste it and the tools that recognise its shape line up, the surest first.
By what you need to do
The same index, grouped by the verb: what each tool does to what you give it.
Decode something I have28
Tools that take an artefact as it is, a token, a packet, a header, a string, and show what is inside it.
- Codec Base64, Base32, Hex e percento
- CVSS vector decoder
- Decodificatore di certificati X.509
- Decodificatore di CSR
- Decodificatore di suite di cifratura
- Decodificatore e verificatore di JWT
- Decodificatore OIDC
- dig output explainer
- HTML structure & DOM explainer
- HTTP header-order fingerprint
- HTTP message decoder
- JA4 / JA3 TLS fingerprint decoder
- JWKS explainer + key matcher
- LDAP filter explainer
- Meta, Open Graph & JSON-LD inspector
- nslookup output explainer
- OGNL injection decoder
- OUI / MAC vendor lookup
- p0f passive TCP/IP signature explainer
- PAC file explainer and validator
- Routing table explainer
- SAML Decoder
- Syslog message parser
- Syslog PRI decoder + encoder
- Unicode inspector
- URL Inspector
- User-Agent entropy analyzer
- XML Decoder
Understand how something works14
Explainers, references and models: the thing laid out so a decision about it can be made.
- ASCII table explorer
- Change Blast-Radius Mapper
- Cron expression explainer
- curl command explainer
- Expect script explainer
- Flow Path Reasoner
- Hash Preimage Finder
- HTTP methods comparison
- HTTP status code explainer
- Log level mapper
- Network operating system comparer
- PAN-OS policy evaluation order
- Python playground
- Terminal, shell, TTY and console explainer
Compute or convert30
Arithmetic and conversion with the rules shown: addresses, timings, encodings, sizes.
- ACME dns-01 TXT computer
- BFD timer calculator
- Bits, bytes and throughput
- Cable run planner
- Calcolatore CIDR / di sottoreti
- CGN port blocks and MAP port sets
- Charset converter and mojibake fixer
- chmod permission calculator
- Color contrast & format
- Convertitore di tempo Unix
- CSS specificity calculator
- DHCP option 43 generator
- Digital transformation tracker
- Generatore di hash (SHA-1/256/384/512)
- Generatore di HMAC (SHA-256/384/512)
- Greek alphabet explainer
- HTTP request translator
- JA3 / JA3N passive TLS fingerprint
- JSON ↔ YAML Converter
- Let's Encrypt rate-limit planner
- MTU / MSS calculator
- Multi-time-zone meeting planner
- OAuth flow chooser
- Pianificatore di rinnovo dei certificati
- Registered domain (eTLD+1)
- Roman numerals converter
- Route origin validation calculator
- Sorting Algorithm Stepper
- Time calculator
- Toolkit IPv6
Build or generate10
Tools that produce something to take away: a command, a policy, a plan, a configuration.
Check, validate or simulate9
Tools that answer yes or no, and show why: validators, graders, testers, comparers and simulators of a system's own order.
Workflows
Five chains that follow one thing from tool to tool. What the first shows is what the next takes. Started here; more arrive as data.
From a CIDR to a firewall rule
The range's arithmetic and the special-purpose space it falls in first, its IPv6 twin, then the order in which your firewall will actually evaluate the rule you write.
From a token to its claims to the flow
Decode the token, check its signature, then read the protocol and the flow that minted it.
From a certificate to the headers a browser enforces
The certificate, the chain it needs, then the security headers and the Content Security Policy that sit on top.
From a syslog line to a level every system can name
The message field by field, its PRI into facility and severity, then that severity on every other ladder.
From an HTTP message to the command that reproduces it
The message decoded, the status explained, the headers judged, then the curl that sends it again.
Recently added
The newest tools, from the changelog, newest first.
- Routing table explainerPaste the output of ip route, netstat -rn or route print to read every route field by field, see which default route wins, and ask which route a destination would use, by longest prefix and then metric.
- CGN port blocks and MAP port setsDivide one public IPv4 address among subscribers: port blocks per address and per pool (RFC 7768), RFC 7422 deterministic mapping with its forward and reverse lookup, and the MAP-E and MAP-T port set of a PSID (RFC 7597), with the log volume that blocks remove.
- BFD timer calculatorEnter both systems' BFD intervals and Detect Mult to get, for each direction, the agreed transmit interval, its jitter range, the detection time the receiver computes and whether Echo may run, every number explained with its RFC 5880 section; or paste a BFD Control packet in hex to decode it field by field.
- Route origin validation calculatorPaste a route (prefix and origin AS) and the VRPs you have, and get its RFC 6811 state (Valid, Invalid or NotFound) with the reason VRP by VRP: which VRPs cover it, which match, and why the others fail. AS 0 and maxLength are handled as the RFCs state them, IPv4 and IPv6 alike, and nothing is fetched.
- Syslog message parserPaste one syslog message, or a TCP frame carrying one, and read every field named in the order its RFC names them: the PRI opened into facility and severity, the RFC 5424 header, the structured data element by element, the message; or the BSD form of RFC 3164 with its TIMESTAMP, HOSTNAME, TAG and CONTENT. Whatever is non-compliant is said in the RFC's own words. Nothing is sent anywhere.
- Log level mapperPick a level in one logging system (syslog, the Linux kernel, Cisco IOS, Junos, Windows Event Log, .NET, Python, java.util.logging, Log4j 2, OpenTelemetry) and read its nearest equivalent in every other, with each system's own number and words, where the match is exact and where it is only the nearest rung. The bridge is OpenTelemetry's SeverityNumber, the one scale defined to hold the others. Nothing is sent anywhere.
The general-purpose index
91 general-purpose tools in 11 categories, every one of them listed below; the 96 tools built for a single vendor's platform are in the vendor hubs. Jump to a category, show only some, or switch between cards and the list.
Certificati e PKI
ACME dns-01 TXT computer
Compute the TXT record for an ACME dns-01 challenge, from the token and account key.
Certificati e PKICertificate chain builder
Paste a leaf and its intermediates in any order and get the chain a server should send: the end entity first, each issuer after the certificate it signed, the root optional. Links are made by key identifier or by name, RFC 5280's rules are checked along the way (cA, keyCertSign, pathLenConstraint, validity, windows), missing and extra certificates are named, and each signature is verified in your browser. Nothing is fetched.
Certificati e PKIDecodificatore di certificati X.509
Incolla un certificato in PEM, base64 o hex per leggerne il soggetto, l'emittente, la finestra di validità, la chiave pubblica e le estensioni v3, con impronte SHA-256 e SHA-1. Gira interamente nel tuo browser.
Certificati e PKIDecodificatore di CSR
Decodifica una richiesta di firma del certificato PKCS#10 per leggerne il soggetto, la chiave pubblica, i SAN e le estensioni richiesti e gli attributi; tutto nel browser.
Certificati e PKILet's Encrypt rate-limit planner
Plan certificate issuance for a set of hostnames: group them by registered domain and see how they map onto Let's Encrypt's rate limits.
Certificati e PKIPianificatore di rinnovo dei certificati
Calcola la validità di un certificato TLS, se rispetta il calendario dei 47 giorni del CA/Browser Forum e la cadenza di rinnovo che ne deriva; tutto offline.
Certificati e PKI
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| ACME dns-01 TXT computeracme-dns01 | Certificati e PKInew4 GV | compute / verify | RFC 8555 · RFC 7638 · RFC 4648 |
| Certificate chain buildercert-chain-builder | Certificati e PKInew21 GV | order / validate (offline) | RFC 5280 · RFC 8446 s4.4.2 · CA/B Forum BR 2.3.1 |
| Decodificatore di certificati X.509x509 | Certificati e PKI7 GV | decode / explain | RFC 5280 · RFC 6960 · RFC 7633 |
| Decodificatore di CSRcsr-decoder | Certificati e PKI | decode / verify | PKCS#10 / RFC 2986 · RFC 5280 |
| Let's Encrypt rate-limit plannerletsencrypt-rate-limits | Certificati e PKInew3 GV | compute | LE Rate Limits · Public Suffix List |
| Pianificatore di rinnovo dei certificaticert-renewal-planner | Certificati e PKInew5 GV | calculate / explain | CA/Browser Forum SC-081v3 · RFC 5280 · RFC 8555 |
Codifica e dati
ASCII table explorer
All 128 ASCII codes in every notation, with their names from RFC 20 to Unicode 18.0.0, how to write each one in C, JSON, JavaScript, Python, Tcl, HTML and URLs, and a look-up that tells you when a character is not ASCII at all.
Codifica e datiCharset converter and mojibake fixer
Turn text into bytes and bytes into text in fourteen charsets, from UTF-8, UTF-16 and UTF-32 to windows-1252, IBM 850 and EBCDIC, with every ill-formed byte replaced exactly as a browser replaces it. Paste a hex dump, escapes, %XX or Base64, compare what every charset makes of the same bytes, and turn garbled text such as café back into what it was.
Codifica e datiCodec Base64, Base32, Hex e percento
Codifica il testo in Base64, Base64 sicuro per URL, Base32, esadecimale o codifica percentuale, e decodifica qualunque di essi. Tollera riempimento e spazi mancanti, e segnala i risultati binari (non UTF-8). Funziona interamente nel tuo browser.
Codifica e datiConvertitore di tempo Unix
Digita un timestamp Unix — secondi, millisecondi, microsecondi o nanosecondi, rilevato automaticamente — o una data ISO-8601, e rileggilo in tutti i formati comuni. Tutto nel tuo browser.
Codifica e datiJSON ↔ YAML Converter
Convert JSON to block-style YAML or YAML back to JSON, entirely in your browser. Parse errors point to the exact line and column, and conversion notes flag the lossy edges like dropped comments and expanded anchors.
Codifica e datiJSON Formatter & Validator
Validate, pretty-print, minify, and sort JSON. Parse errors point to the exact line, column, and path; duplicate keys are flagged; and large numbers are preserved exactly. Runs entirely in your browser.
Codifica e datiMulti-time-zone meeting planner
One instant, read in every attendee's IANA time zone: local time, UTC offset, day shift, and a working-hours flag. DST is whatever the zone database says for that date, which is exactly why you plan with a real one.
Codifica e datiRoman numerals converter
Numbers to numerals and back, with the canonical subtractive form, the place-by-place construction, and honest validation: IIII is accepted and explained, IL is refused with the rule it breaks.
Codifica e datiTime calculator
Exact time arithmetic: the span between two instants, or an instant plus or minus a duration, in ISO 8601 or plain shorthand. Months and years are refused honestly: they are calendar units with no single exact length.
Codifica e datiUnicode inspector
See what is really in a piece of text: every code point with its name, and the characters that hide or deceive, from zero-width spaces and Trojan Source bidirectional controls to Cyrillic letters posing as Latin. Look up any code point, find one by name, clean a text and write it as escapes in eight languages.
Codifica e dati
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| ASCII table explorerascii-table | Codifica e datinew19 GV | look up / convert / explain | RFC 20 (USAS X3.4-1968) · Unicode 18.0.0 UCD · UAX #44 · UTS #39 · WHATWG HTML · RFC 8259 · RFC 3986 · C11 (N1570) · ECMA-262 · Tcl 8.4 |
| Charset converter and mojibake fixercharset-equivalency | Codifica e datinew35 GV | convert / explain / repair | WHATWG Encoding Standard · Unicode 18.0.0 (3.9, 3.10) · RFC 3629 · RFC 2781 · RFC 4648 · Unicode vendor mapping tables (IBM 437, 850, 037, 500) |
| Codec Base64, Base32, Hex e percentobase64 | Codifica e dati | encode / decode | RFC 4648 · RFC 3986 |
| Convertitore di tempo Unixepoch | Codifica e dati7 GV | convert | - |
| JSON ↔ YAML Converterjson-yaml-convert | Codifica e dati16 GV | convert | YAML 1.2.2 · RFC 8259 |
| JSON Formatter & Validatorjson-formatter | Codifica e dati19 GV | format / validate | RFC 8259 · ECMA-404 · RFC 6901 |
| Multi-time-zone meeting plannertimezone-meeting-planner | Codifica e dati4 GV | compute | - |
| Roman numerals converterroman-numerals | Codifica e dati21 GV | convert / explain | - |
| Time calculatortime-calculator | Codifica e dati8 GV | compute | - |
| Unicode inspectorunicode-inspector | Codifica e datinew20 GV | inspect / reveal | Unicode 18.0.0 UCD · UTS #39 · UTS #55 · UAX #9 · UAX #44 · RFC 3629 · RFC 2781 |
Hashing e crypto
Generatore di hash (SHA-1/256/384/512)
Calcola digest SHA-1, SHA-256, SHA-384 e SHA-512 di qualsiasi testo, mostrati in hex e Base64, usando il Web Crypto nativo del browser. Gira interamente nel tuo browser.
Hashing e cryptoGeneratore di HMAC (SHA-256/384/512)
Calcola un HMAC con chiave su un messaggio usando la tua chiave segreta, mostrato in hex e Base64, tramite il Web Crypto nativo del browser. La stessa costruzione che il verificatore di JWT usa per HS256. La tua chiave non lascia mai il tuo browser.
Hashing e cryptoHash Preimage Finder
Watch a bounded, local brute-force search recover a weak hash input in seconds, or run out of keyspace on anything with real entropy. No wordlist, no table, just your browser. A demonstration of why fast, unsalted hashes fail.
Hashing e crypto
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Generatore di hash (SHA-1/256/384/512)hash | Hashing e crypto | compute | FIPS 180-4 · FIPS 202 |
| Generatore di HMAC (SHA-256/384/512)hmac | Hashing e crypto | compute / verify | RFC 2104 · FIPS 198-1 |
| Hash Preimage Finderhash-preimage-finder | Hashing e cryptonew22 GV | demonstrate / crack (bounded) | RFC 1321 · RFC 3174 · FIPS 180-4 |
Identificatori
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Generatore e ispettore di UUID (v4 / v7)uuid | Identificatori | generate / parse | RFC 9562 |
Identità e token
Decodificatore e verificatore di JWT
Decodifica l'header e i claim di un JSON Web Token, leggine la scadenza e i tempi in linguaggio chiaro e verifica una firma HS256/384/512 con un segreto incollato. Gira interamente nel tuo browser.
Identità e tokenPing IdentityDecodificatore OIDC
Incolla un ID token OpenID Connect o un documento .well-known/openid-configuration e decodificalo: i claim principali, i claim di profilo, gli endpoint e le capacità, con controlli sui claim richiesti, sull'algoritmo di firma, sul nonce e su PKCE.
Identità e tokenPing IdentityJWKS explainer + key matcher
Paste a JSON Web Key Set to break down every key, flag any private material, and match a JWT to its key by kid. Nothing leaves your browser.
Identità e tokenPing IdentityLDAP filter explainer
Paste an LDAP search filter - get the annotated tree: operators, match types, decoded RFC 4515 escapes, recognized AD matching-rule OIDs, and errors anchored to the exact character.
Identità e tokenOAuth flow chooser
What kind of app, is there a user, offline access needed - and the right grant comes back RFC-cited, with implicit and ROPC retired by name per RFC 9700.
Identità e tokenSAML Decoder
Paste a SAML Response or assertion (raw, base64, or URL-encoded) and decode its issuer, status, subject, conditions, audience, and attributes, with signature and weak-algorithm checks. Hardened against XXE.
Identità e tokenPing IdentityTOTP / HOTP Generator & Validator
Generate and check time-based (TOTP, RFC 6238) and counter-based (HOTP, RFC 4226) one-time passwords - the codes behind authenticator apps and hardware tokens such as FortiToken. SHA-1/256/512, configurable digits and step. Computed locally with Web Crypto; your secret never leaves your browser.
Identità e tokenPing IdentityVerificatore e challenge OAuth PKCE
Genera un code_verifier OAuth 2.0 e derivane il code_challenge S256, oppure incolla il tuo e verificalo rispetto alle regole di lunghezza e di set di caratteri di RFC 7636. La stessa derivazione SHA-256 in base64url che il tuo authorization server si aspetta. Gira interamente nel tuo browser.
Identità e tokenPing Identity
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Decodificatore e verificatore di JWTjwt | Identità e token | decode / verify | RFC 7519 · RFC 7515 · RFC 7518 |
| Decodificatore OIDCoidc | Identità e token17 GV | decode / explain | OpenID Connect Core 1.0 · OpenID Connect Discovery 1.0 · RFC 6749 · RFC 7519 |
| JWKS explainer + key matcherjwks-explainer | Identità e token13 GV | decode / explain | RFC 7517 · RFC 7518 · RFC 8037 |
| LDAP filter explainerldap-filter-explainer | Identità e tokennew14 GV | decode / explain | RFC 4515 grammar; anchored errors; AD matching-rule OIDs recognized |
| OAuth flow chooseroauth-flow-chooser | Identità e tokennew12 GV | compute (deterministic) | RFC 6749/7636/8252/8628; RFC 9700 retirements encoded |
| SAML Decodersaml-decoder | Identità e token20 GV | decode / explain | OASIS SAML 2.0 · W3C XML-DSig · OWASP XXE |
| TOTP / HOTP Generator & Validatortotp-hotp | Identità e token | generate / verify | RFC 6238 · RFC 4226 |
| Verificatore e challenge OAuth PKCEpkce | Identità e token | generate / verify | RFC 7636 · RFC 6749 |
Operations & Fieldcraft
Before/After Health Snapshot Comparator
You declare the states, the tool gates the conclusion: seven selections produce a tiered comparison report - baseline quality, a churn-classed dimension catalog, delta-interpretation guidance, and the continue / observe / investigate / hold-rollback-ready gate. Never labels a change successful on green components alone.
Operations & FieldcraftChange Blast-Radius Mapper
Describe what you are changing and its structure; a fixed rule set maps the blast radius as concentric tiers (target, co-located, downstream, human) populated with what could be affected, plus severity-tagged risks and containment measures. It maps what could be affected, never asserts what will break.
Operations & FieldcraftChange Window Runbook Builder
Describe a planned change in six structured fields; a fixed rule set assembles an ordered runbook across six phases - with the risks the plan carries and readiness cautions about the input. Advisory structure to review and adapt, never an approval.
Operations & Fieldcraftchmod permission calculator
Type a file mode as octal (4755), as ls shows it (-rwsr-xr-x) or as chmod clauses on a base (g+s,o-rwx) and read it every other way: the bits, who may do what, what setuid, setgid and the sticky bit mean for a file or a directory, the commands that reach it, the umask that would create it, and a trace of each clause. From POSIX.1-2024 chmod and ls and coreutils 9.11 chmod(1); nothing leaves the browser.
Operations & FieldcraftDigital transformation tracker
Thirty milestones across seven domains, sorted by how much you should trust them: what shipped, what is already law, what is scheduled, what is scheduled but actively moving, and what is only somebody's forecast.
Operations & FieldcraftFault Hypothesis Builder
Describe a fault in six structured fields; a fixed rule set ranks hypotheses to test - with the evidence to collect, what would support each, and what would weaken it. Advisory structure, never a diagnosis.
Operations & FieldcraftFlow Path Reasoner
The senior skill is refusing to troubleshoot until the path is understood. Seven selections build a canonical hop map with side-flows, TLS segments, rewrite points, and ranked failure-domain candidates - and unknowns stay visibly unknown.
Operations & FieldcraftIncident Timeline & RCA Builder
RCA stands for root cause analysis - the disciplined walk from an incident's symptoms back to the conditions that allowed it. Enter an incident's events as a small timeline and mark the contributing-factor domains you observed; a fixed rule set orders the timeline, derives the milestone spans, and structures candidate contributing factors with the evidence for each. It never names a root cause - candidates to investigate, not a verdict.
Operations & FieldcraftLog level mapper
Pick a level in one logging system (syslog, the Linux kernel, Cisco IOS, Junos, Windows Event Log, .NET, Python, java.util.logging, Log4j 2, OpenTelemetry) and read its nearest equivalent in every other, with each system's own number and words, where the match is exact and where it is only the nearest rung. The bridge is OpenTelemetry's SeverityNumber, the one scale defined to hold the others. Nothing is sent anywhere.
Operations & FieldcraftNetwork operating system comparer
Fourteen network operating systems - IOS, IOS XE, IOS XR, NX-OS, Junos, Junos Evolved, EOS, TMOS, F5OS, EXOS, VOSS, FortiOS, PAN-OS and Gaia - with lineage, what each runs on, how components share state, where the planes divide, and what an upgrade costs. Pick one for a full profile or two to see them axis by axis. Every entry lists weaknesses as well as strengths.
Operations & FieldcraftPacket Capture Plan Builder
Command builders answer how to capture; this answers where, why, and what it would mean. Describe the path and the symptom; a 35-rule original registry designs a phased capture plan: ranked points on named boundaries, expected observations, an interpretation matrix with supports and weakens decided before collection, and sync/authorization discipline. It plans captures - it never ingests them.
Operations & FieldcraftPython playground
Real CPython 3.14 in your browser, for the arithmetic of networks: subnets, masks, EUI-64, DNS headers in struct, HMAC, latency statistics, transfer times. A 13.5 MB engine downloads once, when you say so; nothing you type leaves the page.
Operations & FieldcraftWASMSyslog message parser
Paste one syslog message, or a TCP frame carrying one, and read every field named in the order its RFC names them: the PRI opened into facility and severity, the RFC 5424 header, the structured data element by element, the message; or the BSD form of RFC 3164 with its TIMESTAMP, HOSTNAME, TAG and CONTENT. Whatever is non-compliant is said in the RFC's own words. Nothing is sent anywhere.
Operations & FieldcraftTAC Escalation Packet Builder
Describe the issue you are about to escalate; a fixed rule set assembles a complete vendor-support packet and a checklist of the artifacts still to collect before opening the case, dropping what you already have. It structures the hand-off; it does not open a case or contact any vendor.
Operations & FieldcraftTerminal, shell, TTY and console explainer
Paste what `tty` printed - /dev/pts/3, /dev/tty2, /dev/ttyS0, /dev/tty, /dev/console, or “not a tty” - and see which layer you are actually looking at, what is holding the other end, and what that implies for signals, job control and what happens when the window closes. Local and offline.
Operations & Fieldcraft
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Before/After Health Snapshot Comparatorhealth-snapshot-comparator | Operations & Fieldcraftnew13 SV | declare / gate / export (advisory) | Original ruleset (D-18) |
| Change Blast-Radius Mapperchange-blast-radius-mapper | Operations & Fieldcraftnew11 SV | map / assess / export (advisory) | Original ruleset (D-18) |
| Change Window Runbook Builderchange-window-runbook-builder | Operations & Fieldcraftnew13 SV | structure / sequence / export (advisory, deterministic rule-firing) | Original ruleset (D-18) |
| chmod permission calculatorchmod-permission-calculator | Operations & Fieldcraftnew25 GV | convert / explain | POSIX.1-2024 chmod · POSIX.1-2024 ls · GNU coreutils 9.11 chmod(1) |
| Digital transformation trackerdigital-transformation-tracker | Operations & Fieldcraftnew14 GV | compute (deterministic) | Certainty-tiered milestone dataset; attribution invariant enforced by golden vectors |
| Fault Hypothesis Builderfault-hypothesis-builder | Operations & Fieldcraftnew13 SV | structure / rank / export (advisory, deterministic rule-firing) | Original ruleset (D-18) |
| Flow Path Reasonerflow-path-reasoner | Operations & Fieldcraftnew13 SV | model / rank / export (advisory) | Original ruleset (D-18) |
| Incident Timeline & RCA Builderincident-timeline-rca-builder | Operations & Fieldcraftnew12 SV | structure / correlate / export (advisory) | Original ruleset (D-18) |
| Log level mapperlog-level-mapper | Operations & Fieldcraftnew18 GV | map / explain | RFC 5424 · OpenTelemetry Logs Data Model · Linux printk · Cisco IOS logging · Junos syslog · Windows event manifest levels · .NET LogLevel · Python logging · java.util.logging · Log4j 2 |
| Network operating system comparernetwork-os-comparer | Operations & Fieldcraft | reference (vendored) | Vendor architecture documentation |
| Packet Capture Plan Builderpacket-capture-plan-builder | Operations & Fieldcraftnew13 SV | plan / rank / export (advisory) | Original ruleset (D-18) |
| Python playgroundpython-playground | Operations & Fieldcraftnew54 GV | run (local, WebAssembly) | CPython 3.14.2 via Pyodide 314.0.7 (WebAssembly, MPL-2.0) · PEP 3156 asyncio (top-level await) |
| Syslog message parsersyslog-message-parser | Operations & Fieldcraftnew17 GV | decode / explain | RFC 5424 · RFC 3164 · RFC 5426 · RFC 6587 · RFC 5425 |
| TAC Escalation Packet Buildertac-escalation-packet-builder | Operations & Fieldcraftnew12 SV | collect / structure / export (advisory) | Original ruleset (D-18) |
| Terminal, shell, TTY and console explainerterminal-stack-explainer | Operations & Fieldcraft | explain | POSIX termios |
Reti
BFD timer calculator
Enter both systems' BFD intervals and Detect Mult to get, for each direction, the agreed transmit interval, its jitter range, the detection time the receiver computes and whether Echo may run, every number explained with its RFC 5880 section; or paste a BFD Control packet in hex to decode it field by field.
RetiBits, bytes and throughput
A size in every unit of both conventions with the bit count written out (1.5 GB is 12 000 000 000 bits and 1.397 GiB; read the 1024 way it would be 7.37 % more), a rate in bits and bytes per second and per minute, hour and day, and any two of size, rate and time giving the third, with the protocol efficiency of TCP over Ethernet applied if you ask. The connection table answers for a modem, T1, E1 and every Ethernet speed at once. Exact arithmetic; nothing is rounded until it is printed.
RetiCable run planner
Speed, distance, environment, PoE in - every compliant cable and fiber option out, each citing the TIA-568 or 802.3 rule that governs it, with honest exclusions for the rest.
RetiCalcolatore CIDR / di sottoreti
Scomponi qualsiasi blocco CIDR IPv4 in indirizzi di rete e di broadcast, intervallo di host utilizzabili, numero di host e maschera di rete, e scopri in quale intervallo a uso speciale della IANA ricade. Le altre modalità suddividono un blocco padre in sottoreti a lunghezza variabile (VLSM), aggregano prefissi in una super-rete e trovano sovrapposizioni e buchi. Gira interamente nel tuo browser.
RetiCGN port blocks and MAP port sets
Divide one public IPv4 address among subscribers: port blocks per address and per pool (RFC 7768), RFC 7422 deterministic mapping with its forward and reverse lookup, and the MAP-E and MAP-T port set of a PSID (RFC 7597), with the log volume that blocks remove.
RetiDHCP option 43 generator
Build the vendor-specific option 43 value a wireless controller actually expects. One option number, four incompatible encodings.
Retidig command builder
Say what to look up, where to ask and how, and get one copy-pasteable dig command with every token explained, the combinations the manual calls redundant or contradictory flagged, and a summary of what the query will carry: transport, port, RD, DO, CD, EDNS and cookie. The inverse of the dig output explainer. Runs nothing; built in your browser from the BIND 9 manual and the DNS RFCs.
Retidig output explainer
Paste real dig output and get a decoded, explained breakdown: the header and flags, the EDNS OPT pseudo-section, every record in each section, and the query stats. Parsed entirely in your browser, nothing is resolved or sent anywhere.
RetiHTTP methods comparison
Enter one to four HTTP methods (try "get vs query") to see each one's registry facts: safe, idempotent, cacheable, request-body semantics, CORS safelist membership, HTML-form support, and the defining RFC - plus exactly which properties differ. Includes QUERY, the RFC 10008 method registered in June 2026.
RetiHTTP status code explainer
Paste status codes (404, 301 302 307) or families (5xx) and get each one decoded: family, registered name, documented meaning, and the operational notes - including the protocol's own fallback rule for codes it has never met.
RetiMTU / MSS calculator
Enter a link MTU and your encapsulation stack (vxlan, gre, pppoe, vlan, mpls, +N custom) to get the inner MTU and TCP MSS, the Ethernet frame sizes, the underlay MTU an overlay needs, and the wire efficiency of standard versus jumbo frames.
Retinslookup output explainer
Paste real nslookup output and get a decoded, explained breakdown: the resolver it used, whether the answer is authoritative, every record (with MX / SRV / SOA field breakdowns), and any failures. Parsed entirely in your browser, nothing is resolved or sent anywhere.
RetiOUI / MAC vendor lookup
Look up the manufacturer behind a MAC address, and read whether it is unicast or multicast and universally or locally administered. All in your browser.
Retip0f passive TCP/IP signature explainer
Decode a p0f v3 SYN fingerprint into its eight fields and see what each reveals about the sender's OS, network path, and stack.
RetiZscalerPAC file explainer and validator
Paste a Proxy Auto-Config file and it reads back the proxy directives it returns, the PAC helper functions it uses (with the DNS-consulting ones flagged), structural and correctness lints, and whether it is a Netskope explicit-proxy steering file. Never runs the file.
RetiNetskopeRegistered domain (eTLD+1)
Find the public suffix (eTLD) and registered domain (eTLD+1) for any hostname, using the Public Suffix List.
RetiRoute origin validation calculator
Paste a route (prefix and origin AS) and the VRPs you have, and get its RFC 6811 state (Valid, Invalid or NotFound) with the reason VRP by VRP: which VRPs cover it, which match, and why the others fail. AS 0 and maxLength are handled as the RFCs state them, IPv4 and IPv6 alike, and nothing is fetched.
RetiRouting table explainer
Paste the output of ip route, netstat -rn or route print to read every route field by field, see which default route wins, and ask which route a destination would use, by longest prefix and then metric.
RetiSyslog PRI decoder + encoder
Decode a syslog PRI such as 134 into its facility and severity, or encode them back, all in your browser.
RetiToolkit IPv6
Analizza un indirizzo o un prefisso IPv6 per vederne le forme canonica (RFC 5952) e completamente espansa, la classificazione a uso speciale, l'aritmetica del prefisso, un MAC EUI-64 se presente e il suo nome DNS inverso ip6.arpa. Gira interamente nel tuo browser.
Reti
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| BFD timer calculatorbfd-timers | Reti42 GV | calculate / decode | RFC 5880 s4.1, s6.6, s6.8.2 to s6.8.9 · RFC 5881 s4 · RFC 5883 s3, s5 · RFC 7419 s3 |
| Bits, bytes and throughputbits-bytes | Retinew22 GV | convert | IEC 60027-2 / IEC 80000-13 (NIST) · RFC 2544 App. C · ITU-T V.90 · ITU-T G.704 · IEEE 802.3-2022 |
| Cable run plannercable-run-planner | Retinew14 GV | compute (deterministic) | ANSI/TIA-568 channel limits + IEEE 802.3 optic reaches; rules table pinned by golden vectors incl. exact-at-limit cases |
| Calcolatore CIDR / di sottoreticidr | Reti26 GV | calculate / explain | RFC 4632 · RFC 1122 · RFC 3021 · RFC 6890 · IANA IPv4 Special-Purpose Address Space |
| CGN port blocks and MAP port setscgn-port-blocks | Retinew36 GV | calculate / reverse | RFC 6888 · RFC 7422 · RFC 7768 · RFC 7597 · RFC 7599 · RFC 6269 · RFC 6302 · RFC 6335 |
| DHCP option 43 generatordhcp-option-43 | Reti17 GV | compute | RFC 2132 s8.4 · Cisco 97066 · Ruckus KB 000008703 · Ubiquiti 204909754 · Extreme XIQC DG · Aruba AOS · Fortinet FortiAP |
| dig command builderdig-command-builder | Retinew39 GV | build / generate (local) | BIND 9 dig manual · RFC 1035 · RFC 3596 · RFC 6891 · RFC 3225 · RFC 4034 · RFC 4035 · RFC 5936 · RFC 1995 · RFC 8482 · RFC 7858 · RFC 8484 · IANA DNS Parameters |
| dig output explainerdig-output-explainer | Retinew15 GV | decode / explain (local) | RFC 1035 · RFC 6891 · RFC 2308 · RFC 9499 · RFC 8490 |
| HTTP methods comparisonhttp-methods-comparison | Retinew19 GV | explain | RFC 9110 §9.3 · RFC 10008 (QUERY) · IANA HTTP Method Registry · RFC 5789 (PATCH) · RFC 4918/3253/5323 (WebDAV) |
| HTTP status code explainerhttp-status-code-explainer | Retinew12 GV | explain | RFC 9110: HTTP Semantics · RFC 6585: Additional HTTP Status Codes · RFC 7725 (451) · RFC 8297 (103 Early Hints) |
| MTU / MSS calculatormtu-mss | Reti25 GV | calculate / reference | RFC 791/8200/9293/768 (header sizes) · RFC 2784 GRE · RFC 7348 VXLAN · RFC 8926 GENEVE · RFC 2516 PPPoE · RFC 3032 MPLS |
| nslookup output explainernslookup-output-explainer | Retinew4 GV | decode / explain (local) | RFC 1035 · RFC 2308 · RFC 2782 · RFC 2181 · RFC 9499 |
| OUI / MAC vendor lookupoui-lookup | Retinew30 GV | decode / lookup | IEEE MA-L · RFC 9542 · RFC 1112 · RFC 2464 · RFC 9568 |
| p0f passive TCP/IP signature explainerp0f-signature-explainer | Retinew10 GV | decode / explain | p0f v3 |
| PAC file explainer and validatorpac-file-explainer | Retinew6 GV | parse / validate | PAC (FindProxyForURL) |
| Registered domain (eTLD+1)public-suffix | Retinew8 GV | compute | Public Suffix List |
| Route origin validation calculatorrpki-origin-validation | Retinew40 GV | compute / explain | RFC 6811 · RFC 9582 · RFC 6483 · RFC 7607 · RFC 9319 · RFC 8416 · RFC 5396 |
| Routing table explainerrouting-table-explainer | Retinew18 GV | decode / explain (local) | ip-route(8) · ip-rule(8) · rtnetlink(7) · route(8) · FreeBSD netstat(1) · Apple netstat.1 · Microsoft route print · RFC 1812 s5.2.4.3 |
| Syslog PRI decoder + encodersyslog-pri-decoder | Reti17 GV | decode / encode | RFC 5424 · RFC 3164 |
| Toolkit IPv6ipv6 | Reti30 GV | expand / compress / explain | RFC 4291 · RFC 5952 · RFC 4380 · RFC 4607 · RFC 7346 |
Security & WAF
CSP evaluator
Paste a Content-Security-Policy, as a header value, a whole header line, a Report-Only header, a meta element or several at once, and read it the way CSP Level 3 reads it: each directive named and explained, each source expression classified by the grammar (keyword, nonce, hash, scheme, host and its wildcards), the effective source list per destination through the fallback chain, and a graded list of findings, each quoting the specification: 'unsafe-inline' and 'unsafe-eval', wildcard, data: and http: sources, missing object-src, base-uri and frame-ancestors, short nonces, 'strict-dynamic' without a nonce, keywords without quotes, missing semicolons, duplicate, unknown and obsolete directives, directives ignored in meta or in Report-Only, and whether the policy meets the specification's own Strict CSP. Decode and grade only, offline: nothing is fetched.
Security & WAFCVSS vector decoder
Paste a CVSS v3.1 or v3.0 vector and get the score computed and mapped to a severity, with every metric spelled out. Local and offline; nothing is sent anywhere.
Security & WAFHTTP header-order fingerprint
Paste a request header block and see how header order and casing fingerprint the client - the passive-HTTP analog of JA3.
Security & WAFZscalerPing IdentityJA3 / JA3N passive TLS fingerprint
Paste a JA3 string and it recomputes the JA3 hash, computes the permutation-stable JA3N, decodes the fields, and flags GREASE values.
Security & WAFZscalerPing IdentityJA4 / JA3 TLS fingerprint decoder
Decode a JA4 TLS client fingerprint or a JA3 fingerprint into its fields, compute the hashed JA4 from raw values, or compute a JA3 MD5. It auto-detects which you paste. All in your browser.
Security & WAFZscalerPing IdentityOGNL injection decoder
Paste an OGNL payload you found in a WAF or application log and read what it was trying to do. Separates a sandbox escape from an execution call, names the advisory family the shape is consistent with, and always states what it did not determine. Decodes only - it never evaluates the payload and holds no templates.
Security & WAFPAN-OS policy evaluation order
Put a Panorama rulebase into the order PAN-OS actually evaluates it, trace a flow to the deciding rule, and find the rules that never fire because something above them already matched.
Security & WAFSecure Headers Analyzer
Paste an HTTP response and get a graded breakdown of its security headers, cookie flags, and cross-origin policy, checked against OWASP, RFC 6797, CSP Level 3, and RFC 6265bis.
Security & WAFSSRF URL classifier
Paste a URL and see where it actually points: loopback, a private or link-local range, a cloud metadata endpoint, CGNAT, any block of the IANA special-purpose registries, or the public internet. Decimal, octal and hex IP obfuscation is decoded, so is an IPv4 address hidden inside an IPv6 one (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo); dangerous schemes and embedded credentials are flagged, and an SSRF risk level is shown. It never resolves DNS and never sends the request.
Security & WAFUser-Agent entropy analyzer
Paste a User-Agent string and see the identifying tokens it exposes, the distinguishing bits each contributes, and the Client Hints migration.
Security & WAFZscalerPing IdentityXML Decoder
Paste XML and read its structure: the declaration, the DOCTYPE and any entities, the element tree with namespaces and attributes, plus a security check of the XML attack surface. Nothing is fetched or resolved.
Security & WAF
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| CSP evaluatorcsp-evaluator | Security & WAFnew19 GV | evaluate / grade | CSP Level 3 (W3C) |
| CVSS vector decodercvss-vector-decoder | Security & WAFnew10 GV | decode / score | CVSS v3.1 (FIRST.org) |
| HTTP header-order fingerprinthttp-header-order-fingerprint | Security & WAFnew7 GV | decode / explain | - |
| JA3 / JA3N passive TLS fingerprintja3-tls-fingerprint | Security & WAFnew16 GV | compute (deterministic) | - |
| JA4 / JA3 TLS fingerprint decoderja4-fingerprint-decoder | Security & WAFnew13 GV | decode / compute | JA4 (FoxIO) · JA3 (Salesforce) · BSD 3-Clause |
| OGNL injection decoderognl-injection-decoder | Security & WAF | decode / explain | CVE-2017-5638 · CVE-2018-11776 |
| PAN-OS policy evaluation orderpanos-policy-evaluation-order | Security & WAF14 GV | explain | PAN-OS Device Groups · Security Policy Rulebase Best Practices · Defining Policies on Panorama |
| Secure Headers Analyzersecure-headers | Security & WAF15 GV | analyze / grade | OWASP Secure Headers Project · RFC 6797 · CSP Level 3 · RFC 6265bis |
| SSRF URL classifierssrf-url-classifier | Security & WAFnew113 GV | classify / flag | RFC 1918 · RFC 3986 · IANA special-purpose registries · RFC 4291 · RFC 6052 · RFC 4380 |
| User-Agent entropy analyzeruser-agent-entropy-analyzer | Security & WAFnew8 GV | decode / explain | - |
| XML Decoderxml-decoder | Security & WAF5 GV | decode / explain (XXE-hardened) | W3C XML 1.0 · W3C Namespaces · OWASP XXE |
Text & utilities
Cron expression explainer
Paste a crontab schedule and get every field read back in plain language, the footguns flagged, and the next runs computed.
Text & utilitiesExpect script explainer
Paste an Expect script and read what it would do, command by command: what it spawns, what it waits for, what it types, when it hands over to you. Then the dialogue it conducts and the findings: a password in clear text, a timeout left at the default or set to never, a pattern that matches too soon, a send without the return the program waits for, a script that ends before the program has answered. Parsed with the Tcl 8.4 engine, never run; every rule cites the expect(1) manual.
Text & utilitiesGreek alphabet explainer
Type Greek and get names plus transliteration; type letter names and get glyphs. The full 24-letter table explains where engineers meet each one, from μ micro to Ω ohms.
Text & utilitiesText Diff
Compare two blocks of text and see exactly what changed, line by line, with inline word-level highlighting on edited lines. Optionally ignore whitespace or case. Everything is computed in your browser; your text is never sent anywhere.
Text & utilities
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Cron expression explainercron-expression-explainer | Text & utilitiesnew23 GV | explain | crontab(5) · POSIX crontab |
| Expect script explainerexpect-script-explainer | Text & utilitiesnew22 GV | explain (deterministic) | expect(1), Expect version 5 · Tcl 8.4 · ssh_config(5) |
| Greek alphabet explainergreek-alphabet | Text & utilities9 GV | convert / explain | - |
| Text Diffdiff | Text & utilities | compare / highlight | - |
TLS e trasporto
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Decodificatore di suite di cifraturacipher | TLS e trasporto15 GV | decode / rate | IANA TLS Cipher Suites · RFC 8446 · RFC 5246 · RFC 8447 · RFC 7465 |
Web & HTTP
Color contrast & format
Two colours in any CSS notation (named, hex, rgb, hsl, hwb, lab, lch, oklab, oklch, color()) and out come the WCAG contrast ratio with pass or fail at every level (AA and AAA, normal and large text, user interface components), a live preview, each colour converted to every notation with its relative luminance, and the nearest foreground that would pass each failing level. Pure arithmetic from the WCAG formulas and the CSS Color Level 4 sample code; nothing leaves the browser.
Web & HTTPCSS selector tester
Paste HTML and one or more selectors (one per line) and see exactly which elements each selector matches: the elements highlighted in the parsed tree with their path and line, the count per selector, and its specificity counted per section 15 of Selectors Level 4. The HTML is parsed inertly with the same parser as the HTML structure explainer; the selectors are parsed and matched by Selectors Level 4's own rules (compound by compound, right to left), including :is(), :not(), :where(), :has(), :nth-child(An+B of S), attribute operators with the i and s flags, CSS escapes and the form-state pseudo-classes read from attributes. Invalid selectors are named with the position of the error; the pseudo-classes a static document cannot answer are marked. Checked against Chromium's querySelectorAll.
Web & HTTPCSS specificity calculator
Paste one or more CSS selectors, or a whole stylesheet, and read each selector's specificity as the (A, B, C) triple of Selectors Level 4, every simple selector named with the column it adds to, the selectors ranked the way the cascade ranks them with ties called out, and the special cases spelled out: :where() counts for nothing, :is(), :not() and :has() take their most specific argument, :nth-child(of) adds its argument, the universal selector adds nothing, a repeated class counts twice, a legacy single-colon pseudo-element counts as one. With the reminder of the five things the cascade checks before specificity.
Web & HTTPcurl command builder
Pick any of the 27 protocols curl speaks, fill in protocol-aware fields, and get the exact command with every flag explained and safety warnings surfaced. The inverse of the HTTP request translator: that one reads a command, this one writes it.
Web & HTTPcurl command explainer
Paste a curl command and get it explained flag by flag, then translated to fetch, a raw HTTP request, HTTPie and Python. Nothing is sent and no request is run.
Web & HTTPHTML structure & DOM explainer
Paste HTML and read the tree the HTML parser builds from it: every element, text node and comment with its line, the elements the parser created without a tag (html, head, body, tbody), the end tags it supplied, the formatting elements it split and the content it moved out of a table, with the document mode (quirks or not) and every parse error by the standard's own code and position. Then the findings: the DOCTYPE, the language, the title, the encoding, images without alternative text, links and buttons with no name, heading jumps, duplicate ids, controls without labels, obsolete elements and attributes, each tied to a sentence of the HTML Standard or WCAG 2.2. Parsing only: no script runs, nothing is fetched, nothing is rendered.
Web & HTTPHTTP message decoder
Paste a raw HTTP/1.1 request or response and read it decoded: the request line or status line against the IANA registries, every field filed under the part of the specification that defines it, the framing decision RFC 9112 makes for the body (which of its eight rules applies, Content-Length against the bytes present, Transfer-Encoding overriding it, the chunks decoded one by one with their trailers), and the credentials and cookies the message carries, surfaced and masked. The decode-only half of an interception proxy's inspector: it never sends, replays or tampers.
Web & HTTPHTTP request translator
Paste a raw HTTP/1.1 request and get the equivalent curl, fetch, HTTPie, Python and PowerShell. Nothing is sent and no request is run.
Web & HTTPMeta, Open Graph & JSON-LD inspector
Paste a page, or just its head, and read everything it declares the way each standard reads it: the title and the character encoding by the HTML Standard, every meta element classified (the standard's own names, the WHATWG MetaExtensions registry, the pragma directives, the non-conforming ones), every link element with its rel tokens (canonical per RFC 6596, hreflang alternates, icons, manifest), the Open Graph object with its arrays and structured properties per ogp.me, the twitter:* card properties as registered, the robots and googlebot rules by Google's published list, the viewport, and every JSON-LD block parsed and outlined per JSON-LD 1.1. Forty-six findings, each quoting the sentence it rests on. Parsed inertly with parse5; nothing is fetched or executed.
Web & HTTPRegex Toolkit
Test, explain, and debug regular expressions with live matches and a backtracking-risk check.
Web & HTTPSorting Algorithm Stepper
Paste a small list of numbers, pick a strategy - bubble, selection, insertion, merge, or quick - and watch the algorithm think: every comparison, every swap, one WHY line per move, with live comparison and write counters that make Big-O growth tangible.
Web & HTTPURL Inspector
Dissect any URL into its named parts: scheme, host, port, path, query parameters, and fragment. Decodes percent-escapes and internationalized hosts, and flags credentials and other issues. Runs entirely in your browser.
Web & HTTP
| Tool | Badges | Posture | Anchors |
|---|---|---|---|
| Color contrast & formatcolor-contrast-format | Web & HTTPnew15 GV | compute / convert | WCAG 2.2 · CSS Color 4 |
| CSS selector testercss-selector-tester | Web & HTTPnew14 GV | match / explain | CSS Selectors 4 · CSS Syntax 3 · HTML Living Standard |
| CSS specificity calculatorcss-specificity-calculator | Web & HTTPnew8 GV | compute / explain | CSS Selectors 4 · CSS Cascade 5 |
| curl command buildercurl-command-builder | Web & HTTPnew11 GV | build (deterministic) | curl manual · everything curl |
| curl command explainercurl-command-explainer | Web & HTTPnew10 GV | explain / translate | curl manual · RFC 9110 |
| HTML structure & DOM explainerhtml-structure-explainer | Web & HTTPnew14 GV | parse / explain | HTML Living Standard · WCAG 2.2 |
| HTTP message decoderhttp-message-decoder | Web & HTTPnew22 GV | decode / explain | RFC 9112 · RFC 9110 · RFC 9111 · IANA HTTP registries · rfc6265bis · RFC 7617 · RFC 6648 |
| HTTP request translatorhttp-request-translator | Web & HTTPnew12 GV | translate | RFC 9112 · RFC 9110 |
| Meta, Open Graph & JSON-LD inspectormeta-og-jsonld-inspector | Web & HTTPnew14 GV | parse / explain | HTML Living Standard · Open Graph protocol · JSON-LD 1.1 · RFC 6596 · HTML+RDFa 1.1 |
| Regex Toolkitregex | Web & HTTP24 GV | test / explain | ECMAScript regular expressions |
| Sorting Algorithm Steppersorting-algorithm-stepper | Web & HTTPnew12 GV | compute (deterministic) | Textbook-canonical sorting variants; correctness enforced by golden vectors + per-run sortedness invariant |
| URL Inspectorurl-inspector | Web & HTTP12 GV | decode / explain | RFC 3986 · WHATWG URL · RFC 3492 |