Free Security Tools for Developers

JWT Parser & Debugger

Decode JSON Web Tokens locally. See header, payload, and signature. Spot expired tokens, weak algorithms, and dangerous alg:none headers.

ClassicClient-side

Password Strength Analyzer

Entropy estimate, crack-time projections, and common-pattern detection. Find out if your password is one dictionary attack away from compromise.

ClassicClient-side

Dockerfile Security Linter

18 rules from the CIS Docker Benchmark and Liz Rice's Container Security. Catches :latest tags, root users, exposed secrets, and supply-chain pitfalls.

OriginalClient-side

Kubernetes YAML Security Scanner

20 checks against Pod Security Standards and NIST SP 800-190: privileged, hostPath, missing securityContext, overly permissive capabilities.

OriginalClient-side

Hash & HMAC Generator

MD5, SHA-1, SHA-256, SHA-512, HMAC variants. For non-cryptographic integrity checks and signature verification.

Coming soon

Secret Pattern Detector

Paste code or config. Scans against 81 regex patterns for API keys, tokens, and credentials. Powered by our SecretScanner catalog.

Coming soon

Why we built these tools

We run Security Factor 365, an AI-first security platform for enterprise development teams. While building it, we kept reaching for tiny utilities: "quick, decode this JWT", "is this Dockerfile hardened?", "does this Kubernetes manifest leak the host filesystem?"

Most of the tools we found on the web were great — but they either uploaded user data to their servers, were cluttered with ads, or missed the security-specific checks we needed. So we built our own, and we're sharing them.

Our privacy promise

Every tool on this page is 100% client-side JavaScript. Your JWT, your password, your Dockerfile, your Kubernetes manifest — none of it ever leaves your browser. There is no backend. There is no server log. There is no telemetry. You can disconnect from the internet after loading the page and the tools still work. Inspect the source if you want to verify it.

When you outgrow these tools

Free, single-file tools are perfect for one-off checks. But when you have hundreds of repositories, dozens of container images in production, and a compliance audit next quarter, you need continuous, correlated, AI-triaged scanning — not a browser tab. That's where Security Factor 365 comes in: 11 scanner engines, SAST + SCA + DAST + IAST + IaC + Secrets + Config + Container + API + AI Security + 12-Factor IaC, all in one platform with AI-assisted remediation and executive reporting.