Utilities
Encoders, JWT and HTTP parsers, recon extractors, CVSS, and transform helpers - 100% in your browser, nothing sent anywhere.
What is on this page
Every utility runs in your browser. Nothing you paste is sent to vulns.co.
- Triage and evidence - Compare two responses, map evidence to impact, and triage pasted JavaScript or URL lists.
- Encode - URL, Base64, hex, HTML entity and Unicode encoding and decoding.
- Transform - Chain several encoding steps and see each stage.
- Crypto and JWT - Decode and inspect JSON Web Tokens, compute hashes and HMAC signatures.
- HTTP and headers - Read Content-Security-Policy, CORS and cookie headers and see what they allow.
- Extractors - Pull URLs, endpoints and parameters out of pasted text.
- Recon - Helpers for organising hosts and discovery output.
- Network and time - IP, CIDR and timestamp conversions.
- Text and JSON - Format JSON, diff two texts and test regular expressions.
- Identity - Identify hash and token formats.
- Scope sort - Sort a pasted host list into in scope, out of scope and unknown against a program's rules.