Paste any text — extracts IPs, domains, URLs, file hashes, CVEs and emails instantly.

Convert IOCs between defanged (hxxp://evil[.]com) and active formats for safe sharing.

Parse raw email headers to trace routing, spot spoofing, and read SPF/DKIM/DMARC results.

Search 56 MITRE ATT&CK techniques and tactics by ID or keyword — with direct links.

Pretty-print, validate and explore JSON logs and SIEM API responses.

Generate reverse shell one-liners for Linux and Windows across all common methods.

35+ XSS payloads: basic, filter bypass, event handler, DOM, template injection, polyglot.

50+ SQL injection payloads: error-based, union, blind, time-based, WAF bypass, auth bypass.

40+ SSRF payloads — localhost bypasses, cloud metadata endpoints (AWS/GCP/Azure), protocol schemes.

Command injection one-liners for Linux and Windows — blind, WAF bypass, chained payloads.

Path traversal, encoding bypass, PHP wrappers, log poisoning paths, and sensitive file targets.

Compose Google dork queries with operators. Presets for file leaks, panels, creds, and dirs.

Decode and inspect JSON Web Tokens — header, payload, signature.

Percent-encode or decode URL components for web testing.

Chain multiple encodings (URL, Base64, HTML entity, hex, unicode) to build WAF-bypass payloads.

Reference for 20+ HTTP security headers — CSP, HSTS, CORS, COOP, COEP — with example values.

Interactive CVSS v3.1 base score calculator. Select metrics, get score, severity, and vector string.

Compute MD5, SHA-1, SHA-256, SHA-512 hashes for any input.

Paste a hash — instantly identifies MD5, SHA family, bcrypt, NTLM, Argon2 and more.

Encode or decode text and binary data using Base64.

Convert text to hexadecimal and back — useful for payloads and escaping.

Encrypt or decrypt text with a Caesar shift cipher. ROT13 built in.

Convert integers between binary, octal, decimal and hex. Shows ASCII too.

Calculate network address, broadcast, host range and mask from CIDR.

Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and PTR records via Cloudflare DoH.

Country, city, ASN and timezone lookup for any IP address.

Searchable reference of 60+ common ports (with risk) and all HTTP status codes.

RDAP-based WHOIS for domains, IPs, and AS numbers. Registrar, dates, nameservers, netblocks.

Passive subdomain enumeration via certificate transparency logs (crt.sh). No active scanning.

Live regex matching with match highlighting and named capture groups.

Line-by-line diff of two texts — config comparison, log analysis, response diffing.

Parse cron expressions, validate fields, and preview next 6 scheduled run times.

Convert UNIX timestamps to human-readable dates and vice versa.

Check the strength and breach status of your passwords.

Generate strong, random passwords with custom rules.

Generate RFC 4122 UUID v4 values in bulk. Analyze existing UUIDs — version, variant, timestamp.