DevSec Toolkit - JWT, Headers & JSON Tools

Free JWT decoder, security headers checker, secret scanner, JSON formatter, Base64 & hash tools. Runs 100% locally.

Scan pages for headers, secrets & cookies. JWT, Base64, JSON, regex, network & Burp—100% local. What each tool does Scan — Passive check of the active tab: security headers, mixed content, secrets/JWTs, source maps, storage keys, optional cookie flags; add findings to a report. JWT — Decode header/payload locally; flag weak alg, expiry, risky claims (no signature verify). Convert — Base64/URL/HTML/hex encode-decode, SHA hashes, Unix timestamp converter. JSON — Format, minify, validate with exact error line/column. Regex — Live match testing with capture groups; runaway patterns are stopped. Report — Collect findings; export Markdown/HTML or copy Markdown. Network — Live request console (method, URL, status, timing, headers). No full bodies. Burp — One-click proxy to 127.0.0.1:8080 (Burp must be running; trust Burp CA for HTTPS).