DeeCon

Inspect HTTP/security headers and CSP; detect web tech; decode/forge JWTs; export requests as cURL/HTTPie/Python, PDF, or JSON.

DeeCon inspects the current tab's HTTP request and response headers in a clean, readable popup — and goes further with a built-in JWT toolkit and one-click export to your terminal or scripts. It's built for developers, security learners, bug bounty researchers, and QA testers who want fast, local visibility into how a site responds. Features: - View request and response headers for the active tab - Analyze common security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy — with a 0–100 security score - Get a CSP directive-by-directive breakdown and a cookie attribute check (Secure, HttpOnly, SameSite) - Detect web technologies: JS frameworks, UI libraries, CMS platforms, analytics tools, CDNs, and servers - Decode JWTs found in headers automatically, flag weak or missing signatures (alg:none, symmetric HS*), edit the header/payload, and re-sign with HS256/384/512 - Surface header-based issues: missing security headers, server version disclosure, weak cookie flags, CORS misconfiguration hints - Export the current request as a ready-to-run cURL, HTTPie, or Python snippet - Export the full report as PDF or JSON - Search through captured headers and findings - Copy individual headers or all headers at once - Light and dark theme, matched to your browser DeeCon processes everything locally in your browser. It never sends captured headers, page technology signals, or token contents to an external server.