Security & Privacy
JWT Inspector
Decode a JWT header and claims in your browser, inspect expiry timestamps and identify review points. Decoding does not verify a signature.
Open toolTHE METACYBERGURU TOOLBOX
OSINT, developer and security tools.
Your data stays with you.
Organise public-source evidence, calculate a checksum or review a configuration. Choose a focused utility, try its sample and see exactly where its conclusions stop.
Free to useNo account requiredNo AI calls
Start with the OSINT Workbench or extract indicators from supplied text.
Pick the right tool
26 tools available
No matching tool. Clear the search or choose another category.
Security & Privacy
Secret Redactor
Redact recognisable credentials and an optional exact text value before sharing logs. Work locally and review the output for anything the rules miss.
Open toolDeveloper Tools
GitHub Actions Workflow Checker
Parse GitHub Actions YAML locally and review permissions, action references and selected script-injection patterns. No repository access or workflow execution.
Open toolAndroid Tools
Android Manifest Reviewer
Review AndroidManifest.xml locally for debug settings, permissions, cleartext and exported components, with target-SDK context and honest limitations.
Open toolSecurity & Privacy
HTTP Security Headers Reviewer
Review pasted HTTP response headers for selected browser security protections. Local analysis only, without crawling a website or fetching a URL.
Open toolReports & Checklists
Security Report Builder
Organise your own security findings, evidence and remediation into a local Markdown report. No invented vulnerabilities, automatic severity or uploads.
Open toolSecurity & Privacy
OAuth Configuration Reviewer
Review supplied OAuth configuration declarations for legacy grants, PKCE, redirect matching and selected token controls. No login or identity-provider connection.
Open toolDeveloper Tools
OpenAPI Document Reviewer
Review OpenAPI 3.0.x or 3.1.x JSON and YAML for selected authentication, operation, reference and path-parameter issues. No API requests or remote reference loading.
Open toolInfrastructure
Dockerfile Static Reviewer
Review Dockerfile text for selected image-pinning, user, credential-name and download patterns. No build, image pull, command execution or vulnerability database lookup.
Open toolInfrastructure
Docker Compose Reviewer
Review one Compose YAML document for privileged services, engine sockets, host mounts, published ports and selected hardening declarations. No container or engine access.
Open toolInfrastructure
Kubernetes Manifest Reviewer
Review Kubernetes YAML resources for selected pod, container, RBAC and exposure declarations. Supports multiple documents without connecting to a cluster.
Open toolInfrastructure
AWS IAM Policy Reviewer
Review AWS IAM policy JSON for selected structural, wildcard, exclusion and principal concerns. No AWS connection, permission simulation or other-cloud policy support.
Open toolPublic-source Research
Public Domain OSINT Workbench
Normalise public organisation domains and URLs, remove duplicate targets and organise supplied source evidence. Nothing is searched or fetched.
Open toolPublic-source Research
IOC Candidate Extractor
Extract candidate URLs, domains, IP addresses and hexadecimal hashes from supplied text. Deduplicate and defang them without visiting a destination.
Open toolDeveloper Tools
SHA Checksum Calculator
Calculate a SHA-256, SHA-384 or SHA-512 digest from UTF-8 text or raw local file bytes. Optionally compare an exact expected hexadecimal digest.
Open toolSecurity & Privacy
Public Certificate Inspector
Read a public PEM certificate, stated validity dates, algorithms, names and SHA-256 fingerprint without contacting a server or verifying a trust chain.
Open toolAndroid Tools
Java and Android Crash Outline
Outline supplied Java exception headings, cause chains and stack frame locations. No invented diagnosis, code execution or log upload.
Open toolInfrastructure
Supplied DNS Record Reviewer
Enter DNS record rows to review selected value syntax, CNAME conflicts and mail-policy points. No DNS request or live-zone claim.
Open toolDeveloper Tools
Dependency Inventory Builder
Inventory supplied package declarations, npm lockfile entries or simple pinned Python requirements. No package download or current advisory lookup.
Open toolInfrastructure
IPv4 CIDR Calculator
Calculate an IPv4 CIDR range, mask, wildcard and host arithmetic locally, with explicit /31 point-to-point and /32 host-route assumptions.
Open toolSecurity & Privacy
CVSS v3.1 Base Calculator
Calculate a CVSS v3.1 Base score from eight explicit metrics using the FIRST formula and integer rounding guidance.
Open toolReports & Checklists
Self-Reported Security Checklist
Organise supplied yes, no, unknown and not-applicable answers for deployment, privacy, IoT, Active Directory, Linux or Windows reviews.
Open toolSecurity & Privacy
Upload Policy Reviewer
Review declared file-upload settings for allowlists, size limits, storage and selected protection controls. No files are uploaded or executed.
Open toolDeveloper Tools
API Access Matrix Planner
Build positive and negative authorisation test cases from declared routes, roles and object-ownership rules. No requests are sent.
Open toolDeveloper Tools
GraphQL Query Reviewer
Parse a GraphQL document locally, expand named fragments and inspect field depth, alias breadth and schema-introspection references.
Open toolDeveloper Tools
JavaScript Syntax Pattern Checker
Parse JavaScript with Acorn and locate selected code-generation, HTML-writing and exec-shaped syntax patterns without running the code.
Open toolChecks you can understand
A warning should explain a concrete observation. The tools show what they read and where interpretation needs more context. They do not invent a safety score, test an application without permission or certify that a system is secure.
Each utility includes a harmless sample and source-linked documentation. Start there if the input format is unfamiliar.
Local processing has limits
The page and its code are downloaded from this website. The hosting provider may log that page request under the site Privacy Policy. Your pasted input is processed in tab memory and is not included in a request, URL or saved browser setting by these tools.
Browser extensions, clipboard history, screenshots and downloaded files are outside that boundary. Reset clears the workspace; it is not a guarantee of secure memory erasure. Use synthetic data whenever you can.