Security Lab

Browser-first tools for JWT analysis, API key inspection, regex workbench, and dependency confusion triage.

JWT Token

Header

{}

Payload

{}

Security Checks

HMAC Secret Brute-Force

Recover the signing secret of an HS256/384/512 token by testing a wordlist server-side, in parallel. Paste a token above, then crack.

Include bundled common-secrets wordlist

Pattern

Flags

Input Text

Regex Definitions (optional)

Load many regexes at once from regexes.yaml. When loaded, Run Scan runs every definition against loaded JS file(s) (uploads/URLs) or falls back to the input text.

regexes.yaml upload

JS file upload(s)

JS file URLs (one per line)

Matches

Dependency Manifest Content

Or load manifests from URL(s)

Paste one URL per line. Each URL will be fetched and analyzed independently. Note: if a remote server blocks CORS, you may need to paste content instead.

Potential Dependency-Confusion Risks

Allowed Hostname

Attacker Hostname

Payload Filter

0 payloads loaded

Generated Payloads

Loading payloads...

Target Domain

Generates search-engine dorks (Google, GitHub, Shodan, crt.sh, Wayback…) for the target. Clicking a card opens the search in a new tab. Use only on authorized targets.

Filter

0 dorks

Quick Recon Links

Generated Dorks

Subdomain & DNS Takeover Reference

Comprehensive database of vulnerable services and DNS providers. Use this to validate if your DNS takeover findings are exploitable.

Vulnerable

Not Vulnerable

Total

Loading subdomain takeover data...

Vulnerable

Not Vulnerable

Edge Case

Total

Loading DNS takeover data...