Checkers
Every checker below runs inside your browser tab. What you paste never reaches a server, so you can use them on a real token or a real schema without leaking it.
- Validate JSON against a schema Paste a JSON Schema and a document to see whether the document validates, and exactly which instance paths fail.
- Decode a JWT Paste a JSON Web Token to read its header and payload, see whether it has expired, and check which algorithm signed it.
- Check a cron expression Paste a cron expression to see the next five runs as real timestamps, in the timezone you choose.
- Check a colour contrast ratio Enter a text colour and a background colour to get the WCAG contrast ratio and see which of the four thresholds it passes.
- Test a regular expression Paste a pattern and a sample to see every match, the capture groups behind each one, and whether the pattern has a shape that can hang a browser tab.
- Convert a timestamp across timezones Paste a Unix timestamp or an ISO 8601 string to see the same instant in several timezones at once, which is how a date that is a day out in one of them becomes visible.
- Verify a webhook signature Compute the HMAC-SHA-256 signature for a payload and secret in the formats providers publish, and compare it with the header you were sent.
- Check a test card number Paste a card number to see whether its Luhn checksum is consistent, which brand the issuer range belongs to, and which payment provider publishes it as a sandbox test card.
Checks that need a server
Reading another site’s TLS handshake or response headers cannot be done from a browser tab: the same-origin policy blocks it. Those checkers need a server that can be rate limited and stopped from scanning hosts on anyone’s behalf, which is not deployed yet. Each page below says what the checker reads, and carries the commands that give the same answer from your own terminal today.
- HTTP/2 and HTTP/3 test Connects to a host and reports which HTTP versions it actually negotiates, which is a different question from what its documentation claims.
- Security headers checker Reads the security headers a URL returns and reports each one with a verdict, including the headers that are absent.
- SSL certificate checker Reads the certificate a host presents: who issued it, when it expires, which names it covers, and whether the chain verifies.
- Redirect chain checker Follows a URL through every redirect and lists each hop with its status code, so an extra hop or a loop is visible.
- Gzip and brotli compression test Requests a URL twice, once asking for no compression and once asking for gzip and brotli, and reports the bytes saved.
- CORS checker Reads the CORS headers an endpoint returns for a given origin, including the preflight response, and says whether a browser would accept the answer.
- robots.txt and sitemap checker Reads a site robots.
- SPF, DKIM and DMARC checker Reads a domain's SPF, DMARC and DKIM records from Google Public DNS and Cloudflare over DNS-over-HTTPS and reports each one parsed, including the SPF lookup count, which gives a permanent error once it passes ten.
- DNS record lookup Asks Google Public DNS and Cloudflare for seven record types of one name over DNS-over-HTTPS, and shows what each resolver returned and where the two differ.
- Meta tag checker Reads the title, meta description, canonical, robots directives and social tags a URL returns, and reports the resolved value of each rather than the raw attribute.
- Health check endpoint test Sends one GET to a health URL and reports its status code, timing and body status, and whether a cache could be answering for the service.