Security tools — inspect, then paste into staging
These pages decode, generate snippets, or hash in the tab. They are not a pentest lab, not a WAF, and not a substitute for your IdP library. The distinctive work on DroidXP is still APK and permission inspection.
Decision guide
- I have a JWT and need to read claims → JWT decoder. Base64url only. No signature check. JWE (five segments) is out of scope.
- The browser blocks my API until CORS exists → CORS header generator. One origin. Does not send OPTIONS.
- I need Apache rewrite / cache / SPA blocks → .htaccess generator. Not Nginx. Test on staging.
- I just need a random password → that generator is a commodity clone. Use it if you are already here; it is not the publication.
Path A — A token on the clipboard
Paste a three-segment JWS. Read alg, iss, aud, exp. Then verify on a trusted backend with the issuer’s keys.
A decoded exp in the future is not authentication — anyone can mint that JSON.
Related desk tool: put Authorization: Bearer … into the
HTTP request builder (text only; it does not call the API).
Path B — Browser origin vs API origin
CORS is a browser rule, not a lock. curl still works. The generator prints Apache Header set or Nginx add_header … always for one Allow-Origin.
* plus credentials is refused here because browsers refuse it. Multi-origin allowlists belong in application code.
Path C — Apache on a host you control
HTTPS, www vs apex, gzip, long cache, SPA index.html fallback, -Indexes, blocks for .env / .git.
Missing mod_rewrite is a 500. SPA catch-all will swallow /api unless you add conditions. Merge carefully with WordPress / Laravel rules.
What we keep on the shelf (and what we do not pretend)
Password generators, strength meters, hash toys, “encrypt in the browser,” API-key strings, and SSL hostname lookups are common on the web. We do not pretend they are a security product. Indexed security pages: JWT decode, CORS snippets, Apache snippets.
Frequently asked questions
Should I paste production secrets?
Follow your policy. Even local tools sit in a tab on a machine you may not fully control.
Does the JWT page validate signatures?
No. Decode only.
Which page should a reviewer open first?
The Android hub. This hub is the adjacent desk for tokens and headers.