Developer Tools
Free, browser-based utilities for SAML, OpenID Connect, tokens, and Keycloak. Everything runs client-side: nothing you paste leaves your browser, and the only requests go to URLs you enter.
Tokens and JWTs
Decode, sign, and verify JSON Web Tokens and the key sets that sign them.
JWT Decoder
Decode and inspect any JSON Web Token, verify its signature, and read its claims in plain English. Keycloak-aware.
JWT Generator
Build and sign test JWTs with HMAC, RSA, ECDSA, or EdDSA. Keycloak-style presets, in-browser key pairs, and PEM/JWKS export.
JWKS Verifier
Fetch or paste a JSON Web Key Set, inspect every key and certificate, catch weak or expired keys, and verify a JWT against it.
OpenID Connect and OAuth
Run real login flows, inspect issuers, and lint the URLs your apps send.
OIDC Playground
Run the authorization code + PKCE flow against Keycloak or any OIDC provider step by step: authorize URL, token exchange, verified tokens, userinfo, refresh, and logout.
OIDC Discovery Inspector
Inspect any issuer's .well-known/openid-configuration: endpoints, supported features, and lint checks for issuer, PKCE, and algorithms.
Authorize URL Inspector
Paste an authorize or callback URL to lint PKCE, state, nonce, and redirect_uri, flag implicit flows, and explain OAuth and Keycloak errors in plain English.
PKCE Generator
Generate a code_verifier and S256 code_challenge, or compute the challenge for a verifier you paste.
SAML and certificates
Read SAML messages and the X.509 certificates behind them.
SAML Decoder
Decode SAMLResponse and SAMLRequest messages from base64, redirect URLs, or XML, check expiry, and verify the signature. Keycloak-aware.
X.509 Certificate Decoder
Decode PEM, DER, and SAML metadata certificates and CSRs. Validity, SANs, key usage, SHA-1/SHA-256 fingerprints, and chain order checks.
Keycloak
Check client configurations and stand up Keycloak locally.
Keycloak Client Security Checker
Paste a client or realm export to find wildcard redirect URIs, missing PKCE, password grants, broad scopes and weak SAML signing, with the fix for each.
Keycloak Docker Compose Generator
Generate a docker-compose.yml and .env for Keycloak with your database, reverse proxy, TLS, and healthchecks. Passwords generated locally.