AppSec Engineer Toolkit
Application security engineers review code, triage vulnerability findings, and work with development teams to build secure software. The role demands constant context-switching between code review, threat modeling, and hands-on testing. These free, browser-based tools handle the repetitive technical tasks that fill the gaps between your security scanner runs and design reviews.
JSON Formatter & Validator
Pretty-print API responses to identify hidden parameters, validate JSON schemas for input validation controls, and inspect webhook payloads for injection vectors. Clean formatting reveals issues that minified JSON obscures.
URL Encoder / Decoder
Decode percent-encoded URLs from security scanner findings. Verify that redirect URIs, callback URLs, and deep links are safe from open redirect and SSRF vulnerabilities.
Base64 Encoder / Decoder
Decode JWTs to inspect claims and algorithm headers. Verify that sensitive data in configuration files is encrypted rather than merely Base64-encoded — one of the most common findings in code reviews.
RegExp Tester
Test input validation regex patterns from the codebase to verify they actually block malicious input. Build better patterns for email validation, URL parsing, and content filtering.
MD5 / Hash Generator
Verify that applications use strong hashing algorithms. Generate hashes to test password storage implementations and confirm that deprecated algorithms like MD5 are not used for security-critical functions.
AES Encryptor
Test AES encryption implementations to verify cipher mode, key size, and padding scheme. Confirm that encryption controls in the application match the security requirements in the threat model.
RSA Encryptor
Verify RSA key sizes and test encryption during certificate and TLS configuration reviews. Ensure that key management practices follow OWASP recommendations.
Code Diff Tool
Compare code changes in security-sensitive areas — authentication flows, authorization checks, cryptographic implementations. The visual diff helps you focus on what changed during code review.
WebSocket Tester
Test WebSocket endpoints for authentication bypass, message injection, and cross-site WebSocket hijacking. Real-time endpoints are frequently overlooked in security assessments.
cURL Converter
Reproduce vulnerability findings by converting cURL commands from security scanners into structured requests. Verify issues before filing tickets with development teams.
Password Generator
Generate test passwords of varying complexity to verify password policy enforcement. Test that minimum length, character class, and entropy requirements are correctly implemented.
Hex Converter
Analyze hex-encoded payloads from penetration test findings, decode binary data in API responses, and inspect encoded values found during code review.