Bug Bounty Hunter Toolkit
Bug bounty hunters move fast across dozens of targets, probing for injection points, decoding tokens, and crafting payloads. Having the right browser-based utilities at your fingertips eliminates the friction of spinning up scripts for each micro-task. Every tool below runs client-side — your data never leaves your browser.
URL Encoder / Decoder
Encode payloads for URL injection testing or decode percent-encoded strings from server responses. Essential for testing reflected XSS, open redirects, and SSRF vectors where special characters must be carefully encoded.
Base64 Encoder / Decoder
Decode JWT tokens to inspect claims and expiration, encode payloads for Base64-based injection, or decode encoded error messages that reveal internal paths and stack traces.
RegExp Tester
Build regex patterns to extract endpoints from JavaScript files, parse API responses for secrets, or match patterns in page source. Live highlighting shows matches as you type.
cURL Converter
Convert browser requests copied as cURL into structured views. Replay and modify requests with different parameters, headers, or authentication tokens to test for IDOR and privilege escalation.
MD5 / Hash Generator
Generate MD5 and SHA hashes to identify known hashes in password databases, verify file checksums, or test for hash-length extension vulnerabilities. Supports MD5, SHA-1, SHA-256, and SHA-512.
JSON Formatter & Validator
Pretty-print API responses to spot hidden parameters, debug JSON injection points, or analyze GraphQL introspection results. The formatted view reveals structure that raw minified JSON hides.
Hex Converter
Convert payloads between hex and ASCII for WAF bypass techniques, binary protocol analysis, and encoding shellcode for injection testing.
Unicode Converter
Convert between Unicode code points and characters. Useful for crafting Unicode normalization bypasses, testing homograph attacks, and evading input filters that only check ASCII.
WebSocket Tester
Connect to WebSocket endpoints and send custom messages to test for injection, authentication bypass, or information disclosure in real-time communication channels.
IP Address Lookup
Look up IP addresses to identify hosting providers, geographic locations, and ASN information. Useful for reconnaissance and understanding the target's infrastructure.
User-Agent Parser
Parse and analyze user-agent strings to understand how the target handles different clients. Useful for testing user-agent-based access controls and identifying mobile-only endpoints.
RSA Encryptor
Test RSA encryption and decryption to verify key pairs, inspect public keys found during recon, or test for weak key vulnerabilities in exposed certificates.