devtoken.tools

// security tools for auth, web and AWS

Check tokens, headers and IAM policies without handing them over.

Free tools for finding security mistakes in your own apps, APIs and AWS accounts. Paste a JWT, your response headers, an IAM policy or a security group: it's checked in this tab and never sent anywhere.

Audit an IAM policy Decode a JWT
EXAMPLE · AWS IAM POLICY AUDITOR LOCAL

A role trust policy for GitHub Actions deploys:

"Principal": { "Federated":
  "…:oidc-provider/token.actions.githubusercontent.com" },
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": { "StringEquals": {
  "token.actions.githubusercontent.com:aud":
    "sts.amazonaws.com" } }
  • FAIL

    No sub condition: any GitHub Actions workflow, in any repository, can assume this role.

  • FIX

    Pin sub to one repository and environment, e.g. repo:example-org/web-app:environment:prod.

Checked in this tab. Nothing was sent.

// start from the problem

What are you trying to find out?

Pick the question closest to yours, or paste an error message or header name into the search box at the top: it matches them to the right tool.

// where your data goes

One rule, and every tool is labelled with it.

What you paste stays in your browser. The only exception is when you choose to share something, and then it is stored briefly. Full details, the exact security header, and how to check it yourself.

LOCAL 17 tools

Runs in your browser

your input tool, in this tab result server
  • Built on standard browser APIs such as Web Crypto.
  • Nothing you paste is sent, logged or stored. No tracking scripts, and no third-party requests: fonts and scripts come from devtoken.tools itself.
  • Enforced by your browser: each LOCAL page's Content-Security-Policy sets connect-src 'none', so the page can't send what you paste anywhere.
  • Check it yourself: open DevTools, go to the Network tab, and use any tool.
SHARED · 1H 2 tools: Code Share, Pen

Stored only when you share

your code you click Share server, deleted 1h after last edit
  • Nothing is uploaded until you create a link.
  • Code Share passwords: encryption happens in your browser (AES-256-GCM). The server keeps ciphertext only, never the password.
  • Pen previews run in a sandboxed iframe. Shared pens wait for you to press Run.
  • Your IP address is used to rate-limit link creation.

// tools

Everything, one click away.

// tokens & auth

// web security & network

// aws

// crypto & encoding

// share & run