E
Endlessus Academy SECURITY TOOLS & WORKBENCH
bolt ZERO-TELEMETRY IN-BROWSER SECURITY TOOLKIT

Security Tools, Encoders & Payload Workbench

All computations run 100% locally in your web browser. No inputs, keys, or passwords ever leave your machine. Use these utilities to inspect encodings, calculate CIDR network boundaries, verify cryptographic hashes, and study defensive security.

Security Note: Encoding (Base64, URL, Hex) is NOT encryption or hashing. Encoded strings can be decoded by anyone without a secret key!

transform Multi-Format Encoders & Decoders

Safely convert between text representations and encoding schemes. Supports UTF-8 Unicode characters and URL-safe modes.

Input Text 0 chars • 0 bytes
Output Result 0 chars • 0 bytes
Results appear here...

bug_report Educational Security Payload Workbench

Structured, documented security test strings categorized by vulnerability context. Learn how each payload works, observe its expected lab behavior, and study proper secure coding mitigations.

search

lan IPv4 & CIDR Subnet Calculator

Calculate network boundaries, broadcast addresses, usable host ranges, and wildcard masks instantly.

Property Calculated Value Binary / Details

tag Common Network Ports Quick Reference

Essential well-known network services, transport protocols, and cybersecurity audit considerations.

search
Port Proto Service Standard Purpose Security Significance

fingerprint Cryptographic Hashing & Verification

Calculate cryptographic hashes in real time using the native browser Web Cryptography API (`crypto.subtle`). Demonstrates the Avalanche Effect where changing one letter flips the entire output.

SHA-256 (256-bit Digest)
Computing...
SHA-512 (512-bit Digest)
Computing...
SHA-1 (160-bit Legacy Digest)
Computing...

Hash Identifier Helper

Paste an unknown hash string to analyze its character length and potential candidate algorithms.

http HTTP Security Headers Reference

Essential HTTP response headers used to protect modern web applications from Clickjacking, XSS, and transport downgrade attacks.

Strict-Transport-Security (HSTS) Transport Layer
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Forces web browsers to communicate exclusively over encrypted HTTPS for the next year (31,536,000 seconds), permanently defeating SSL stripping downgrade attacks.

X-Frame-Options Clickjacking Defense
X-Frame-Options: DENY

Instructs the browser never to render this web page inside an <iframe>, <frame>, or <object>, preventing transparent overlay Clickjacking attacks.

Content-Security-Policy (CSP) XSS Mitigation
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'

Specifies authorized origins from which scripts, images, and fonts may be loaded, mitigating Cross-Site Scripting (XSS) and data exfiltration.

Set-Cookie Security Flags Session Security
Set-Cookie: session=xyz123; Path=/; Secure; HttpOnly; SameSite=Strict

Combines HttpOnly (blocks JavaScript access via document.cookie), Secure (HTTPS-only transmission), and SameSite=Strict (blocks Cross-Site Request Forgery CSRF).

analytics Text Metrics & Shannon Entropy Estimator

Inspect text length, encoding boundaries, and calculate Shannon entropy (0 to 8.0 bits/byte) to evaluate information density, encryption, compression, or token randomness.

Characters
0
Bytes (UTF-8)
0
Entropy
0.000
Entropy Rating
Empty
Shannon entropy measures the average information density per byte. Typical English text scores 3.5–5.0; random cryptographic keys and encrypted payloads score > 7.2 bits/byte.

data_object Canonical Hex Dump Generator

Generate classic 16-byte canonical hex dumps with 8-digit hexadecimal offset addresses, two 8-byte space-separated hex columns, and printable ASCII translation. 


      


      
      

        

          difference
          Text Inspector & Comparison
        

        

          Compare two text blocks to inspect byte differences, whitespace discrepancies, and character counts.